Trojaner-Board - Cibs pol (schweiz)

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Cibs pol (schweiz) (https://www.trojaner-board.de/135661-cibs-pol-schweiz.html)

Cibs pol (schweiz)

Hallo

Ich habe mir diesen nervigen Cibs Pol Virus (Schweiz) eingefangen. Nun habe ich keine Ahnung, was ich tun soll und wäre sehr froh, wenn mir jemand helfen könnte.

Freundliche Grüsse

Code:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 22:17:01, on 27.05.2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v8.00 (8.00.7601.17514)

Boot mode: Safe mode with network support
 

Running processes:

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe

C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://g.uk.msn.com/HPCON/12

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://searchab.com/?aff=7&uid=10fce665-4fac-11e2-acef-00ade1ac1c1a

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://g.uk.msn.com/HPCON/12

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://searchab.com/?aff=7&uid=10fce665-4fac-11e2-acef-00ade1ac1c1a

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\IPSBHO.DLL

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\coIEPlg.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [HPCam_Menu] "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam" UpdateWithCreateOnce "Software\Hewlett-Packard\Media\Webcam"

O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM\..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe

O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

O4 - HKLM\..\Run: [NortonOnlineBackup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files (x86)\DVD Maker\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

O4 - HKLM\..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe

O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

O4 - HKCU\..\Run: [HP Officejet 6700 (NET)] "C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe" -deviceID "CN27V7B22505RQ:NW" -scfn "HP Officejet 6700 (NET)" -AutoStart 1

O4 - HKCU\..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload

O4 - HKCU\..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup

O4 - HKCU\..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\cowiga.dat,FG00

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')

O4 - Startup: msconfig.lnk = C:\Windows\System32\rundll32.exe

O4 - Startup: Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk = ?

O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?

O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Bluetooth.lnk = ?

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Free YouTube Download - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm

O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe

O9 - Extra 'Tools' menuitem: SmartPrint - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe

O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} (WRC Class) - h**p://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx

O17 - HKLM\System\CCS\Services\Tcpip\..\{C089350C-6EEE-4182-8057-A250ACEAF6AC}: NameServer = 195.186.1.111,195.186.4.162

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

O20 - AppInit_DLLs: c:\progra~2\zoomex\sprote~1.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\AESTSr64.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Avira Planer (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira Echtzeit-Scanner (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe

O23 - Service: Google Update-Dienst (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe (file missing)

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\ccSvcHst.exe

O23 - Service: Norton Online Backup (NOBU) - Symantec Corporation - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Sesam Control Service (SesamService) - Swisscom - C:\Program Files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: SpyHunter 4 Service - Enigma Software Group USA, LLC. - C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE

O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\STacSV64.exe

O23 - Service: UDM Service - Swisscom - C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: Cisco AnyConnect Secure Mobility Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
 

--

End of file - 17080 bytes

Hi, bitte kein HIjackthis mehr verwenden.

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

C:\Windows\system32\*.tsp

/md5start

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

explorer.exe

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\*.dll /lockedfiles

%USERPROFILE%\*.*

%USERPROFILE%\Local Settings\Temp\*.exe

%USERPROFILE%\Local Settings\Temp\*.dll

%USERPROFILE%\Application Data\*.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

hoffe das stimmt so.

danke!

Code:

OTL Extras logfile created on: 27.05.2013 23:30:58 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\roman\Downloads

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy

 

3,91 Gb Total Physical Memory | 3,23 Gb Available Physical Memory | 82,83% Memory free

7,81 Gb Paging File | 7,18 Gb Available in Paging File | 91,93% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 281,66 Gb Total Space | 161,03 Gb Free Space | 57,17% Space Free | Partition Type: NTFS

Drive D: | 16,13 Gb Total Space | 2,64 Gb Free Space | 16,34% Space Free | Partition Type: NTFS

Drive E: | 99,34 Mb Total Space | 92,74 Mb Free Space | 93,36% Space Free | Partition Type: FAT32

 

Computer Name: PC-ROMAN | User Name: roman | Logged in as Administrator.

Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htafile [open] -- "%1" %*

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htafile [open] -- "%1" %*

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0362E4C7-1953-4ACD-BC6C-AFCAF667086C}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{094C4BA8-A2B1-43EA-818C-7E9C97F1C4A9}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{09DC47FD-D457-49BF-8921-14FBA84E8D2A}" = rport=139 | protocol=6 | dir=out | app=system | 

"{109BC759-F531-4E63-8352-C797A1FE853C}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{1187EB4B-61ED-421C-B163-09FD546E3763}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{1EED7BB7-3DD3-462A-9B5E-45AAEAED89DF}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{21125F55-69B0-4485-A6D5-F0AB148BED32}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{21970019-B6EA-4150-A4BE-4714A84FD849}" = rport=137 | protocol=17 | dir=out | app=system | 

"{359E9CEB-C168-4854-9B62-C009CC4EC36E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{3CA2B260-6346-4C65-8436-67FF3310B0EF}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{41E135D4-4924-4A0E-9642-5B8BD7D34790}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{4E94EBCD-53A1-4FA7-81B4-7FD58FB9A7F9}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{54195E1B-8CC4-43CA-96AE-5E2B976E62BE}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{58D107A2-3FED-45E1-8888-468264AE4F77}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{62707D88-63D0-4F67-A7D8-9E06A18602F9}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{633C47AD-2690-43A5-A88A-03EE5A6F6349}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{712015B2-7642-4DDF-84D5-1F1A18FDECA1}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | 

"{80CE27AF-FD50-4952-B80C-91366924F352}" = rport=445 | protocol=6 | dir=out | app=system | 

"{84E06E65-BC6E-417D-BFB4-0B6BF0D869E0}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{8878AB46-B32F-4096-90C8-0FD1F2B9BB1C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{8AA57E56-FE3E-4A5E-99EF-353442A87B25}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{8C394F3E-F3AE-4ACB-B9F1-4139EB45D31D}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{8FF7ECD9-E050-423C-98DF-0AA6519087B4}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{9FFB7D70-2334-405D-A8A3-4E175CCE14F6}" = lport=137 | protocol=17 | dir=in | app=system | 

"{A17EE2CA-6433-4A4A-8F44-E94AAA2C2E74}" = rport=138 | protocol=17 | dir=out | app=system | 

"{A239244D-B6ED-47F0-94DA-223CA2E01CD5}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{A3FA7BED-1482-493B-B10B-1B0A8B0FA888}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{A469DB4B-E0AC-4733-8A31-5A5930279160}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{A5901E9F-9687-4FA7-A8E4-2AF79B3A8DFD}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{B5893317-3631-4264-B463-A59702207E44}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{B7381546-DCF1-44D2-BE8F-44E20BA2B1C5}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{BF1CB28D-BE38-4F8C-B4F1-8059078DF2CB}" = rport=2869 | protocol=6 | dir=out | app=system | 

"{C07C9059-D7D3-4A02-9505-45BF5E4C9435}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{C1A4621E-F2BE-4CCE-9EA2-035638E33D8C}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{C4BC1696-A9BA-4E62-87ED-B8065A614AD0}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{C676D9CB-EE26-4A86-AEA2-A929D4E19E42}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{C73B4989-5AA8-4566-AC31-7AF20AF29F1F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{E348EFC1-177E-47BC-9DB3-97FE445B14D5}" = lport=138 | protocol=17 | dir=in | app=system | 

"{E4F29DA0-5103-4FEC-8064-48AEF6B93DFD}" = lport=445 | protocol=6 | dir=in | app=system | 

"{E50D6F21-28BA-431D-85D7-DE763853FCEB}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{EF65BE4D-4127-4630-A303-8D21CC6218ED}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{F9B23092-1184-4445-8131-AD56FCC16BE8}" = lport=139 | protocol=6 | dir=in | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{038BC5BE-6D08-4599-9081-39C97CF60459}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{06DA1155-FFCC-4777-949B-C6ABB0A87EBC}" = protocol=6 | dir=in | app=c:\program files (x86)\dvd maker\adobe\adobe version cue cs2\bin\versioncuecs2.exe | 

"{0788285A-E0D0-4538-84A5-64B50B88A3A5}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 | 

"{120E39E5-1907-4070-8B4F-1CE7D196CD6A}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 

"{124A0479-26E1-4557-924A-CAC20C5AB43D}" = dir=in | app=c:\program files\hp\hp officejet 6700\bin\devicesetup.exe | 

"{216D51C0-8776-46FE-8A95-EC5C6B3CE1AB}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 

"{23F796DE-2EF7-4BEC-9DEB-6261904F939E}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{242A7574-755F-47D0-93AC-99514A8A7BE1}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe | 

"{2607A209-C8B6-4FFC-BBD2-9197BCC5AEBF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{2C1B6FC0-4D0B-4C6D-8E07-3D0D08E15BEC}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartphoto.exe | 

"{2E052690-1EC2-4CE0-A94C-2E43E540D0CC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{3253251B-067D-4E6C-95F6-7B62A6366ED9}" = protocol=17 | dir=in | app=c:\program files (x86)\dvd maker\adobe\adobe version cue cs2\bin\versioncuecs2.exe | 

"{350E8CCA-6081-4423-B573-DB1B879EBF89}" = protocol=6 | dir=in | app=c:\users\roman\appdata\roaming\utorrent\utorrent.exe | 

"{3602B1EC-E8F7-4B4F-8E9C-61734C27ECCC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{3835F621-9F56-4169-9BAB-A78F614DDDCF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{4230A5A3-451C-4E8A-A839-6C7B7C2ABFB2}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{4C50DA9D-EC92-451C-8E1D-8C243CD31B2C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{5518986C-F016-4BD2-B2DE-B2A74B4B9855}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{5B8AAE7D-77AE-418B-9F4D-96726521FE9C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{5FC0BA1E-24BD-4039-8FA5-4E25A28DB65B}" = protocol=58 | dir=in | app=system | 

"{67FB1454-7698-4A13-A0C0-F8F56DAC43FA}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hpdvdsmart.exe | 

"{685557CF-562F-4E18-9073-8E3AB84446B8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{69B5DABD-0273-4306-AB7B-E4A7569A9098}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartvideo.exe | 

"{69DE3597-E657-43D3-B1E5-417CF0A1BFDB}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 

"{6A1D170A-D0A0-48DC-83CF-0AFACD761F2B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{6D3DA208-4DDA-4822-B6EC-ECDF3ECEC8E6}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartmusic.exe | 

"{77FB70C6-4E8C-4FB1-B9F3-91EE7216FBAA}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\kernel\clml\clmlsvc.exe | 

"{7AC84624-16B1-40C5-AC1E-9BF73F0D4E5B}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartvideo.exe | 

"{7EBE595C-7DED-4899-A623-2D3ED7A92905}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\tsmagent.exe | 

"{8B8B63F1-F3A5-4888-95E0-90B3534F5657}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{8F2800BB-5AF7-4860-A547-945993F28A24}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 

"{95573419-BF60-4696-ADB1-C067D0047482}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | 

"{A15569D1-9421-42A3-BAF4-5C02A50384A1}" = protocol=17 | dir=in | app=c:\users\roman\appdata\roaming\utorrent\utorrent.exe | 

"{A55212FC-ADF3-4AB0-857F-1A57279C5374}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 

"{A735232A-149F-413F-890D-E9801BAA8724}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\tsmagent.exe | 

"{ABAE7B12-A9C3-40B4-A9C7-0C30A5BDB64D}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{AC7FBE7F-AB3A-4978-B4CD-10092DFA9029}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{B22526D0-EA3C-4295-ACD4-8F6525A7FD46}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartphoto.exe | 

"{B97547DC-FEA2-47AE-89B2-2CACDBB2752E}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 

"{C18678F4-0C79-4539-9ADA-4EA5E396B7F7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{C663BC1D-47F1-4A79-92B0-F360FDD15571}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 

"{C6791FA5-BD09-44B2-AE6C-4D03278664E1}" = protocol=6 | dir=out | app=system | 

"{CC48D623-98DF-4FF9-AF09-0B2816F25F7A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{CC8395C4-97AE-4387-855D-48F51F986ED7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{CDD5DD03-323A-4E35-8EC2-EB2F3C8DAB82}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{D1EF865D-F1D7-44AA-A5A3-20E69FB0B370}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\kernel\clml\clmlsvc.exe | 

"{DCB9D98A-C577-4FC6-8312-A16ADC33F99C}" = dir=in | app=c:\program files\hp\hp officejet 6700\bin\hpnetworkcommunicator.exe | 

"{DDE1C4CF-B938-414F-9196-46F5E8CD7E67}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartmusic.exe | 

"{EAF9D729-E773-4DC2-A162-900002144100}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{F74352F6-7288-40E4-8360-235069EF426F}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 

"{FE725FAA-1B1F-484D-96F0-1A5290F27544}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"TCP Query User{306334E6-6C42-4E4E-98E6-AA88034209C5}C:\program files (x86)\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tvuplayer\tvuplayer.exe | 

"TCP Query User{4F68A105-18DC-4EB1-8732-0E703D8EADA5}C:\program files (x86)\symantec\norton online backup\nobuclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\symantec\norton online backup\nobuclient.exe | 

"TCP Query User{5DD87E9F-8247-46B5-8EF1-FF94F7413C36}C:\program files (x86)\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe | 

"TCP Query User{66D2C514-A20B-4039-82D4-0D3BE0FFAFFE}C:\program files (x86)\symantec\norton online backup\nobuclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\symantec\norton online backup\nobuclient.exe | 

"TCP Query User{7D7C8F78-9671-4E6E-8E34-883180653AF2}C:\users\roman\appdata\roaming\torrentstream\engine\tsengine.exe" = protocol=6 | dir=in | app=c:\users\roman\appdata\roaming\torrentstream\engine\tsengine.exe | 

"TCP Query User{7FF6AAE7-3154-4B6B-A6FC-A2B9412F5A07}C:\users\roman\appdata\roaming\torrentstream\engine\tsengine.exe" = protocol=6 | dir=in | app=c:\users\roman\appdata\roaming\torrentstream\engine\tsengine.exe | 

"TCP Query User{A03998FB-0E04-4588-8A10-A5B328DE6671}C:\program files (x86)\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe | 

"TCP Query User{A9AED419-EA11-4062-B1FC-FD4F50F1BA0E}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 

"TCP Query User{BF10DC8C-A39E-44A7-8BFA-63DA157F1F43}C:\windows\system32\javaw.exe" = protocol=6 | dir=in | app=c:\windows\system32\javaw.exe | 

"TCP Query User{BF683607-9B30-4C37-A2E7-73598CFF36F3}C:\program files (x86)\mediamonkey\mediamonkey (non-skinned).exe" = protocol=6 | dir=in | app=c:\program files (x86)\mediamonkey\mediamonkey (non-skinned).exe | 

"TCP Query User{E90A10D5-0EAC-47DB-85F5-7D9714D5E833}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 

"TCP Query User{ED64122F-651B-4387-A4F0-26C7B38B7CD1}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 

"TCP Query User{F69588F6-FFAE-4C74-B105-233DF45D062E}C:\program files (x86)\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sopcast\adv\sopadver.exe | 

"TCP Query User{FB3A3444-4BDB-4A2D-A1CC-3E366D9A4FF3}C:\program files (x86)\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sopcast\adv\sopadver.exe | 

"UDP Query User{157036A6-F1EE-48C8-9030-55268E213290}C:\program files (x86)\symantec\norton online backup\nobuclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\symantec\norton online backup\nobuclient.exe | 

"UDP Query User{1A0071B8-0E72-497E-8B4E-D262109B2FF4}C:\users\roman\appdata\roaming\torrentstream\engine\tsengine.exe" = protocol=17 | dir=in | app=c:\users\roman\appdata\roaming\torrentstream\engine\tsengine.exe | 

"UDP Query User{280D32D7-8A9D-4D8C-99E7-D22E07BF13AB}C:\program files (x86)\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tvuplayer\tvuplayer.exe | 

"UDP Query User{28A9F0F6-C6B9-4A7D-A114-2FDAFD77F7F7}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 

"UDP Query User{4881DF5C-40E3-43EB-9D28-5680316F7B45}C:\program files (x86)\mediamonkey\mediamonkey (non-skinned).exe" = protocol=17 | dir=in | app=c:\program files (x86)\mediamonkey\mediamonkey (non-skinned).exe | 

"UDP Query User{687EFC3F-1F71-4700-9ABC-2735E224B03A}C:\program files (x86)\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sopcast\adv\sopadver.exe | 

"UDP Query User{76EF3465-20D6-4B4F-97AD-D1CD70B22CC1}C:\users\roman\appdata\roaming\torrentstream\engine\tsengine.exe" = protocol=17 | dir=in | app=c:\users\roman\appdata\roaming\torrentstream\engine\tsengine.exe | 

"UDP Query User{B1806141-B3D2-4EC6-8928-31B25E81C695}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 

"UDP Query User{B4A21251-35A4-403E-A0A0-C9331A92119D}C:\program files (x86)\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe | 

"UDP Query User{BA4C4658-8049-41B5-A244-67812063F0CA}C:\program files (x86)\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sopcast\adv\sopadver.exe | 

"UDP Query User{CF5E5AB4-C6D5-4F7E-9DC6-5E909B4598A6}C:\program files (x86)\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe | 

"UDP Query User{E2ED2723-5AEA-4E22-9C74-517D971F3FED}C:\program files (x86)\symantec\norton online backup\nobuclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\symantec\norton online backup\nobuclient.exe | 

"UDP Query User{F839A074-B3D9-4FD7-B05D-97C524B28F3B}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 

"UDP Query User{FEC6910F-8D07-45CA-AFC7-A52DA38CEF8C}C:\windows\system32\javaw.exe" = protocol=17 | dir=in | app=c:\windows\system32\javaw.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0E21ACD8-DA65-4FB6-AC75-AA626CBD2926}" = HP Officejet 6700 - Grundlegende Software für das Gerät

"{26A24AE4-039D-4CA4-87B4-2F86416015FF}" = Java(TM) 6 Update 15 (64-bit)

"{26A24AE4-039D-4CA4-87B4-2F86417007FF}" = Java 7 Update 7 (64-bit)

"{3D94225C-2149-65B6-875D-696BE67700AA}" = ZoomEx

"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

"{64A3A4F4-B792-11D6-A78A-00B0D0160150}" = Java(TM) SE Development Kit 6 Update 15 (64-bit)

"{64A3A4F4-B792-11D6-A78A-00B0D0170070}" = Java SE Development Kit 7 Update 7 (64-bit)

"{7FD7F421-39B2-4CAC-BC41-7D83DDBAB329}" = HP 3D DriveGuard

"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570

"{88E60521-1E4E-4785-B9F1-1798A4BD0C30}" = HP MediaSmart SmartMenu

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007

"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007

"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = HP Integrated Module with Bluetooth wireless technology

"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Alps Touch Pad Driver

"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones

"{E63D8961-0BA9-4CF3-9E94-407ACA42846C}" = SpyHunter

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"3BA80AB4C7E9F8497C115C844953A3D4BEB84D21" = Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800)

"6B6B5E96843E55CF5CF8C7E45FB457F1FE642FF1" = Windows Driver Package - Broadcom Bluetooth  (07/30/2009 6.2.0.9405)

"6B8550A319DDC8B17F35F4A89988705E4592349B" = Windows Driver Package - Broadcom Bluetooth  (06/15/2009 6.2.0.9000)

"GPL Ghostscript 9.04" = GPL Ghostscript

"Matlab R2012a" = MATLAB R2012a

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"NVIDIA Drivers" = NVIDIA Drivers

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"TeamSpeak 3 Client" = TeamSpeak 3 Client

"ZoomEx" = 

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0134A1A1-C283-4A47-91A1-92F19F960372}" = Adobe Creative Suite 2

"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = HP MediaSmart Webcam

"{06F22256-8A8D-4F3F-B22C-6E07313D0FD1}" = HP Support Assistant

"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements

"{1061DF04-CF33-40B0-8360-D07C9BBEB122}" = HP Wireless Assistant

"{17795164-3BC1-4D4F-8ADA-65C895EBFC9A}" = Brother MFL-Pro Suite MFC-J6510DW

"{17B4760F-334B-475D-829F-1A3E94A6A4E6}" = HP Setup

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{21FFAF37-E51A-41AB-8749-ACD1F9CF8E37}" = HP QuickWeb

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{236BB7C4-4419-42FD-0407-1E257A25E34D}" = Adobe Photoshop CS2

"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library

"{26A24AE4-039D-4CA4-87B4-2F83216017F0}" = Java(TM) 6 Update 17

"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17

"{29F9F3A6-B342-4F07-8939-6581F76BBBE9}" = HP User Guides 0174

"{2EF17083-57D4-4D64-AE4F-55F32A2C4571}" = Codecv

"{3023EBDA-BF1B-4831-B347-E5018555F26E}" = Movie Theme Pack for HP MediaSmart Video

"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform

"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons

"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Windows 7

"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works

"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup

"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go

"{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}" = HP Advisor

"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager

"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis

"{46548E80-0407-0000-7E8A-45000F855001}" = Adobe GoLive CS2

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{50DA41E2-0701-43E2-A8BB-FAA0CB64B28B}" = HP Officejet 6700 Hilfe

"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent

"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync

"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{786C5747-0C40-4930-9AFE-113BCE553101}" = Adobe Stock Photos 1.0

"{7F4C8163-F259-49A0-A018-2857A90578BC}" = Adobe InDesign CS2

"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 5.4.0

"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie

"{85DF2EED-08BC-46FB-90DA-28B0D0A8E8A8}" = HP Update

"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows Vista and Later

"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)

"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update

"{8EDBA74D-0686-4C99-BFDD-F894678E5101}" = Adobe Common File Installer

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISER_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISER_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISER_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISER_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007

"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)

"{95140000-0080-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{A155B015-7FBB-41C1-8277-D88623310F2A}" = Unlimited Data Manager 9.1.0

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{A41EB7B5-8883-4795-A587-AAD8A84A010D}" = Cisco AnyConnect Secure Mobility Client

"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AC76BA86-1033-F400-7760-100000000002}" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.6) - Deutsch

"{ADBE46EE-54E0-4610-B436-D7E93D829100}" = Adobe Version Cue CS2

"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger

"{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video

"{B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}" = Adobe Illustrator CS2

"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6

"{B74D4E10-6884-0000-0000-000000000101}" = Adobe Bridge 1.0

"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)

"{BFC50240-10F5-4B89-8B61-BA209A1050E5}" = Alcor Micro USB Card Reader

"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program

"{C49DAA9C-5BA8-459A-8244-E57B69DF0F04}" = Suite Specific

"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail

"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint

"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR

"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials

"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector

"{CC8E94A2-55C7-4460-953C-2A790180578C}" = LightScribe System Software

"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call

"{D8DFA46A-39F7-4368-810D-18AFCFDDAEAF}" = Adobe Shockwave Player

"{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD

"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer

"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio

"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant

"{E553760D-D7F7-48BF-BD8B-C7E23BA04CB5}" = HP MediaSmart Internet TV

"{E9787678-119F-4D52-B551-6739B2B22101}" = Adobe Help Center 1.0

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F1D7AC58-554A-4A58-B784-B61558B1449A}" = QLBCASL

"{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}" = DVD Menu Pack for HP MediaSmart Video

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Adobe SVG Viewer" = Adobe SVG Viewer 3.0

"Avira AntiVir Desktop" = Avira Free Antivirus

"Cisco AnyConnect Secure Mobility Client" = Cisco AnyConnect Secure Mobility Client 

"Codec" = Codec Updater

"EasyBits Magic Desktop" = Magic Desktop

"ENTERPRISER" = Microsoft Office Enterprise 2007

"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4

"Free YouTube Download_is1" = Free YouTube Download version 2.10.28

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8

"Google Chrome" = Google Chrome

"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = HP MediaSmart Webcam

"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite

"InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}" = Movie Theme Pack for HP MediaSmart Video

"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go

"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video

"InstallShield_{BFC50240-10F5-4B89-8B61-BA209A1050E5}" = Alcor Micro USB Card Reader

"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint

"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector

"InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD

"InstallShield_{E553760D-D7F7-48BF-BD8B-C7E23BA04CB5}" = HP MediaSmart Internet TV

"InstallShield_{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}" = DVD Menu Pack for HP MediaSmart Video

"KESO-K4V3.2.A" = KESO-K4V3.2.A

"MediaMonkey_is1" = MediaMonkey 4.0

"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"Mp3tag" = Mp3tag v2.55a

"NIS" = Norton Internet Security

"PC Performer_is1" = PC Performer

"PhotoScape" = PhotoScape

"PokerStars" = PokerStars

"PokerStars.eu" = PokerStars.eu

"SopCast" = SopCast 3.2.8

"SP_5dec30d7" = 

"Uninstall_is1" = Uninstall 1.0.0.1

"uTorrent" = µTorrent

"VLC media player" = VLC media player 1.0.1

"WildTangent hp Master Uninstall" = HP Games

"WinLiveSuite_Wave3" = Windows Live Essentials

"WinRAR archiver" = WinRAR 4.20 (32-Bit)

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Dropbox" = Dropbox

"MyFreeCodec" = MyFreeCodec

"TorrentStream" = Torrent Stream 2.0.3

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 27.05.2012 20:07:33 | Computer Name = pc-roman | Source = SideBySide | ID = 16842815

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files

 (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder

 Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe

 AIR.dll" in Zeile 3.  Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"

 des "version"-Attributs im assemblyIdentity-Element ist ungültig.

 

Error - 27.05.2012 20:09:20 | Computer Name = pc-roman | Source = SideBySide | ID = 16842787

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files

 (x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei

 "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile  8.  Die 

im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente

 überein.  Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition:

 WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".  Verwenden Sie

 das Programm "sxstrace.exe" für eine detaillierte Diagnose.

 

Error - 27.05.2012 20:09:48 | Computer Name = pc-roman | Source = SideBySide | ID = 16842815

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files

 (x86)\chiavetta internet mt191up\DELZIP179.DLL". Fehler in Manifest- oder Richtliniendatei

 "c:\program files (x86)\chiavetta internet mt191up\DELZIP179.DLL" in Zeile 8.  Der

 Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

 

Error - 28.05.2012 18:19:32 | Computer Name = pc-roman | Source = SideBySide | ID = 16842787

Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files

 (x86)\Windows Live\Photo Gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei

 "C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile  8.  Die 

im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente

 überein.  Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition:

 WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".  Verwenden Sie

 das Programm "sxstrace.exe" für eine detaillierte Diagnose.

 

Error - 29.05.2012 08:11:30 | Computer Name = pc-roman | Source = SideBySide | ID = 16842787

Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files

 (x86)\Windows Live\Photo Gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei

 "C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile  8.  Die 

im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente

 überein.  Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition:

 WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".  Verwenden Sie

 das Programm "sxstrace.exe" für eine detaillierte Diagnose.

 

Error - 29.05.2012 08:48:39 | Computer Name = pc-roman | Source = Customer Experience Improvement Program | ID = 1008

Description = 

 

Error - 31.05.2012 18:17:46 | Computer Name = pc-roman | Source = Customer Experience Improvement Program | ID = 1008

Description = 

 

Error - 02.06.2012 10:09:15 | Computer Name = pc-roman | Source = Customer Experience Improvement Program | ID = 1008

Description = 

 

Error - 03.06.2012 07:32:10 | Computer Name = pc-roman | Source = Customer Experience Improvement Program | ID = 1008

Description = 

 

Error - 03.06.2012 10:13:03 | Computer Name = pc-roman | Source = Customer Experience Improvement Program | ID = 1008

Description = 

 

[ Cisco AnyConnect Secure Mobility Client Events ]

Error - 27.05.2013 17:27:02 | Computer Name = pc-roman | Source = acvpnagent | ID = 67108866

Description = Function: CCapiCertUtils::CCapiCertUtils File: .\Certificates\CapiCertUtils.cpp

Line:

 92 Invoked Function: CWinsecApiImpersonateUser::CWinsecApiImpersonateUser Return 

Code: -32767981 (0xFE0C0013) Description: WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED
 

 

Error - 27.05.2013 17:27:02 | Computer Name = pc-roman | Source = acvpnagent | ID = 67108866

Description = Function: CCapiCertStore::CCapiCertStore File: .\Certificates\CapiCertStore.cpp

Line:

 70 Invoked Function: CapiCertUtils Return Code: -32767981 (0xFE0C0013) Description:

 WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED 

 

Error - 27.05.2013 17:27:02 | Computer Name = pc-roman | Source = acvpnagent | ID = 67108866

Description = Function: CCollectiveCertStore::addCapiStore File: .\Certificates\CollectiveCertStore.cpp

Line:

 922 Invoked Function: CCapiCertStore::CCapiCertStore Return Code: -32767981 (0xFE0C0013)

Description:

 WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED 

 

Error - 27.05.2013 17:27:02 | Computer Name = pc-roman | Source = acvpnagent | ID = 67108866

Description = Function: CWinsecApiImpersonateUser::searchProcessesForUserToken File:

 .\IPC\WinsecAPI.cpp Line: 1391 Invoked Function: Process32Next Return Code: 18 (0x00000012)

Description:

 Es sind keine weiteren Dateien vorhanden.   

 

Error - 27.05.2013 17:27:02 | Computer Name = pc-roman | Source = acvpnagent | ID = 67108865

Description = Function: CWinsecApiImpersonateUser::acquireTokens File: .\IPC\WinsecAPI.cpp

Line:

 101 CWinsecApiImpersonateUser::getUserImpersonationToken returned NULL

 

Error - 27.05.2013 17:27:02 | Computer Name = pc-roman | Source = acvpnagent | ID = 67108866

Description = Function: CWinsecApiImpersonateUser::CWinsecApiImpersonateUser File:

 .\IPC\WinsecAPI.cpp Line: 81 Invoked Function: CWinsecApiImpersonateUser::acquireTokens

Return

 Code: -32767981 (0xFE0C0013) Description: WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED
 

 

Error - 27.05.2013 17:27:02 | Computer Name = pc-roman | Source = acvpnagent | ID = 67108866

Description = Function: CCapiCertUtils::CCapiCertUtils File: .\Certificates\CapiCertUtils.cpp

Line:

 92 Invoked Function: CWinsecApiImpersonateUser::CWinsecApiImpersonateUser Return 

Code: -32767981 (0xFE0C0013) Description: WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED
 

 

Error - 27.05.2013 17:27:02 | Computer Name = pc-roman | Source = acvpnagent | ID = 67108866

Description = Function: CCapiCertStore::CCapiCertStore File: .\Certificates\CapiCertStore.cpp

Line:

 70 Invoked Function: CapiCertUtils Return Code: -32767981 (0xFE0C0013) Description:

 WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED 

 

Error - 27.05.2013 17:27:02 | Computer Name = pc-roman | Source = acvpnagent | ID = 67108866

Description = Function: CCapiCertSmartcardStore::CCapiCertSmartcardStore File: .\Certificates\CapiCertSmartcardStore.cpp

Line:

 40 Invoked Function: CCapiCertStore::CCapiCertStore Return Code: -32767981 (0xFE0C0013)

Description:

 WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED 

 

Error - 27.05.2013 17:27:02 | Computer Name = pc-roman | Source = acvpnagent | ID = 67108866

Description = Function: CCollectiveCertStore::addCapiSmartcardStore File: .\Certificates\CollectiveCertStore.cpp

Line:

 959 Invoked Function: CCapiCertSmartcardStore::CCapiCertSmartcardStore Return Code:

 -32767981 (0xFE0C0013) Description: WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED
 

 

[ Hewlett-Packard Events ]

Error - 18.02.2013 15:10:53 | Computer Name = pc-roman | Source = Hewlett-Packard | ID = 0

Description = de-CH Die Datei "C:\Program Files (x86)\Hewlett-Packard\HP Support 

Framework\Logs\SystemInfoAA.xml" konnte nicht gefunden werden. mscorlib    bei System.IO.__Error.WinIOError(Int32

 errorCode, String maybeFullPath)     bei System.IO.FileStream.Init(String path, FileMode

 mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32

 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, 

Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode mode,

 FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String

 msgPath, Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode

 mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
 

   bei System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,

 Int32 bufferSize)     bei System.IO.StreamReader..ctor(String path, Encoding encoding)
 

   bei System.IO.File.ReadAllText(String path, Encoding encoding)     bei n.a(Object

 A_0, EventArgs A_1) 

 

Error - 18.02.2013 15:19:26 | Computer Name = pc-roman | Source = Hewlett-Packard | ID = 0

Description = de-CH Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.

HPSF
 

   bei HPAssistant.Pages.MaintainAnalyzing.MaintainAnalyzing_Unloaded(Object sender,

 RoutedEventArgs e)     bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object

 target, RoutedEventArgs routedEventArgs)     bei System.Windows.EventRoute.InvokeHandlersImpl(Object

 source, RoutedEventArgs args, Boolean reRaised)     bei System.Windows.UIElement.RaiseEventImpl(DependencyObject

 sender, RoutedEventArgs args)     bei System.Windows.UIElement.RaiseEvent(RoutedEventArgs

 e)     bei System.Windows.BroadcastEventHelper.BroadcastEvent(DependencyObject root,

 RoutedEvent routedEvent)     bei System.Windows.BroadcastEventHelper.BroadcastUnloadedEvent(Object

 root)     bei MS.Internal.LoadedOrUnloadedOperation.DoWork()     bei System.Windows.Media.MediaContext.FireLoadedPendingCallbacks()
 

   bei System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks()     bei System.Windows.Media.MediaContext.RenderMessageHandlerCore(Object

 resizedCompositionTarget)     bei System.Windows.Media.MediaContext.AnimatedRenderMessageHandler(Object

 resizedCompositionTarget)     bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate

 callback, Object args, Boolean isSingleParameter)     bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object

 source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)
 

 

Error - 01.03.2013 20:08:44 | Computer Name = pc-roman | Source = Hewlett-Packard | ID = 0

Description = de-CH Die Datei "C:\Program Files (x86)\Hewlett-Packard\HP Support 

Framework\Logs\SystemInfoAA.xml" konnte nicht gefunden werden. mscorlib    bei System.IO.__Error.WinIOError(Int32

 errorCode, String maybeFullPath)     bei System.IO.FileStream.Init(String path, FileMode

 mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32

 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, 

Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode mode,

 FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String

 msgPath, Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode

 mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
 

   bei System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,

 Int32 bufferSize)     bei System.IO.StreamReader..ctor(String path, Encoding encoding)
 

   bei System.IO.File.ReadAllText(String path, Encoding encoding)     bei n.a(Object

 A_0, EventArgs A_1) 

 

Error - 01.03.2013 20:08:44 | Computer Name = pc-roman | Source = Hewlett-Packard | ID = 0

Description = de-CH Die Datei "C:\Program Files (x86)\Hewlett-Packard\HP Support 

Framework\Logs\SystemInfoAA.xml" konnte nicht gefunden werden. mscorlib    bei System.IO.__Error.WinIOError(Int32

 errorCode, String maybeFullPath)     bei System.IO.FileStream.Init(String path, FileMode

 mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32

 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, 

Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode mode,

 FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String

 msgPath, Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode

 mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
 

   bei System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,

 Int32 bufferSize)     bei System.IO.StreamReader..ctor(String path, Encoding encoding)
 

   bei System.IO.File.ReadAllText(String path, Encoding encoding)     bei n.a(Object

 A_0, EventArgs A_1) 

 

Error - 30.03.2013 19:57:06 | Computer Name = pc-roman | Source = Hewlett-Packard | ID = 0

Description = de-CH Die Datei "C:\Program Files (x86)\Hewlett-Packard\HP Support 

Framework\Logs\SystemInfoAA.xml" konnte nicht gefunden werden. mscorlib    bei System.IO.__Error.WinIOError(Int32

 errorCode, String maybeFullPath)     bei System.IO.FileStream.Init(String path, FileMode

 mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32

 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, 

Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode mode,

 FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String

 msgPath, Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode

 mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
 

   bei System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,

 Int32 bufferSize)     bei System.IO.StreamReader..ctor(String path, Encoding encoding)
 

   bei System.IO.File.ReadAllText(String path, Encoding encoding)     bei n.a(Object

 A_0, EventArgs A_1) 

 

Error - 30.03.2013 19:57:07 | Computer Name = pc-roman | Source = Hewlett-Packard | ID = 0

Description = de-CH Die Datei "C:\Program Files (x86)\Hewlett-Packard\HP Support 

Framework\Logs\SystemInfoAA.xml" konnte nicht gefunden werden. mscorlib    bei System.IO.__Error.WinIOError(Int32

 errorCode, String maybeFullPath)     bei System.IO.FileStream.Init(String path, FileMode

 mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32

 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, 

Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode mode,

 FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String

 msgPath, Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode

 mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
 

   bei System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,

 Int32 bufferSize)     bei System.IO.StreamReader..ctor(String path, Encoding encoding)
 

   bei System.IO.File.ReadAllText(String path, Encoding encoding)     bei n.a(Object

 A_0, EventArgs A_1) 

 

Error - 05.04.2013 06:35:33 | Computer Name = pc-roman | Source = Hewlett-Packard | ID = 0

Description = de-CH Die Datei "C:\Program Files (x86)\Hewlett-Packard\HP Support 

Framework\Logs\SystemInfoAA.xml" konnte nicht gefunden werden. mscorlib    bei System.IO.__Error.WinIOError(Int32

 errorCode, String maybeFullPath)     bei System.IO.FileStream.Init(String path, FileMode

 mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32

 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, 

Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode mode,

 FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String

 msgPath, Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode

 mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
 

   bei System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,

 Int32 bufferSize)     bei System.IO.StreamReader..ctor(String path, Encoding encoding)
 

   bei System.IO.File.ReadAllText(String path, Encoding encoding)     bei n.a(Object

 A_0, EventArgs A_1) 

 

Error - 05.04.2013 06:35:34 | Computer Name = pc-roman | Source = Hewlett-Packard | ID = 0

Description = de-CH Die Datei "C:\Program Files (x86)\Hewlett-Packard\HP Support 

Framework\Logs\SystemInfoAA.xml" konnte nicht gefunden werden. mscorlib    bei System.IO.__Error.WinIOError(Int32

 errorCode, String maybeFullPath)     bei System.IO.FileStream.Init(String path, FileMode

 mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32

 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, 

Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode mode,

 FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String

 msgPath, Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode

 mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
 

   bei System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,

 Int32 bufferSize)     bei System.IO.StreamReader..ctor(String path, Encoding encoding)
 

   bei System.IO.File.ReadAllText(String path, Encoding encoding)     bei n.a(Object

 A_0, EventArgs A_1) 

 

Error - 05.04.2013 06:35:48 | Computer Name = pc-roman | Source = Hewlett-Packard | ID = 0

Description = de-CH Die Datei "C:\Program Files (x86)\Hewlett-Packard\HP Support 

Framework\Logs\SystemInfoAA.xml" konnte nicht gefunden werden. mscorlib    bei System.IO.__Error.WinIOError(Int32

 errorCode, String maybeFullPath)     bei System.IO.FileStream.Init(String path, FileMode

 mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32

 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, 

Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode mode,

 FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String

 msgPath, Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode

 mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
 

   bei System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,

 Int32 bufferSize)     bei System.IO.StreamReader..ctor(String path, Encoding encoding)
 

   bei System.IO.File.ReadAllText(String path, Encoding encoding)     bei n.a(Object

 A_0, EventArgs A_1) 

 

Error - 20.04.2013 19:31:26 | Computer Name = pc-roman | Source = Hewlett-Packard | ID = 0

Description = de-CH Die Datei "C:\Program Files (x86)\Hewlett-Packard\HP Support 

Framework\Logs\SystemInfoAA.xml" konnte nicht gefunden werden. mscorlib    bei System.IO.__Error.WinIOError(Int32

 errorCode, String maybeFullPath)     bei System.IO.FileStream.Init(String path, FileMode

 mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32

 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, 

Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode mode,

 FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String

 msgPath, Boolean bFromProxy)     bei System.IO.FileStream..ctor(String path, FileMode

 mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
 

   bei System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,

 Int32 bufferSize)     bei System.IO.StreamReader..ctor(String path, Encoding encoding)
 

   bei System.IO.File.ReadAllText(String path, Encoding encoding)     bei n.a(Object

 A_0, EventArgs A_1) 

 

[ System Events ]

Error - 27.05.2013 18:04:26 | Computer Name = pc-roman | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.05.2013 18:04:56 | Computer Name = pc-roman | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.05.2013 18:04:56 | Computer Name = pc-roman | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.05.2013 18:04:56 | Computer Name = pc-roman | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.05.2013 18:06:34 | Computer Name = pc-roman | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.05.2013 18:06:34 | Computer Name = pc-roman | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.05.2013 18:06:34 | Computer Name = pc-roman | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.05.2013 18:06:58 | Computer Name = pc-roman | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.05.2013 18:06:58 | Computer Name = pc-roman | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.05.2013 18:06:58 | Computer Name = pc-roman | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

 

< End of report >

Code:

OTL logfile created on: 27.05.2013 23:30:58 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\roman\Downloads

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy

 

3,91 Gb Total Physical Memory | 3,23 Gb Available Physical Memory | 82,83% Memory free

7,81 Gb Paging File | 7,18 Gb Available in Paging File | 91,93% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 281,66 Gb Total Space | 161,03 Gb Free Space | 57,17% Space Free | Partition Type: NTFS

Drive D: | 16,13 Gb Total Space | 2,64 Gb Free Space | 16,34% Space Free | Partition Type: NTFS

Drive E: | 99,34 Mb Total Space | 92,74 Mb Free Space | 93,36% Space Free | Partition Type: FAT32

 

Computer Name: PC-ROMAN | User Name: roman | Logged in as Administrator.

Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\roman\Downloads\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - (STacSV) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\stacsv64.exe (IDT, Inc.)

SRV:64bit: - (hpsrv) -- C:\Windows\SysNative\hpservice.exe (Hewlett-Packard)

SRV:64bit: - (AESTFilters) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\AESTSr64.exe (Andrea Electronics Corporation)

SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (SpyHunter 4 Service) -- C:\Programme\Enigma Software Group\SpyHunter\SH4Service.exe (Enigma Software Group USA, LLC.)

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (vpnagent) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)

SRV - (NOBU) -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (UDM Service) -- C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe (Swisscom)

SRV - (SesamService) -- C:\Program Files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe (Swisscom)

SRV - (STacSV) -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\STacSV64.exe (IDT, Inc.)

SRV - (btwdins) -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)

SRV - (NIS) -- C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\ccSvcHst.exe (Symantec Corporation)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (GameConsoleService) -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe (WildTangent, Inc.)

SRV - (AESTFilters) -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\AESTSr64.exe (Andrea Electronics Corporation)

SRV - (ezSharedSvc) -- C:\Windows\SysWOW64\ezsvc7.dll (EasyBits Sofware AS)

SRV - (Adobe Version Cue CS2) -- C:\Program Files (x86)\DVD Maker\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe (Adobe Systems Incorporated)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)

DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)

DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)

DRV:64bit: - (EsgScanner) -- C:\Windows\SysNative\drivers\EsgScanner.sys ()

DRV:64bit: - (vpnva) -- C:\Windows\SysNative\drivers\vpnva64.sys (Cisco Systems, Inc.)

DRV:64bit: - (acsock) -- C:\Windows\SysNative\drivers\acsock64.sys (Cisco Systems, Inc.)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)

DRV:64bit: - (ewusbnet) -- C:\Windows\SysNative\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (hwusbfake) -- C:\Windows\SysNative\drivers\ewusbfake.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (AmUStor) -- C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)

DRV:64bit: - (STHDA) -- C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (btwrchid) -- C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)

DRV:64bit: - (btwl2cap) -- C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)

DRV:64bit: - (btwavdt) -- C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)

DRV:64bit: - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (SRTSP) -- C:\Windows\SysNative\drivers\NISx64\1100000.088\srtsp64.sys (Symantec Corporation)

DRV:64bit: - (SRTSPX) -- C:\Windows\SysNative\drivers\NISx64\1100000.088\srtspx64.sys (Symantec Corporation)

DRV:64bit: - (WtSmpFlt) -- C:\Windows\SysNative\drivers\wtsmpflt.sys (Swisscom)

DRV:64bit: - (wtsmpadap) -- C:\Windows\SysNative\drivers\wtsmpadap.sys (Swisscom)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)

DRV:64bit: - (hpdskflt) -- C:\Windows\SysNative\drivers\hpdskflt.sys (Hewlett-Packard)

DRV:64bit: - (Accelerometer) -- C:\Windows\SysNative\drivers\Accelerometer.sys (Hewlett-Packard)

DRV:64bit: - (SrvHsfV92) -- C:\Windows\SysNative\drivers\VSTDPV6.SYS (Conexant Systems, Inc.)

DRV:64bit: - (SrvHsfWinac) -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS (Conexant Systems, Inc.)

DRV:64bit: - (SrvHsfHDA) -- C:\Windows\SysNative\drivers\VSTAZL6.SYS (Conexant Systems, Inc.)

DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys (Marvell)

DRV:64bit: - (netw5v64) -- C:\Windows\SysNative\drivers\netw5v64.sys (Intel Corporation)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)

DRV:64bit: - (HpqKbFiltr) -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)

DRV - (DVMIO) -- C:\SPLASH.SYS\config\dvmio.sys (DeviceVM, Inc.)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/12

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCON/12

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {B8102C4D-2D2B-46BF-BF67-1AC9FF61E12B}

IE:64bit: - HKLM\..\SearchScopes\{B8102C4D-2D2B-46BF-BF67-1AC9FF61E12B}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/12

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://searchab.com/?aff=7&uid=10fce665-4fac-11e2-acef-00ade1ac1c1a

IE - HKLM\..\SearchScopes,DefaultScope = {B8102C4D-2D2B-46BF-BF67-1AC9FF61E12B}

IE - HKLM\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = ${SEARCH_URL}{searchTerms}

IE - HKLM\..\SearchScopes\{B8102C4D-2D2B-46BF-BF67-1AC9FF61E12B}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/12

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://searchab.com/?aff=7&uid=10fce665-4fac-11e2-acef-00ade1ac1c1a

IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://searchab.com/?aff=7&uid=10fce665-4fac-11e2-acef-00ade1ac1c1a&q={searchTerms}

IE - HKCU\..\SearchScopes\{B8102C4D-2D2B-46BF-BF67-1AC9FF61E12B}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox

IE - HKCU\..\SearchScopes\{D734C3F7-D9A3-4528-BE7F-766B998B8012}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=112457&tt=3512_5&babsrc=SP_ss&mntrId=6429017300000000000000ade1ac1c1a

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultengine: "Privitize VPN"

FF - prefs.js..browser.search.defaultenginename: "Privitize VPN"

FF - prefs.js..browser.search.defaultenginename,S: S", ""

FF - prefs.js..browser.search.defaultthis.engineName: ""

FF - prefs.js..browser.search.defaulturl: ""

FF - prefs.js..browser.search.order.1: "Privitize VPN"

FF - prefs.js..browser.search.order.1,S: S", ""

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.selectedEngine,S: S", ""

FF - prefs.js..browser.search.useDBForOrder: "false"

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.ch/"

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0

FF - prefs.js..extensions.enabledItems: {99999999-73df-4e76-b66c-87d3db104b03}:1.3.5

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1

FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {9d1f059c-cada-4111-9696-41a62d64e3ba}:0.5.3.4

FF - prefs.js..extensions.enabledItems: {7E77F5DF-8022-40e3-9122-F03DEBEFC43B}:1.0.25

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..keyword.URL: "hxxp://searchab.com/?aff=7&uid=10fce665-4fac-11e2-acef-00ade1ac1c1a&q="

FF - prefs.js..network.proxy.type: 4

FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""

FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""

FF - prefs.js..browser.startup.homepage: ""

FF - prefs.js..sweetim.toolbar.previous.keyword.URL: ""

 

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Program Files (x86)\TVUPlayer\npTVUAx.dll File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@torrentstream.net/tsplugin,version=2.0.3: C:\Users\roman\AppData\Roaming\TorrentStream\player\npts_plugin.dll (Innovative Digital Technologies)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4C0766D3-67A7-45a3-85A2-752F77312F32}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{E4D8AFFF-DA7C-412F-A976-05ED142C7806}: C:\Program Files (x86)\Swisscom\Unlimited Data Manager\FireFox_Remote\ [2011.07.01 12:12:43 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\quickprint@hp.com: C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2011.01.26 15:27:28 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.05.23 18:48:10 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.05.23 18:48:10 | 000,000,000 | ---D | M]

 

[2010.03.20 18:28:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\roman\AppData\Roaming\mozilla\Extensions

[2013.04.15 20:07:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\roman\AppData\Roaming\mozilla\Firefox\Profiles\m39annuf.default\extensions

[2013.05.23 18:48:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2013.05.23 18:48:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2013.05.23 18:48:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

[2013.05.23 18:48:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions

[2013.05.23 18:48:15 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2012.08.31 12:57:47 | 000,002,349 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml

 
 ========== Chrome  ==========

 

CHR - homepage: 

CHR - Extension: No name found = C:\Users\roman\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\

CHR - Extension: No name found = C:\Users\roman\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\

CHR - Extension: No name found = C:\Users\roman\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\

CHR - Extension: No name found = C:\Users\roman\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\

CHR - Extension: No name found = C:\Users\roman\AppData\Local\Google\Chrome\User Data\Default\Extensions\kgjpgeghoihfjhcefchccfodloanbcgg\1.0_0\

CHR - Extension: No name found = C:\Users\roman\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\coIEPlg.dll (Symantec Corporation)

O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\IPSBHO.DLL (Symantec Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\coIEPlg.dll (Symantec Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()

O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)

O4 - HKLM..\Run: [Adobe Version Cue CS2] C:\Program Files (x86)\DVD Maker\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe (Adobe Sytems Incorporated)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Cisco Systems, Inc.)

O4 - HKLM..\Run: [Dashboard]  File not found

O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe (EasyBits Software AS)

O4 - HKLM..\Run: [HPCam_Menu] c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)

O4 - HKLM..\Run: [NortonOnlineBackup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)

O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)

O4 - HKCU..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)

O4 - HKCU..\Run: [ctfmon.exe] C:\ProgramData\cowiga.dat ()

O4 - HKCU..\Run: [HP Officejet 6700 (NET)] C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)

O4 - HKCU..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup File not found

O4 - HKCU..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)

O4:64bit: - HKLM..\RunOnce: [GrpConv] C:\Windows\SysNative\grpconv.exe (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0

O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8:64bit: - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8:64bit: - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()

O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8:64bit: - Extra context menu item: In vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O8:64bit: - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8:64bit: - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8 - Extra context menu item: Free YouTube Download - C:\Users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()

O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)

O9 - Extra 'Tools' menuitem : SmartPrint - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Reg Error: Value error.)

O16:64bit: - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 10.7.2)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Reg Error: Value error.)

O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (WRC Class)

O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 10.17.2)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BED56F8B-4D3D-4593-A4A5-7DF72E44F288}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C089350C-6EEE-4182-8057-A250ACEAF6AC}: NameServer = 195.186.1.111,195.186.4.162

O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (c:\progra~2\zoomex\sprote~1.dll) - c:\progra~2\zoomex\sprote~1.dll ()

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.)

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{0d643da6-a3c6-11e0-abe7-9a09c775ac9f}\Shell - "" = AutoRun

O33 - MountPoints2\{0d643da6-a3c6-11e0-abe7-9a09c775ac9f}\Shell\AutoRun\command - "" = F:\Start.exe

O33 - MountPoints2\{1d3e3753-a3cb-11e0-b3b6-fdf826776688}\Shell - "" = AutoRun

O33 - MountPoints2\{1d3e3753-a3cb-11e0-b3b6-fdf826776688}\Shell\AutoRun\command - "" = F:\Start.exe

O33 - MountPoints2\F\Shell - "" = AutoRun

O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Setup.exe

O33 - MountPoints2\G\Shell - "" = AutoRun

O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\Start.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"

ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker 2.6

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

NetSvcs: ezSharedSvc - C:\Windows\SysWOW64\ezsvc7.dll (EasyBits Sofware AS)

 

 

CREATERESTOREPOINT

Unable to start System Restore Service. Error code 1084

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.05.27 22:15:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro

[2013.05.27 22:15:04 | 000,000,000 | ---D | C] -- C:\Users\roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis

[2013.05.27 21:33:37 | 000,000,000 | ---D | C] -- C:\Users\roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter

[2013.05.27 21:33:36 | 000,000,000 | ---D | C] -- C:\sh4ldr

[2013.05.27 21:33:36 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group

[2013.05.27 21:33:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard

[2013.05.23 22:25:01 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\rundll32.exe

[2013.05.23 18:48:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

[2013.05.23 18:45:57 | 000,000,000 | ---D | C] -- C:\Users\roman\AppData\Roaming\PerformerSoft

[2013.05.23 18:45:56 | 000,019,632 | ---- | C] (PerformerSoft LLC) -- C:\Windows\SysNative\roboot64.exe

[2013.05.23 18:45:56 | 000,000,000 | ---D | C] -- C:\ProgramData\IBUpdaterService

[2013.05.23 18:45:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Performer

[2013.05.23 18:45:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Performer

[2013.05.23 18:45:45 | 000,000,000 | ---D | C] -- C:\Users\roman\AppData\Roaming\PhotoScape

[2013.05.23 18:45:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape

[2013.05.23 18:45:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PhotoScape

[2013.05.23 18:45:01 | 021,322,864 | ---- | C] (Mooii) -- C:\Users\roman\Desktop\PhotoScape_V3-6-3.exe

[2013.05.09 21:59:57 | 000,083,160 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys

[2013.05.02 22:25:29 | 000,000,000 | ---D | C] -- C:\Users\roman\AppData\Roaming\Mp3tag

[2013.05.02 22:24:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mp3tag

[2013.04.30 19:05:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24

[2013.04.30 19:05:45 | 000,000,000 | ---D | C] -- C:\Users\roman\AppData\Local\Programs

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.05.27 23:28:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.05.27 23:28:13 | 3144,839,168 | -HS- | M] () -- C:\hiberfil.sys

[2013.05.27 22:15:04 | 000,002,975 | ---- | M] () -- C:\Users\roman\Desktop\HiJackThis.lnk

[2013.05.27 21:33:38 | 000,002,258 | ---- | M] () -- C:\Users\roman\Desktop\SpyHunter.lnk

[2013.05.27 21:15:51 | 000,000,362 | -H-- | M] () -- C:\Windows\tasks\ZoomExUpdaterTask{F23D1332-650C-41C4-A9AD-35612BEE4DA8}.job

[2013.05.27 21:15:51 | 000,000,332 | -H-- | M] () -- C:\Windows\tasks\CodecUpdaterTask{A3BC3E92-28B6-42C0-93BD-0D1B5CF5C1C7}.job

[2013.05.27 21:13:21 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.05.27 21:13:21 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.05.27 21:09:50 | 095,023,320 | ---- | M] () -- C:\ProgramData\agiwoc.pad

[2013.05.27 21:07:29 | 000,001,922 | ---- | M] () -- C:\Users\roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk

[2013.05.27 21:07:21 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.05.27 21:07:18 | 000,000,522 | ---- | M] () -- C:\Windows\tasks\MATLAB R2012a Startup Accelerator.job

[2013.05.27 21:04:49 | 000,002,633 | ---- | M] () -- C:\ProgramData\agiwoc.js

[2013.05.24 19:19:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.05.24 18:48:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.05.24 15:02:19 | 000,000,276 | ---- | M] () -- C:\Windows\tasks\PC Performer_DEFAULT.job

[2013.05.23 22:25:55 | 000,001,029 | ---- | M] () -- C:\Users\roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk

[2013.05.23 22:25:26 | 000,000,152 | ---- | M] () -- C:\ProgramData\agiwoc.reg

[2013.05.23 22:25:26 | 000,000,056 | ---- | M] () -- C:\ProgramData\agiwoc.bat

[2013.05.23 22:25:01 | 000,159,744 | ---- | M] () -- C:\ProgramData\cowiga.dat

[2013.05.23 22:24:48 | 000,159,744 | ---- | M] () -- C:\Users\roman\4727213.dll

[2013.05.23 21:08:59 | 000,000,284 | ---- | M] () -- C:\Windows\tasks\PC Performer_UPDATES.job

[2013.05.23 18:45:55 | 000,001,054 | ---- | M] () -- C:\Users\Public\Desktop\PC Performer.lnk

[2013.05.23 18:45:38 | 000,001,035 | ---- | M] () -- C:\Users\roman\Desktop\PhotoScape.lnk

[2013.05.23 18:45:13 | 000,609,088 | ---- | M] () -- C:\Users\roman\Desktop\bundleSetup.exe

[2013.05.23 18:45:09 | 021,322,864 | ---- | M] (Mooii) -- C:\Users\roman\Desktop\PhotoScape_V3-6-3.exe

[2013.05.22 19:52:43 | 004,714,380 | ---- | M] () -- C:\Users\roman\Desktop\Mechanik Formelsammlung Lukas Frhlich.pdf

[2013.05.15 07:22:00 | 000,439,048 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2013.05.15 00:26:46 | 001,520,734 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2013.05.15 00:26:46 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2013.05.15 00:26:46 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2013.05.15 00:26:46 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2013.05.15 00:26:46 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2013.05.09 21:59:41 | 000,083,160 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys

[2013.05.02 22:24:40 | 000,000,983 | ---- | M] () -- C:\Users\Public\Desktop\Mp3tag.lnk

[2013.05.01 15:55:58 | 001,661,812 | ---- | M] () -- C:\Users\roman\Desktop\skript-1.pdf

[2013.04.30 19:48:04 | 000,211,626 | ---- | M] () -- C:\Users\roman\Desktop\loesung_annotated.pdf

[2013.04.30 19:05:56 | 000,001,063 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk

[2013.04.30 19:05:55 | 000,001,078 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Editor.lnk

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013.05.27 22:15:04 | 000,002,975 | ---- | C] () -- C:\Users\roman\Desktop\HiJackThis.lnk

[2013.05.27 21:33:40 | 000,022,704 | ---- | C] () -- C:\Windows\SysNative\drivers\EsgScanner.sys

[2013.05.27 21:33:38 | 000,002,258 | ---- | C] () -- C:\Users\roman\Desktop\SpyHunter.lnk

[2013.05.27 21:04:49 | 000,002,633 | ---- | C] () -- C:\ProgramData\agiwoc.js

[2013.05.23 22:25:55 | 000,001,029 | ---- | C] () -- C:\Users\roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk

[2013.05.23 22:25:26 | 000,000,152 | ---- | C] () -- C:\ProgramData\agiwoc.reg

[2013.05.23 22:25:26 | 000,000,056 | ---- | C] () -- C:\ProgramData\agiwoc.bat

[2013.05.23 22:25:23 | 095,023,320 | ---- | C] () -- C:\ProgramData\agiwoc.pad

[2013.05.23 22:25:01 | 000,159,744 | ---- | C] () -- C:\ProgramData\cowiga.dat

[2013.05.23 22:24:48 | 000,159,744 | ---- | C] () -- C:\Users\roman\4727213.dll

[2013.05.23 18:46:03 | 000,000,284 | ---- | C] () -- C:\Windows\tasks\PC Performer_UPDATES.job

[2013.05.23 18:46:03 | 000,000,276 | ---- | C] () -- C:\Windows\tasks\PC Performer_DEFAULT.job

[2013.05.23 18:45:55 | 000,001,054 | ---- | C] () -- C:\Users\Public\Desktop\PC Performer.lnk

[2013.05.23 18:45:38 | 000,001,035 | ---- | C] () -- C:\Users\roman\Desktop\PhotoScape.lnk

[2013.05.23 18:45:01 | 000,609,088 | ---- | C] () -- C:\Users\roman\Desktop\bundleSetup.exe

[2013.05.22 19:52:42 | 004,714,380 | ---- | C] () -- C:\Users\roman\Desktop\Mechanik Formelsammlung Lukas Frhlich.pdf

[2013.05.02 22:24:40 | 000,000,983 | ---- | C] () -- C:\Users\Public\Desktop\Mp3tag.lnk

[2013.05.01 15:55:56 | 001,661,812 | ---- | C] () -- C:\Users\roman\Desktop\skript-1.pdf

[2013.04.30 19:48:04 | 000,211,626 | ---- | C] () -- C:\Users\roman\Desktop\loesung_annotated.pdf

[2013.04.30 19:05:56 | 000,001,063 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk

[2013.04.30 19:05:55 | 000,001,078 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Editor.lnk

[2013.02.05 17:52:54 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe

[2013.02.05 17:52:50 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll

[2013.02.05 17:52:50 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll

[2013.02.05 17:52:50 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll

[2013.02.05 17:52:50 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll

[2012.12.08 19:52:17 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini

[2012.02.20 21:11:21 | 000,016,384 | ---- | C] () -- C:\Windows\SysWow64\FileOps.exe

[2012.02.18 11:41:12 | 000,000,154 | ---- | C] () -- C:\Users\roman\.appletviewer

[2010.12.10 14:19:41 | 000,005,120 | ---- | C] () -- C:\Users\roman\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.03.18 21:10:01 | 000,000,000 | ---- | C] () -- C:\Users\roman\AppData\Roaming\wklnhst.dat

 
 ========== ZeroAccess Check ==========

 

[2002.06.01 10:03:20 | 000,000,099 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-2295630978-4142572454-2340649278-1000\$RWXIVQC\perl\win32\lib\Net\FTP\L.pm

[2010.01.26 22:15:28 | 000,005,361 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-2295630978-4142572454-2340649278-1000\$RWXIVQC\perl\win32\lib\unicore\lib\bc\L.pl

[2010.01.26 22:15:28 | 000,000,218 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-2295630978-4142572454-2340649278-1000\$RWXIVQC\perl\win32\lib\unicore\lib\ccc\L.pl

[2010.01.26 22:15:34 | 000,006,687 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-2295630978-4142572454-2340649278-1000\$RWXIVQC\perl\win32\lib\unicore\lib\ea\N.pl

[2010.01.26 22:15:28 | 000,004,786 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-2295630978-4142572454-2340649278-1000\$RWXIVQC\perl\win32\lib\unicore\lib\gc_sc\L.pl

[2010.01.26 22:15:28 | 000,001,102 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-2295630978-4142572454-2340649278-1000\$RWXIVQC\perl\win32\lib\unicore\lib\gc_sc\N.pl

[2010.01.26 22:15:34 | 000,000,242 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-2295630978-4142572454-2340649278-1000\$RWXIVQC\perl\win32\lib\unicore\lib\hst\L.pl

[2010.01.26 22:15:34 | 000,000,274 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-2295630978-4142572454-2340649278-1000\$RWXIVQC\perl\win32\lib\unicore\lib\jt\U.pl

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2013.03.07 20:46:25 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\.Torrent Stream

[2012.08.31 12:57:46 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\Babylon

[2013.04.08 13:12:06 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\Dropbox

[2010.10.17 13:55:04 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\DVDVideoSoft

[2010.11.26 20:43:31 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\DVDVideoSoftIEHelpers

[2012.09.06 15:42:32 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\FreePDF

[2013.04.10 16:34:04 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\MediaMonkey

[2013.05.02 22:34:16 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\Mp3tag

[2013.05.23 18:45:57 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\PerformerSoft

[2013.05.23 18:53:19 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\PhotoScape

[2013.04.08 13:31:38 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\Samsung

[2011.06.10 21:47:54 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\TS3Client

[2013.05.22 12:18:44 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\uTorrent

[2010.11.23 19:25:31 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\XMedia Recode

[2010.03.10 22:40:40 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\_MDLogs

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %SYSTEMDRIVE%\*. >

[2010.03.22 18:38:49 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin

[2009.12.09 12:11:59 | 000,000,000 | -HSD | M] -- C:\boot

[2011.05.08 13:01:41 | 000,000,000 | ---D | M] -- C:\Brother

[2013.05.27 22:15:05 | 000,000,000 | -HSD | M] -- C:\Config.Msi

[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2010.03.10 20:08:43 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen

[2010.03.10 20:08:57 | 000,000,000 | -H-D | M] -- C:\dvmexp

[2010.01.04 21:50:10 | 000,000,000 | -H-D | M] -- C:\HP

[2010.03.10 20:08:57 | 000,000,000 | -HSD | M] -- C:\HPMBackup

[2010.05.31 23:15:30 | 000,000,000 | RH-D | M] -- C:\MSOCache

[2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2013.05.27 21:33:36 | 000,000,000 | R--D | M] -- C:\Program Files

[2013.05.27 22:15:04 | 000,000,000 | R--D | M] -- C:\Program Files (x86)

[2013.05.27 21:09:50 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2010.03.10 20:08:43 | 000,000,000 | -HSD | M] -- C:\Programme

[2010.03.10 20:14:36 | 000,000,000 | -HSD | M] -- C:\Recovery

[2013.05.27 21:34:04 | 000,000,000 | ---D | M] -- C:\sh4ldr

[2010.03.12 21:57:38 | 000,000,000 | -H-D | M] -- C:\SPLASH.000

[2010.03.10 20:08:57 | 000,000,000 | -H-D | M] -- C:\SPLASH.SYS

[2010.03.10 20:24:30 | 000,000,000 | ---D | M] -- C:\SwSetup

[2013.05.24 19:21:18 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2010.03.10 20:14:39 | 000,000,000 | -H-D | M] -- C:\SYSTEM.SAV

[2013.03.07 20:46:36 | 000,000,000 | ---D | M] -- C:\TorrentStream

[2010.08.14 09:46:19 | 000,000,000 | R--D | M] -- C:\Users

[2013.05.27 21:33:22 | 000,000,000 | ---D | M] -- C:\Windows

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 
 < C:\Windows\system32\*.tsp >

[2009.07.14 03:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp

[2009.07.14 03:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp

[2009.07.14 03:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp

[2009.07.14 03:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp

[2010.11.20 14:16:53 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp

[2009.07.14 07:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT

[2009.07.14 07:08:49 | 000,032,632 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2012.08.31 12:57:53 | 000,000,332 | -H-- | C] () -- C:\Windows\Tasks\CodecUpdaterTask{A3BC3E92-28B6-42C0-93BD-0D1B5CF5C1C7}.job

[2012.10.31 21:29:54 | 000,000,522 | ---- | C] () -- C:\Windows\Tasks\MATLAB R2012a Startup Accelerator.job

[2012.12.27 00:32:35 | 000,000,362 | -H-- | C] () -- C:\Windows\Tasks\ZoomExUpdaterTask{F23D1332-650C-41C4-A9AD-35612BEE4DA8}.job

[2013.03.11 16:09:12 | 000,001,104 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

[2013.03.11 16:09:12 | 000,001,108 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

[2013.04.17 13:44:00 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

[2013.05.23 18:46:03 | 000,000,276 | ---- | C] () -- C:\Windows\Tasks\PC Performer_DEFAULT.job

[2013.05.23 18:46:03 | 000,000,284 | ---- | C] () -- C:\Windows\Tasks\PC Performer_UPDATES.job

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: EVENTLOG.DLL  >

[2010.01.26 23:29:28 | 000,028,797 | ---- | M] () MD5=4571E750E4A920D773511F50A2E62A20 -- C:\$Recycle.Bin\S-1-5-21-2295630978-4142572454-2340649278-1000\$RWXIVQC\perl\win32\lib\auto\Win32\EventLog\EventLog.dll

[2007.05.17 22:34:04 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files (x86)\CyberLink\PowerDirector\EventLog.dll

 
 < MD5 for: EXPLORER.EXE  >

[2009.12.09 09:00:54 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_b8b0208ee0ce1889\explorer.exe

[2011.02.26 08:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe

[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe

[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe

[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe

[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe

[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe

[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe

[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe

[2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe

[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe

[2009.12.09 09:00:54 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=6D4F9E4B640B413C6F73414327484C80 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_addea9f19345cd81\explorer.exe

[2009.08.03 08:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe

[2009.10.31 08:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe

[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe

[2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

[2009.10.31 08:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe

[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe

[2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe

[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe

[2009.12.09 09:00:54 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=CA17F8620815267DC838E30B68CB5052 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_ae5b763cac6d568e\explorer.exe

[2011.02.26 08:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe

[2009.08.03 08:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

[2009.12.09 09:00:54 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_b8335443c7a68f7c\explorer.exe

 
 < MD5 for: IASTOR.SYS  >

[2009.06.04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys

[2009.06.04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysNative\drivers\iaStor.sys

[2009.06.04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_7fb62b08f6b7117a\iaStor.sys

[2009.06.04 19:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < %USERPROFILE%\*.* >

[2012.02.18 11:41:12 | 000,000,154 | ---- | M] () -- C:\Users\roman\.appletviewer

[2013.05.23 22:24:48 | 000,159,744 | ---- | M] () -- C:\Users\roman\4727213.dll

[2013.05.27 23:44:11 | 003,145,728 | -HS- | M] () -- C:\Users\roman\ntuser.dat

[2013.05.27 23:44:11 | 000,262,144 | -HS- | M] () -- C:\Users\roman\ntuser.dat.LOG1

[2010.03.10 20:08:48 | 000,000,000 | -HS- | M] () -- C:\Users\roman\ntuser.dat.LOG2

[2010.03.10 22:44:56 | 000,065,536 | -HS- | M] () -- C:\Users\roman\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf

[2010.03.10 22:44:56 | 000,524,288 | -HS- | M] () -- C:\Users\roman\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms

[2010.03.10 22:44:56 | 000,524,288 | -HS- | M] () -- C:\Users\roman\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms

[2011.07.12 23:38:51 | 000,065,536 | -HS- | M] () -- C:\Users\roman\ntuser.dat{67bc0534-accc-11e0-b107-e55b9245e8f8}.TM.blf

[2011.07.12 23:38:51 | 000,524,288 | -HS- | M] () -- C:\Users\roman\ntuser.dat{67bc0534-accc-11e0-b107-e55b9245e8f8}.TMContainer00000000000000000001.regtrans-ms

[2011.07.12 23:38:51 | 000,524,288 | -HS- | M] () -- C:\Users\roman\ntuser.dat{67bc0534-accc-11e0-b107-e55b9245e8f8}.TMContainer00000000000000000002.regtrans-ms

[2010.03.10 20:08:48 | 000,000,020 | -HS- | M] () -- C:\Users\roman\ntuser.ini

 
 < %USERPROFILE%\Local Settings\Temp\*.exe >

 
 < %USERPROFILE%\Local Settings\Temp\*.dll >

 
 < %USERPROFILE%\Application Data\*.exe >

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

 
 <           >

 
 ========== Files - Unicode (All) ==========

[2013.02.23 15:56:01 | 000,000,040 | ---- | M] ()(C:\Windows\SysNative\?µ) -- C:\Windows\SysNative\漰µ

[2013.02.23 15:56:01 | 000,000,040 | ---- | C] ()(C:\Windows\SysNative\?µ) -- C:\Windows\SysNative\漰µ
 

< End of report >

Hi,

otl fix

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

:OTL

O4 - HKCU..\Run: [ctfmon.exe] C:\ProgramData\cowiga.dat ()

[2013.05.23 22:25:55 | 000,001,029 | ---- | M] () -- C:\Users\roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk

[2013.05.23 22:25:26 | 000,000,152 | ---- | M] () -- C:\ProgramData\agiwoc.reg

[2013.05.23 22:25:26 | 000,000,056 | ---- | M] () -- C:\ProgramData\agiwoc.bat

[2013.05.23 22:24:48 | 000,159,744 | ---- | M] () -- C:\Users\roman\4727213.dll

:files

:Commands

[emptytemp]

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

Bin nicht sicher ob ich das mit dem Upload ganz richtig hinbekommen habe. Gab ein kleines Problem beim Erstellen der ZIP-Datei.

LG

Code:

All processes killed

========== OTL ==========

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ctfmon.exe not found.

File C:\ProgramData\cowiga.dat not found.

File C:\Users\roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk not found.

File C:\ProgramData\agiwoc.reg not found.

File C:\ProgramData\agiwoc.bat not found.

File C:\Users\roman\4727213.dll not found.

========== FILES ==========

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: ADMINI~1

->Temp folder emptied: 0 bytes

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

User: roman

->Temp folder emptied: 252910 bytes

->Temporary Internet Files folder emptied: 360307 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 15281019 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 492 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 20516 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 4338 bytes

 

Total Files Cleaned = 15,00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 05282013_154713
 

Files\Folders moved on Reboot...

C:\Users\roman\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

File\Folder C:\Windows\temp\hsperfdata_PC-ROMAN$\1748 not found!

File move failed. C:\Windows\temp\ib2 scheduled to be moved on reboot.

File move failed. C:\Windows\temp\ib3 scheduled to be moved on reboot.

File move failed. C:\Windows\temp\ib4 scheduled to be moved on reboot.
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Ok, weiter mit:
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

danke!

Code:

16:33:14.0537 2084  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42

16:33:14.0684 2084  ============================================================

16:33:14.0684 2084  Current date / time: 2013/05/28 16:33:14.0684

16:33:14.0684 2084  SystemInfo:

16:33:14.0684 2084  

16:33:14.0684 2084  OS Version: 6.1.7601 ServicePack: 1.0

16:33:14.0684 2084  Product type: Workstation

16:33:14.0684 2084  ComputerName: PC-ROMAN

16:33:14.0684 2084  UserName: roman

16:33:14.0684 2084  Windows directory: C:\Windows

16:33:14.0684 2084  System windows directory: C:\Windows

16:33:14.0684 2084  Running under WOW64

16:33:14.0684 2084  Processor architecture: Intel x64

16:33:14.0684 2084  Number of processors: 2

16:33:14.0684 2084  Page size: 0x1000

16:33:14.0684 2084  Boot type: Normal boot

16:33:14.0684 2084  ============================================================

16:33:15.0146 2084  Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

16:33:15.0156 2084  ============================================================

16:33:15.0156 2084  \Device\Harddisk0\DR0:

16:33:15.0156 2084  MBR partitions:

16:33:15.0156 2084  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63800

16:33:15.0156 2084  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x64000, BlocksNum 0x23353000

16:33:15.0156 2084  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x233B7000, BlocksNum 0x2043800

16:33:15.0156 2084  \Device\Harddisk0\DR0\Partition4: MBR, Type 0xC, StartLBA 0x253FA800, BlocksNum 0x33AB0

16:33:15.0156 2084  ============================================================

16:33:15.0176 2084  C: <-> \Device\Harddisk0\DR0\Partition2

16:33:15.0206 2084  D: <-> \Device\Harddisk0\DR0\Partition3

16:33:15.0216 2084  E: <-> \Device\Harddisk0\DR0\Partition4

16:33:15.0216 2084  ============================================================

16:33:15.0216 2084  Initialize success

16:33:15.0216 2084  ============================================================

16:34:41.0600 2000  ============================================================

16:34:41.0600 2000  Scan started

16:34:41.0600 2000  Mode: Manual; SigCheck; TDLFS; 

16:34:41.0600 2000  ============================================================

16:34:41.0950 2000  ================ Scan system memory ========================

16:34:41.0950 2000  System memory - ok

16:34:41.0950 2000  ================ Scan services =============================

16:34:42.0100 2000  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys

16:34:42.0260 2000  1394ohci - ok

16:34:42.0300 2000  [ 1CFFE9C06E66A57DAE1452E449A58240 ] Accelerometer   C:\Windows\system32\DRIVERS\Accelerometer.sys

16:34:42.0340 2000  Accelerometer - ok

16:34:42.0390 2000  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys

16:34:42.0430 2000  ACPI - ok

16:34:42.0470 2000  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys

16:34:42.0530 2000  AcpiPmi - ok

16:34:42.0590 2000  [ E5568164C070A4988BD79C896920B3C6 ] acsock          C:\Windows\system32\DRIVERS\acsock64.sys

16:34:42.0630 2000  acsock - ok

16:34:42.0700 2000  [ 8B46D5A1D3EF08232C04D0EAFB871FB2 ] Adobe LM Service C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

16:34:42.0730 2000  Adobe LM Service ( UnsignedFile.Multi.Generic ) - warning

16:34:42.0730 2000  Adobe LM Service - detected UnsignedFile.Multi.Generic (1)

16:34:42.0810 2000  [ 41D15EAD554396BF35B7C5246AD47A28 ] Adobe Version Cue CS2 C:\Program Files (x86)\DVD Maker\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe

16:34:42.0850 2000  Adobe Version Cue CS2 ( UnsignedFile.Multi.Generic ) - warning

16:34:42.0850 2000  Adobe Version Cue CS2 - detected UnsignedFile.Multi.Generic (1)

16:34:42.0950 2000  [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

16:34:42.0980 2000  AdobeARMservice - ok

16:34:43.0090 2000  [ F040037B149FD0F5A5044AE563390FA7 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

16:34:43.0130 2000  AdobeFlashPlayerUpdateSvc - ok

16:34:43.0200 2000  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys

16:34:43.0270 2000  adp94xx - ok

16:34:43.0300 2000  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys

16:34:43.0350 2000  adpahci - ok

16:34:43.0360 2000  [ E109549C90F62FB570B9540C4B148E54 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys

16:34:43.0400 2000  adpu320 - ok

16:34:43.0440 2000  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll

16:34:43.0562 2000  AeLookupSvc - ok

16:34:43.0662 2000  [ A6FB9DB8F1A86861D955FD6975977AE0 ] AESTFilters     C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\AESTSr64.exe

16:34:43.0732 2000  AESTFilters - ok

16:34:43.0792 2000  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD             C:\Windows\system32\drivers\afd.sys

16:34:43.0872 2000  AFD - ok

16:34:43.0922 2000  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys

16:34:43.0962 2000  agp440 - ok

16:34:43.0982 2000  [ 3290D6946B5E30E70414990574883DDB ] ALG             C:\Windows\System32\alg.exe

16:34:44.0042 2000  ALG - ok

16:34:44.0072 2000  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys

16:34:44.0112 2000  aliide - ok

16:34:44.0122 2000  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys

16:34:44.0162 2000  amdide - ok

16:34:44.0212 2000  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys

16:34:44.0282 2000  AmdK8 - ok

16:34:44.0302 2000  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys

16:34:44.0372 2000  AmdPPM - ok

16:34:44.0422 2000  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata         C:\Windows\system32\drivers\amdsata.sys

16:34:44.0452 2000  amdsata - ok

16:34:44.0502 2000  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys

16:34:44.0542 2000  amdsbs - ok

16:34:44.0552 2000  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata         C:\Windows\system32\drivers\amdxata.sys

16:34:44.0582 2000  amdxata - ok

16:34:44.0612 2000  [ 8EBE028FC7E48725CDD92013580EFD17 ] AmUStor         C:\Windows\system32\drivers\AmUStor.SYS

16:34:44.0672 2000  AmUStor - ok

16:34:44.0742 2000  [ D9A92E6DD41C5ADC045AE485026AA40C ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

16:34:44.0772 2000  AntiVirSchedulerService - ok

16:34:44.0822 2000  [ 66A7A38F7C439153B758548375EB9E5E ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

16:34:44.0852 2000  AntiVirService - ok

16:34:44.0893 2000  [ 9815014F3E30357168DA272088C6F12F ] ApfiltrService  C:\Windows\system32\DRIVERS\Apfiltr.sys

16:34:44.0924 2000  ApfiltrService - ok

16:34:44.0974 2000  [ 89A69C3F2F319B43379399547526D952 ] AppID           C:\Windows\system32\drivers\appid.sys

16:34:45.0094 2000  AppID - ok

16:34:45.0124 2000  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll

16:34:45.0244 2000  AppIDSvc - ok

16:34:45.0274 2000  [ 9D2A2369AB4B08A4905FE72DB104498F ] Appinfo         C:\Windows\System32\appinfo.dll

16:34:45.0344 2000  Appinfo - ok

16:34:45.0394 2000  [ C484F8CEB1717C540242531DB7845C4E ] arc             C:\Windows\system32\DRIVERS\arc.sys

16:34:45.0434 2000  arc - ok

16:34:45.0454 2000  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys

16:34:45.0484 2000  arcsas - ok

16:34:45.0504 2000  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys

16:34:45.0624 2000  AsyncMac - ok

16:34:45.0674 2000  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi           C:\Windows\system32\drivers\atapi.sys

16:34:45.0714 2000  atapi - ok

16:34:45.0784 2000  [ 38562A6A9CB10844759EAF2B01A7FCD3 ] athr            C:\Windows\system32\DRIVERS\athrx.sys

16:34:45.0894 2000  athr - ok

16:34:45.0944 2000  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll

16:34:46.0094 2000  AudioEndpointBuilder - ok

16:34:46.0124 2000  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll

16:34:46.0234 2000  AudioSrv - ok

16:34:46.0284 2000  [ 09E6069EF94B345061B4BD3CEBD974C8 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys

16:34:46.0324 2000  avgntflt - ok

16:34:46.0384 2000  [ 488486DAD09A5B6C6DBB8B990A8B2307 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys

16:34:46.0414 2000  avipbb - ok

16:34:46.0454 2000  [ 490FA25161BF3E51993EB724ECF0ACEB ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys

16:34:46.0484 2000  avkmgr - ok

16:34:46.0534 2000  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll

16:34:46.0654 2000  AxInstSV - ok

16:34:46.0704 2000  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys

16:34:46.0794 2000  b06bdrv - ok

16:34:46.0834 2000  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys

16:34:46.0884 2000  b57nd60a - ok

16:34:46.0924 2000  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll

16:34:46.0994 2000  BDESVC - ok

16:34:47.0004 2000  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys

16:34:47.0114 2000  Beep - ok

16:34:47.0184 2000  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE             C:\Windows\System32\bfe.dll

16:34:47.0344 2000  BFE - ok

16:34:47.0413 2000  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll

16:34:47.0568 2000  BITS - ok

16:34:47.0618 2000  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys

16:34:47.0668 2000  blbdrive - ok

16:34:47.0698 2000  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys

16:34:47.0748 2000  bowser - ok

16:34:47.0788 2000  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys

16:34:47.0858 2000  BrFiltLo - ok

16:34:47.0868 2000  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys

16:34:47.0908 2000  BrFiltUp - ok

16:34:47.0948 2000  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser         C:\Windows\System32\browser.dll

16:34:48.0018 2000  Browser - ok

16:34:48.0058 2000  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid         C:\Windows\System32\Drivers\Brserid.sys

16:34:48.0148 2000  Brserid - ok

16:34:48.0168 2000  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys

16:34:48.0228 2000  BrSerWdm - ok

16:34:48.0248 2000  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys

16:34:48.0298 2000  BrUsbMdm - ok

16:34:48.0318 2000  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys

16:34:48.0368 2000  BrUsbSer - ok

16:34:48.0418 2000  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum         C:\Windows\system32\drivers\BthEnum.sys

16:34:48.0508 2000  BthEnum - ok

16:34:48.0538 2000  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys

16:34:48.0578 2000  BTHMODEM - ok

16:34:48.0608 2000  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys

16:34:48.0668 2000  BthPan - ok

16:34:48.0708 2000  [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT         C:\Windows\System32\Drivers\BTHport.sys

16:34:48.0778 2000  BTHPORT - ok

16:34:48.0828 2000  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv         C:\Windows\system32\bthserv.dll

16:34:48.0946 2000  bthserv - ok

16:34:48.0960 2000  [ F188B7394D81010767B6DF3178519A37 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys

16:34:49.0010 2000  BTHUSB - ok

16:34:49.0050 2000  [ 4BDBDB86ABBA924E029FB2683BE7C505 ] btwaudio        C:\Windows\system32\drivers\btwaudio.sys

16:34:49.0080 2000  btwaudio - ok

16:34:49.0100 2000  [ 5C849BD7C78791C5CEE9F4651D7FE38D ] btwavdt         C:\Windows\system32\DRIVERS\btwavdt.sys

16:34:49.0130 2000  btwavdt - ok

16:34:49.0200 2000  [ 31DA517946FFE416442E864592548F8A ] btwdins         C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

16:34:49.0260 2000  btwdins - ok

16:34:49.0290 2000  [ 6149301DC3F81D6F9667A3FBAC410975 ] btwl2cap        C:\Windows\system32\DRIVERS\btwl2cap.sys

16:34:49.0310 2000  btwl2cap - ok

16:34:49.0340 2000  [ 3E1991AFA851A36DC978B0A1B0535C8B ] btwrchid        C:\Windows\system32\DRIVERS\btwrchid.sys

16:34:49.0370 2000  btwrchid - ok

16:34:49.0410 2000  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys

16:34:49.0520 2000  cdfs - ok

16:34:49.0580 2000  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys

16:34:49.0630 2000  cdrom - ok

16:34:49.0680 2000  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc     C:\Windows\System32\certprop.dll

16:34:49.0770 2000  CertPropSvc - ok

16:34:49.0790 2000  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys

16:34:49.0850 2000  circlass - ok

16:34:49.0890 2000  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys

16:34:49.0930 2000  CLFS - ok

16:34:50.0000 2000  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

16:34:50.0040 2000  clr_optimization_v2.0.50727_32 - ok

16:34:50.0090 2000  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

16:34:50.0120 2000  clr_optimization_v2.0.50727_64 - ok

16:34:50.0160 2000  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

16:34:50.0190 2000  clr_optimization_v4.0.30319_32 - ok

16:34:50.0220 2000  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

16:34:50.0250 2000  clr_optimization_v4.0.30319_64 - ok

16:34:50.0280 2000  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys

16:34:50.0320 2000  CmBatt - ok

16:34:50.0350 2000  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys

16:34:50.0390 2000  cmdide - ok

16:34:50.0440 2000  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG             C:\Windows\system32\Drivers\cng.sys

16:34:50.0520 2000  CNG - ok

16:34:50.0570 2000  [ F9A79C5B27037821112C50A9C8FB367A ] Com4QLBEx       C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

16:34:50.0600 2000  Com4QLBEx - ok

16:34:50.0620 2000  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys

16:34:50.0650 2000  Compbatt - ok

16:34:50.0690 2000  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys

16:34:50.0740 2000  CompositeBus - ok

16:34:50.0770 2000  COMSysApp - ok

16:34:50.0800 2000  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys

16:34:50.0830 2000  crcdisk - ok

16:34:50.0880 2000  [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc        C:\Windows\system32\cryptsvc.dll

16:34:50.0950 2000  CryptSvc - ok

16:34:51.0010 2000  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll

16:34:51.0150 2000  DcomLaunch - ok

16:34:51.0200 2000  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc       C:\Windows\System32\defragsvc.dll

16:34:51.0350 2000  defragsvc - ok

16:34:51.0390 2000  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys

16:34:51.0500 2000  DfsC - ok

16:34:51.0560 2000  [ 41AC348DBD378F618CB4FDEE54270692 ] dg_ssudbus      C:\Windows\system32\DRIVERS\ssudbus.sys

16:34:51.0600 2000  dg_ssudbus - ok

16:34:51.0650 2000  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll

16:34:51.0730 2000  Dhcp - ok

16:34:51.0760 2000  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys

16:34:51.0870 2000  discache - ok

16:34:51.0900 2000  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys

16:34:51.0940 2000  Disk - ok

16:34:51.0975 2000  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll

16:34:52.0042 2000  Dnscache - ok

16:34:52.0082 2000  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc         C:\Windows\System32\dot3svc.dll

16:34:52.0202 2000  dot3svc - ok

16:34:52.0242 2000  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS             C:\Windows\system32\dps.dll

16:34:52.0352 2000  DPS - ok

16:34:52.0382 2000  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys

16:34:52.0432 2000  drmkaud - ok

16:34:52.0492 2000  [ F9F437B39CC0FCACCE8AC7CE422F537F ] DVMIO           C:\SPLASH.SYS\config\dvmio.sys

16:34:52.0532 2000  DVMIO - ok

16:34:52.0624 2000  [ AF2E16242AA723F68F461B6EAE2EAD3D ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys

16:34:52.0696 2000  DXGKrnl - ok

16:34:52.0726 2000  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost         C:\Windows\System32\eapsvc.dll

16:34:52.0846 2000  EapHost - ok

16:34:52.0956 2000  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys

16:34:53.0146 2000  ebdrv - ok

16:34:53.0196 2000  [ C118A82CD78818C29AB228366EBF81C3 ] EFS             C:\Windows\System32\lsass.exe

16:34:53.0286 2000  EFS - ok

16:34:53.0346 2000  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe

16:34:53.0456 2000  ehRecvr - ok

16:34:53.0486 2000  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched         C:\Windows\ehome\ehsched.exe

16:34:53.0556 2000  ehSched - ok

16:34:53.0606 2000  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys

16:34:53.0676 2000  elxstor - ok

16:34:53.0686 2000  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys

16:34:53.0746 2000  ErrDev - ok

16:34:53.0796 2000  [ 3B32CAA07D672F8A2E0DF5CB3A873F45 ] EsgScanner      C:\Windows\system32\DRIVERS\EsgScanner.sys

16:34:53.0826 2000  EsgScanner - ok

16:34:53.0876 2000  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem     C:\Windows\system32\es.dll

16:34:54.0006 2000  EventSystem - ok

16:34:54.0036 2000  [ 251AF86E0A4DDF3A6B181ED5103B06B1 ] ewusbnet        C:\Windows\system32\DRIVERS\ewusbnet.sys

16:34:54.0096 2000  ewusbnet - ok

16:34:54.0126 2000  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat           C:\Windows\system32\drivers\exfat.sys

16:34:54.0236 2000  exfat - ok

16:34:54.0256 2000  ezSharedSvc - ok

16:34:54.0286 2000  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat         C:\Windows\system32\drivers\fastfat.sys

16:34:54.0406 2000  fastfat - ok

16:34:54.0476 2000  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax             C:\Windows\system32\fxssvc.exe

16:34:54.0566 2000  Fax - ok

16:34:54.0586 2000  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc             C:\Windows\system32\DRIVERS\fdc.sys

16:34:54.0626 2000  fdc - ok

16:34:54.0636 2000  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost         C:\Windows\system32\fdPHost.dll

16:34:54.0746 2000  fdPHost - ok

16:34:54.0766 2000  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll

16:34:54.0866 2000  FDResPub - ok

16:34:54.0896 2000  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys

16:34:54.0926 2000  FileInfo - ok

16:34:54.0946 2000  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys

16:34:55.0056 2000  Filetrace - ok

16:34:55.0086 2000  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys

16:34:55.0146 2000  flpydisk - ok

16:34:55.0228 2000  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys

16:34:55.0278 2000  FltMgr - ok

16:34:55.0338 2000  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache       C:\Windows\system32\FntCache.dll

16:34:55.0438 2000  FontCache - ok

16:34:55.0488 2000  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

16:34:55.0508 2000  FontCache3.0.0.0 - ok

16:34:55.0528 2000  [ D43703496149971890703B4B1B723EAC ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys

16:34:55.0568 2000  FsDepends - ok

16:34:55.0588 2000  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys

16:34:55.0628 2000  Fs_Rec - ok

16:34:55.0668 2000  [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys

16:34:55.0718 2000  fvevol - ok

16:34:55.0738 2000  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys

16:34:55.0778 2000  gagp30kx - ok

16:34:55.0828 2000  [ C1BBCE4B30B45410178EE674C818D10C ] GameConsoleService C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe

16:34:55.0868 2000  GameConsoleService - ok

16:34:55.0918 2000  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc           C:\Windows\System32\gpsvc.dll

16:34:56.0038 2000  gpsvc - ok

16:34:56.0128 2000  [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

16:34:56.0158 2000  gupdate - ok

16:34:56.0190 2000  [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

16:34:56.0215 2000  gupdatem - ok

16:34:56.0240 2000  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys

16:34:56.0300 2000  hcw85cir - ok

16:34:56.0360 2000  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

16:34:56.0440 2000  HdAudAddService - ok

16:34:56.0460 2000  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys

16:34:56.0510 2000  HDAudBus - ok

16:34:56.0540 2000  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys

16:34:56.0570 2000  HidBatt - ok

16:34:56.0600 2000  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys

16:34:56.0660 2000  HidBth - ok

16:34:56.0691 2000  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys

16:34:56.0742 2000  HidIr - ok

16:34:56.0772 2000  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv         C:\Windows\system32\hidserv.dll

16:34:56.0892 2000  hidserv - ok

16:34:56.0932 2000  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys

16:34:56.0972 2000  HidUsb - ok

16:34:57.0002 2000  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll

16:34:57.0102 2000  hkmsvc - ok

16:34:57.0152 2000  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll

16:34:57.0212 2000  HomeGroupListener - ok

16:34:57.0252 2000  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll

16:34:57.0302 2000  HomeGroupProvider - ok

16:34:57.0362 2000  [ C84BCC03858DAEAC4DB1E95EFCCE1934 ] HP Health Check Service C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe

16:34:57.0382 2000  HP Health Check Service ( UnsignedFile.Multi.Generic ) - warning

16:34:57.0382 2000  HP Health Check Service - detected UnsignedFile.Multi.Generic (1)

16:34:57.0412 2000  [ 05712FDDBD45A5864EB326FAABC6A4E3 ] hpdskflt        C:\Windows\system32\DRIVERS\hpdskflt.sys

16:34:57.0442 2000  hpdskflt - ok

16:34:57.0482 2000  [ 9AF482D058BE59CC28BCE52E7C4B747C ] HpqKbFiltr      C:\Windows\system32\DRIVERS\HpqKbFiltr.sys

16:34:57.0522 2000  HpqKbFiltr - ok

16:34:57.0562 2000  [ FDF273A845F1FFCCEADF363AAF47582F ] hpqwmiex        C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

16:34:57.0592 2000  hpqwmiex - ok

16:34:57.0632 2000  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys

16:34:57.0672 2000  HpSAMD - ok

16:34:57.0692 2000  [ AA036CC5F5221D9B915F4D4DCE74BA9A ] hpsrv           C:\Windows\system32\Hpservice.exe

16:34:57.0722 2000  hpsrv - ok

16:34:57.0782 2000  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys

16:34:57.0932 2000  HTTP - ok

16:34:57.0972 2000  [ 4B5C07DB91A0099272FAAE732E1152BD ] hwdatacard      C:\Windows\system32\DRIVERS\ewusbmdm.sys

16:34:58.0032 2000  hwdatacard - ok

16:34:58.0072 2000  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys

16:34:58.0102 2000  hwpolicy - ok

16:34:58.0132 2000  [ 1F24CF1F7DB6D4461AC65A86DB8E4BC2 ] hwusbfake       C:\Windows\system32\DRIVERS\ewusbfake.sys

16:34:58.0202 2000  hwusbfake - ok

16:34:58.0242 2000  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys

16:34:58.0282 2000  i8042prt - ok

16:34:58.0312 2000  [ 1D004CB1DA6323B1F55CAEF7F94B61D9 ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys

16:34:58.0352 2000  iaStor - ok

16:34:58.0382 2000  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys

16:34:58.0442 2000  iaStorV - ok

16:34:58.0512 2000  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

16:34:58.0582 2000  idsvc - ok

16:34:58.0812 2000  [ 2D18C9E1F23970DE32D78D3B1CDDA0A7 ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys

16:34:59.0172 2000  igfx - ok

16:34:59.0212 2000  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys

16:34:59.0242 2000  iirsp - ok

16:34:59.0302 2000  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll

16:34:59.0452 2000  IKEEXT - ok

16:34:59.0482 2000  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys

16:34:59.0512 2000  intelide - ok

16:34:59.0542 2000  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys

16:34:59.0592 2000  intelppm - ok

16:34:59.0632 2000  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum       C:\Windows\system32\ipbusenum.dll

16:34:59.0734 2000  IPBusEnum - ok

16:34:59.0764 2000  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys

16:34:59.0874 2000  IpFilterDriver - ok

16:34:59.0914 2000  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll

16:34:59.0964 2000  iphlpsvc - ok

16:35:00.0004 2000  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys

16:35:00.0034 2000  IPMIDRV - ok

16:35:00.0064 2000  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys

16:35:00.0174 2000  IPNAT - ok

16:35:00.0214 2000  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys

16:35:00.0274 2000  IRENUM - ok

16:35:00.0294 2000  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys

16:35:00.0334 2000  isapnp - ok

16:35:00.0374 2000  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys

16:35:00.0414 2000  iScsiPrt - ok

16:35:00.0444 2000  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys

16:35:00.0474 2000  kbdclass - ok

16:35:00.0524 2000  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys

16:35:00.0574 2000  kbdhid - ok

16:35:00.0594 2000  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe

16:35:00.0634 2000  KeyIso - ok

16:35:00.0664 2000  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys

16:35:00.0704 2000  KSecDD - ok

16:35:00.0744 2000  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys

16:35:00.0784 2000  KSecPkg - ok

16:35:00.0794 2000  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys

16:35:00.0904 2000  ksthunk - ok

16:35:00.0944 2000  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm           C:\Windows\system32\msdtckrm.dll

16:35:01.0074 2000  KtmRm - ok

16:35:01.0114 2000  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll

16:35:01.0234 2000  LanmanServer - ok

16:35:01.0264 2000  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

16:35:01.0374 2000  LanmanWorkstation - ok

16:35:01.0454 2000  [ 2238B91AC1A12CC6CC4C4FED41258B2A ] LightScribeService C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

16:35:01.0474 2000  LightScribeService ( UnsignedFile.Multi.Generic ) - warning

16:35:01.0474 2000  LightScribeService - detected UnsignedFile.Multi.Generic (1)

16:35:01.0504 2000  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys

16:35:01.0614 2000  lltdio - ok

16:35:01.0664 2000  [ C1185803384AB3FEED115F79F109427F ] lltdsvc         C:\Windows\System32\lltdsvc.dll

16:35:01.0804 2000  lltdsvc - ok

16:35:01.0814 2000  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts         C:\Windows\System32\lmhsvc.dll

16:35:01.0914 2000  lmhosts - ok

16:35:01.0944 2000  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys

16:35:01.0984 2000  LSI_FC - ok

16:35:02.0014 2000  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys

16:35:02.0054 2000  LSI_SAS - ok

16:35:02.0064 2000  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys

16:35:02.0104 2000  LSI_SAS2 - ok

16:35:02.0124 2000  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys

16:35:02.0164 2000  LSI_SCSI - ok

16:35:02.0184 2000  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv           C:\Windows\system32\drivers\luafv.sys

16:35:02.0294 2000  luafv - ok

16:35:02.0334 2000  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll

16:35:02.0374 2000  Mcx2Svc - ok

16:35:02.0404 2000  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys

16:35:02.0434 2000  megasas - ok

16:35:02.0454 2000  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys

16:35:02.0504 2000  MegaSR - ok

16:35:02.0584 2000  [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe

16:35:02.0614 2000  Microsoft Office Groove Audit Service - ok

16:35:02.0654 2000  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS           C:\Windows\system32\mmcss.dll

16:35:02.0764 2000  MMCSS - ok

16:35:02.0784 2000  [ 800BA92F7010378B09F9ED9270F07137 ] Modem           C:\Windows\system32\drivers\modem.sys

16:35:02.0894 2000  Modem - ok

16:35:02.0924 2000  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor         C:\Windows\system32\DRIVERS\monitor.sys

16:35:02.0984 2000  monitor - ok

16:35:03.0024 2000  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\drivers\mouclass.sys

16:35:03.0064 2000  mouclass - ok

16:35:03.0084 2000  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys

16:35:03.0134 2000  mouhid - ok

16:35:03.0164 2000  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys

16:35:03.0194 2000  mountmgr - ok

16:35:03.0274 2000  [ 825BF0E46B4470A463AEB641480C5FCA ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

16:35:03.0314 2000  MozillaMaintenance - ok

16:35:03.0324 2000  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys

16:35:03.0364 2000  mpio - ok

16:35:03.0384 2000  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys

16:35:03.0484 2000  mpsdrv - ok

16:35:03.0534 2000  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll

16:35:03.0684 2000  MpsSvc - ok

16:35:03.0724 2000  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys

16:35:03.0784 2000  MRxDAV - ok

16:35:03.0824 2000  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys

16:35:03.0874 2000  mrxsmb - ok

16:35:03.0904 2000  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys

16:35:03.0964 2000  mrxsmb10 - ok

16:35:03.0984 2000  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys

16:35:04.0024 2000  mrxsmb20 - ok

16:35:04.0064 2000  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys

16:35:04.0094 2000  msahci - ok

16:35:04.0124 2000  [ DB801A638D011B9633829EB6F663C900 ] msdsm           C:\Windows\system32\drivers\msdsm.sys

16:35:04.0164 2000  msdsm - ok

16:35:04.0184 2000  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC           C:\Windows\System32\msdtc.exe

16:35:04.0224 2000  MSDTC - ok

16:35:04.0254 2000  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys

16:35:04.0354 2000  Msfs - ok

16:35:04.0384 2000  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys

16:35:04.0484 2000  mshidkmdf - ok

16:35:04.0514 2000  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys

16:35:04.0554 2000  msisadrv - ok

16:35:04.0574 2000  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll

16:35:04.0704 2000  MSiSCSI - ok

16:35:04.0714 2000  msiserver - ok

16:35:04.0744 2000  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys

16:35:04.0854 2000  MSKSSRV - ok

16:35:04.0884 2000  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys

16:35:04.0994 2000  MSPCLOCK - ok

16:35:05.0014 2000  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys

16:35:05.0124 2000  MSPQM - ok

16:35:05.0164 2000  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys

16:35:05.0214 2000  MsRPC - ok

16:35:05.0234 2000  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys

16:35:05.0264 2000  mssmbios - ok

16:35:05.0284 2000  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys

16:35:05.0386 2000  MSTEE - ok

16:35:05.0426 2000  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys

16:35:05.0476 2000  MTConfig - ok

16:35:05.0506 2000  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup             C:\Windows\system32\Drivers\mup.sys

16:35:05.0546 2000  Mup - ok

16:35:05.0596 2000  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll

16:35:05.0728 2000  napagent - ok

16:35:05.0758 2000  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys

16:35:05.0828 2000  NativeWifiP - ok

16:35:05.0908 2000  NAVENG - ok

16:35:05.0918 2000  NAVEX15 - ok

16:35:05.0978 2000  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys

16:35:06.0058 2000  NDIS - ok

16:35:06.0078 2000  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys

16:35:06.0188 2000  NdisCap - ok

16:35:06.0218 2000  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys

16:35:06.0338 2000  NdisTapi - ok

16:35:06.0378 2000  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys

16:35:06.0488 2000  Ndisuio - ok

16:35:06.0528 2000  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys

16:35:06.0638 2000  NdisWan - ok

16:35:06.0668 2000  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys

16:35:06.0778 2000  NDProxy - ok

16:35:06.0798 2000  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys

16:35:06.0908 2000  NetBIOS - ok

16:35:06.0967 2000  [ 09594D1089C523423B32A4229263F068 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys

16:35:07.0070 2000  NetBT - ok

16:35:07.0090 2000  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe

16:35:07.0120 2000  Netlogon - ok

16:35:07.0160 2000  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll

16:35:07.0290 2000  Netman - ok

16:35:07.0320 2000  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll

16:35:07.0440 2000  netprofm - ok

16:35:07.0470 2000  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

16:35:07.0500 2000  NetTcpPortSharing - ok

16:35:07.0660 2000  [ 64428DFDAF6E88366CB51F45A79C5F69 ] netw5v64        C:\Windows\system32\DRIVERS\netw5v64.sys

16:35:07.0960 2000  netw5v64 - ok

16:35:08.0000 2000  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys

16:35:08.0040 2000  nfrd960 - ok

16:35:08.0110 2000  [ 2F86BE1818C2D7AC90478E3323EE7FCB ] NIS             C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\ccSvcHst.exe

16:35:08.0150 2000  NIS - ok

16:35:08.0170 2000  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll

16:35:08.0230 2000  NlaSvc - ok

16:35:08.0380 2000  [ BDDEB5CFD294F527DA712CA17F66C3C6 ] NOBU            C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

16:35:08.0562 2000  NOBU - ok

16:35:08.0592 2000  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys

16:35:08.0692 2000  Npfs - ok

16:35:08.0722 2000  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi             C:\Windows\system32\nsisvc.dll

16:35:08.0832 2000  nsi - ok

16:35:08.0852 2000  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys

16:35:08.0972 2000  nsiproxy - ok

16:35:09.0052 2000  [ B98F8C6E31CD07B2E6F71F7F648E38C0 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys

16:35:09.0182 2000  Ntfs - ok

16:35:09.0202 2000  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys

16:35:09.0312 2000  Null - ok

16:35:09.0352 2000  [ A6DCE41417B2D310ECCA5D797AE7A66E ] NVHDA           C:\Windows\system32\drivers\nvhda64v.sys

16:35:09.0382 2000  NVHDA - ok

16:35:09.0722 2000  [ CEC9B11559729D9497FBB8C8A30BDE8F ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys

16:35:10.0222 2000  nvlddmkm - ok

16:35:10.0294 2000  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys

16:35:10.0334 2000  nvraid - ok

16:35:10.0354 2000  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys

16:35:10.0394 2000  nvstor - ok

16:35:10.0414 2000  [ 991079F9F2A4A82E5549677B8265A1FB ] nvsvc           C:\Windows\system32\nvvsvc.exe

16:35:10.0454 2000  nvsvc - ok

16:35:10.0504 2000  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys

16:35:10.0544 2000  nv_agp - ok

16:35:10.0624 2000  [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv          C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

16:35:10.0684 2000  odserv - ok

16:35:10.0714 2000  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys

16:35:10.0774 2000  ohci1394 - ok

16:35:10.0794 2000  ONDAusbmdm6k - ok

16:35:10.0814 2000  ONDAusbnet - ok

16:35:10.0824 2000  ONDAusbnmea - ok

16:35:10.0834 2000  ONDAusbser6k - ok

16:35:10.0864 2000  [ 5A432A042DAE460ABE7199B758E8606C ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

16:35:10.0894 2000  ose - ok

16:35:10.0934 2000  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll

16:35:11.0014 2000  p2pimsvc - ok

16:35:11.0044 2000  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll

16:35:11.0094 2000  p2psvc - ok

16:35:11.0124 2000  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport         C:\Windows\system32\DRIVERS\parport.sys

16:35:11.0174 2000  Parport - ok

16:35:11.0204 2000  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr         C:\Windows\system32\drivers\partmgr.sys

16:35:11.0244 2000  partmgr - ok

16:35:11.0254 2000  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll

16:35:11.0314 2000  PcaSvc - ok

16:35:11.0334 2000  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci             C:\Windows\system32\drivers\pci.sys

16:35:11.0364 2000  pci - ok

16:35:11.0404 2000  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys

16:35:11.0434 2000  pciide - ok

16:35:11.0464 2000  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys

16:35:11.0504 2000  pcmcia - ok

16:35:11.0534 2000  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw             C:\Windows\system32\drivers\pcw.sys

16:35:11.0564 2000  pcw - ok

16:35:11.0604 2000  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys

16:35:11.0744 2000  PEAUTH - ok

16:35:11.0824 2000  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe

16:35:11.0874 2000  PerfHost - ok

16:35:11.0954 2000  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla             C:\Windows\system32\pla.dll

16:35:12.0134 2000  pla - ok

16:35:12.0194 2000  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll

16:35:12.0274 2000  PlugPlay - ok

16:35:12.0304 2000  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll

16:35:12.0364 2000  PNRPAutoReg - ok

16:35:12.0394 2000  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll

16:35:12.0434 2000  PNRPsvc - ok

16:35:12.0474 2000  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll

16:35:12.0604 2000  PolicyAgent - ok

16:35:12.0644 2000  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power           C:\Windows\system32\umpo.dll

16:35:12.0744 2000  Power - ok

16:35:12.0784 2000  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys

16:35:12.0894 2000  PptpMiniport - ok

16:35:12.0924 2000  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor       C:\Windows\system32\DRIVERS\processr.sys

16:35:12.0984 2000  Processor - ok

16:35:13.0024 2000  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc         C:\Windows\system32\profsvc.dll

16:35:13.0104 2000  ProfSvc - ok

16:35:13.0124 2000  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe

16:35:13.0154 2000  ProtectedStorage - ok

16:35:13.0204 2000  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys

16:35:13.0314 2000  Psched - ok

16:35:13.0374 2000  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys

16:35:13.0514 2000  ql2300 - ok

16:35:13.0534 2000  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys

16:35:13.0574 2000  ql40xx - ok

16:35:13.0610 2000  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE           C:\Windows\system32\qwave.dll

16:35:13.0666 2000  QWAVE - ok

16:35:13.0696 2000  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys

16:35:13.0758 2000  QWAVEdrv - ok

16:35:13.0768 2000  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys

16:35:13.0878 2000  RasAcd - ok

16:35:13.0908 2000  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys

16:35:14.0018 2000  RasAgileVpn - ok

16:35:14.0038 2000  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto         C:\Windows\System32\rasauto.dll

16:35:14.0150 2000  RasAuto - ok

16:35:14.0180 2000  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys

16:35:14.0290 2000  Rasl2tp - ok

16:35:14.0340 2000  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll

16:35:14.0450 2000  RasMan - ok

16:35:14.0470 2000  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys

16:35:14.0570 2000  RasPppoe - ok

16:35:14.0600 2000  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys

16:35:14.0710 2000  RasSstp - ok

16:35:14.0750 2000  [ 77F665941019A1594D887A74F301FA2F ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys

16:35:14.0860 2000  rdbss - ok

16:35:14.0890 2000  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys

16:35:14.0950 2000  rdpbus - ok

16:35:14.0970 2000  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys

16:35:15.0080 2000  RDPCDD - ok

16:35:15.0110 2000  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys

16:35:15.0210 2000  RDPENCDD - ok

16:35:15.0230 2000  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys

16:35:15.0340 2000  RDPREFMP - ok

16:35:15.0390 2000  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys

16:35:15.0480 2000  RDPWD - ok

16:35:15.0530 2000  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys

16:35:15.0570 2000  rdyboost - ok

16:35:15.0600 2000  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll

16:35:15.0720 2000  RemoteAccess - ok

16:35:15.0760 2000  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll

16:35:15.0860 2000  RemoteRegistry - ok

16:35:15.0900 2000  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys

16:35:15.0960 2000  RFCOMM - ok

16:35:16.0030 2000  [ 498EB62A160674E793FA40FD65390625 ] RichVideo       C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

16:35:16.0060 2000  RichVideo - ok

16:35:16.0080 2000  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll

16:35:16.0190 2000  RpcEptMapper - ok

16:35:16.0230 2000  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe

16:35:16.0280 2000  RpcLocator - ok

16:35:16.0310 2000  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs           C:\Windows\system32\rpcss.dll

16:35:16.0420 2000  RpcSs - ok

16:35:16.0460 2000  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys

16:35:16.0550 2000  rspndr - ok

16:35:16.0590 2000  [ FE61B0B4AA58C3BD3DFA6279131F7F53 ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys

16:35:16.0650 2000  RTL8167 - ok

16:35:16.0680 2000  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs           C:\Windows\system32\lsass.exe

16:35:16.0720 2000  SamSs - ok

16:35:16.0750 2000  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys

16:35:16.0790 2000  sbp2port - ok

16:35:16.0810 2000  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll

16:35:16.0930 2000  SCardSvr - ok

16:35:16.0970 2000  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys

16:35:17.0070 2000  scfilter - ok

16:35:17.0120 2000  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll

16:35:17.0290 2000  Schedule - ok

16:35:17.0310 2000  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc     C:\Windows\System32\certprop.dll

16:35:17.0410 2000  SCPolicySvc - ok

16:35:17.0450 2000  [ 111E0EBC0AD79CB0FA014B907B231CF0 ] sdbus           C:\Windows\system32\drivers\sdbus.sys

16:35:17.0520 2000  sdbus - ok

16:35:17.0550 2000  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll

16:35:17.0600 2000  SDRSVC - ok

16:35:17.0630 2000  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys

16:35:17.0740 2000  secdrv - ok

16:35:17.0780 2000  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll

16:35:17.0890 2000  seclogon - ok

16:35:17.0910 2000  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll

16:35:18.0020 2000  SENS - ok

16:35:18.0060 2000  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll

16:35:18.0130 2000  SensrSvc - ok

16:35:18.0150 2000  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys

16:35:18.0200 2000  Serenum - ok

16:35:18.0230 2000  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys

16:35:18.0290 2000  Serial - ok

16:35:18.0330 2000  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys

16:35:18.0370 2000  sermouse - ok

16:35:18.0480 2000  [ 8631221AC3AF3B09C718DAA1B19EB8DD ] SesamService    C:\Program Files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe

16:35:18.0570 2000  SesamService - ok

16:35:18.0610 2000  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll

16:35:18.0720 2000  SessionEnv - ok

16:35:18.0750 2000  [ A554811BCD09279536440C964AE35BBF ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys

16:35:18.0810 2000  sffdisk - ok

16:35:18.0830 2000  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys

16:35:18.0880 2000  sffp_mmc - ok

16:35:18.0900 2000  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys

16:35:18.0950 2000  sffp_sd - ok

16:35:18.0970 2000  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys

16:35:19.0020 2000  sfloppy - ok

16:35:19.0060 2000  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll

16:35:19.0180 2000  SharedAccess - ok

16:35:19.0230 2000  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll

16:35:19.0330 2000  ShellHWDetection - ok

16:35:19.0370 2000  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys

16:35:19.0400 2000  SiSRaid2 - ok

16:35:19.0420 2000  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys

16:35:19.0450 2000  SiSRaid4 - ok

16:35:19.0480 2000  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb             C:\Windows\system32\DRIVERS\smb.sys

16:35:19.0600 2000  Smb - ok

16:35:19.0650 2000  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe

16:35:19.0700 2000  SNMPTRAP - ok

16:35:19.0720 2000  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr           C:\Windows\system32\drivers\spldr.sys

16:35:19.0750 2000  spldr - ok

16:35:19.0800 2000  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler         C:\Windows\System32\spoolsv.exe

16:35:19.0890 2000  Spooler - ok

16:35:20.0010 2000  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe

16:35:20.0240 2000  sppsvc - ok

16:35:20.0260 2000  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify     C:\Windows\system32\sppuinotify.dll

16:35:20.0360 2000  sppuinotify - ok

16:35:20.0450 2000  [ 623E4A909E759D73D1C9FA5059A49E9A ] SpyHunter 4 Service C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE

16:35:20.0520 2000  SpyHunter 4 Service - ok

16:35:20.0590 2000  [ 56979A80F6F9DF788A8BFCC1603DA40D ] SRTSP           C:\Windows\system32\drivers\NISx64\1100000.088\SRTSP64.SYS

16:35:20.0630 2000  SRTSP - ok

16:35:20.0650 2000  [ 3C3D82BB245AD1CB00ED48CB2F4AB385 ] SRTSPX          C:\Windows\system32\drivers\NISx64\1100000.088\SRTSPX64.SYS

16:35:20.0680 2000  SRTSPX - ok

16:35:20.0720 2000  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv             C:\Windows\system32\DRIVERS\srv.sys

16:35:20.0790 2000  srv - ok

16:35:20.0820 2000  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys

16:35:20.0890 2000  srv2 - ok

16:35:20.0940 2000  [ 0C4540311E11664B245A263E1154CEF8 ] SrvHsfHDA       C:\Windows\system32\DRIVERS\VSTAZL6.SYS

16:35:20.0990 2000  SrvHsfHDA - ok

16:35:21.0040 2000  [ 02071D207A9858FBE3A48CBFD59C4A04 ] SrvHsfV92       C:\Windows\system32\DRIVERS\VSTDPV6.SYS

16:35:21.0150 2000  SrvHsfV92 - ok

16:35:21.0200 2000  [ 18E40C245DBFAF36FD0134A7EF2DF396 ] SrvHsfWinac     C:\Windows\system32\DRIVERS\VSTCNXT6.SYS

16:35:21.0270 2000  SrvHsfWinac - ok

16:35:21.0300 2000  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys

16:35:21.0350 2000  srvnet - ok

16:35:21.0390 2000  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll

16:35:21.0510 2000  SSDPSRV - ok

16:35:21.0530 2000  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc         C:\Windows\system32\sstpsvc.dll

16:35:21.0650 2000  SstpSvc - ok

16:35:21.0700 2000  [ B4C983DA20E2970E21893BF0E4EE2AD8 ] ssudmdm         C:\Windows\system32\DRIVERS\ssudmdm.sys

16:35:21.0730 2000  ssudmdm - ok

16:35:21.0840 2000  [ 9528A9C0939156EAE5C1AC927287D808 ] STacSV          C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\STacSV64.exe

16:35:21.0890 2000  STacSV - ok

16:35:21.0920 2000  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys

16:35:21.0950 2000  stexstor - ok

16:35:21.0990 2000  [ 674A9977E356C4ECF184374FF96FACC4 ] STHDA           C:\Windows\system32\DRIVERS\stwrt64.sys

16:35:22.0070 2000  STHDA - ok

16:35:22.0120 2000  [ DECACB6921DED1A38642642685D77DAC ] StillCam        C:\Windows\system32\DRIVERS\serscan.sys

16:35:22.0180 2000  StillCam - ok

16:35:22.0220 2000  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll

16:35:22.0300 2000  stisvc - ok

16:35:22.0340 2000  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys

16:35:22.0370 2000  swenum - ok

16:35:22.0430 2000  [ E08E46FDD841B7184194011CA1955A0B ] swprv           C:\Windows\System32\swprv.dll

16:35:22.0570 2000  swprv - ok

16:35:22.0762 2000  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain         C:\Windows\system32\sysmain.dll

16:35:22.0892 2000  SysMain - ok

16:35:22.0922 2000  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll

16:35:22.0992 2000  TabletInputService - ok

16:35:23.0022 2000  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv         C:\Windows\System32\tapisrv.dll

16:35:23.0152 2000  TapiSrv - ok

16:35:23.0185 2000  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS             C:\Windows\System32\tbssvc.dll

16:35:23.0294 2000  TBS - ok

16:35:23.0384 2000  [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys

16:35:23.0514 2000  Tcpip - ok

16:35:23.0574 2000  [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys

16:35:23.0674 2000  TCPIP6 - ok

16:35:23.0724 2000  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys

16:35:23.0774 2000  tcpipreg - ok

16:35:23.0804 2000  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys

16:35:23.0844 2000  TDPIPE - ok

16:35:23.0874 2000  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys

16:35:23.0924 2000  TDTCP - ok

16:35:23.0974 2000  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys

16:35:24.0074 2000  tdx - ok

16:35:24.0114 2000  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys

16:35:24.0144 2000  TermDD - ok

16:35:24.0194 2000  [ 2E648163254233755035B46DD7B89123 ] TermService     C:\Windows\System32\termsrv.dll

16:35:24.0324 2000  TermService - ok

16:35:24.0344 2000  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll

16:35:24.0404 2000  Themes - ok

16:35:24.0434 2000  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER     C:\Windows\system32\mmcss.dll

16:35:24.0534 2000  THREADORDER - ok

16:35:24.0554 2000  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll

16:35:24.0674 2000  TrkWks - ok

16:35:24.0734 2000  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

16:35:24.0824 2000  TrustedInstaller - ok

16:35:24.0874 2000  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys

16:35:24.0984 2000  tssecsrv - ok

16:35:25.0054 2000  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys

16:35:25.0104 2000  TsUsbFlt - ok

16:35:25.0154 2000  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys

16:35:25.0244 2000  tunnel - ok

16:35:25.0274 2000  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys

16:35:25.0314 2000  uagp35 - ok

16:35:25.0354 2000  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys

16:35:25.0474 2000  udfs - ok

16:35:25.0524 2000  [ 52B42D0D13FD2DBEE4599E676B634FF6 ] UDM Service     C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe

16:35:25.0544 2000  UDM Service - ok

16:35:25.0574 2000  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect       C:\Windows\system32\UI0Detect.exe

16:35:25.0614 2000  UI0Detect - ok

16:35:25.0664 2000  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys

16:35:25.0704 2000  uliagpkx - ok

16:35:25.0764 2000  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus           C:\Windows\system32\drivers\umbus.sys

16:35:25.0814 2000  umbus - ok

16:35:25.0844 2000  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys

16:35:25.0874 2000  UmPass - ok

16:35:25.0904 2000  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll

16:35:26.0044 2000  upnphost - ok

16:35:26.0064 2000  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys

16:35:26.0114 2000  usbccgp - ok

16:35:26.0164 2000  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys

16:35:26.0224 2000  usbcir - ok

16:35:26.0244 2000  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys

16:35:26.0284 2000  usbehci - ok

16:35:26.0314 2000  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys

16:35:26.0374 2000  usbhub - ok

16:35:26.0394 2000  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci         C:\Windows\system32\drivers\usbohci.sys

16:35:26.0454 2000  usbohci - ok

16:35:26.0484 2000  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys

16:35:26.0554 2000  usbprint - ok

16:35:26.0584 2000  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS

16:35:26.0644 2000  USBSTOR - ok

16:35:26.0664 2000  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci         C:\Windows\system32\DRIVERS\usbuhci.sys

16:35:26.0714 2000  usbuhci - ok

16:35:26.0734 2000  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys

16:35:26.0804 2000  usbvideo - ok

16:35:26.0864 2000  [ 7B28E2FBE75115660FAB31079C0A9F29 ] usb_rndisx      C:\Windows\system32\drivers\usb8023x.sys

16:35:26.0904 2000  usb_rndisx - ok

16:35:26.0934 2000  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms           C:\Windows\System32\uxsms.dll

16:35:27.0054 2000  UxSms - ok

16:35:27.0064 2000  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe

16:35:27.0104 2000  VaultSvc - ok

16:35:27.0134 2000  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys

16:35:27.0164 2000  vdrvroot - ok

16:35:27.0214 2000  [ 8D6B481601D01A456E75C3210F1830BE ] vds             C:\Windows\System32\vds.exe

16:35:27.0344 2000  vds - ok

16:35:27.0404 2000  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys

16:35:27.0444 2000  vga - ok

16:35:27.0454 2000  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave         C:\Windows\System32\drivers\vga.sys

16:35:27.0554 2000  VgaSave - ok

16:35:27.0606 2000  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys

16:35:27.0646 2000  vhdmp - ok

16:35:27.0686 2000  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys

16:35:27.0726 2000  viaide - ok

16:35:27.0736 2000  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys

16:35:27.0776 2000  volmgr - ok

16:35:27.0816 2000  [ A255814907C89BE58B79EF2F189B843B ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys

16:35:27.0866 2000  volmgrx - ok

16:35:27.0896 2000  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap         C:\Windows\system32\drivers\volsnap.sys

16:35:27.0946 2000  volsnap - ok

16:35:28.0016 2000  [ 18507BDC6C15BD464DE9AB18B6AF1C23 ] vpnagent        C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

16:35:28.0056 2000  vpnagent - ok

16:35:28.0106 2000  [ BE7FE15AC90B9F02CBE011AE2426DD0F ] vpnva           C:\Windows\system32\DRIVERS\vpnva64.sys

16:35:28.0136 2000  vpnva - ok

16:35:28.0166 2000  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys

16:35:28.0206 2000  vsmraid - ok

16:35:28.0276 2000  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS             C:\Windows\system32\vssvc.exe

16:35:28.0476 2000  VSS - ok

16:35:28.0526 2000  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys

16:35:28.0576 2000  vwifibus - ok

16:35:28.0616 2000  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys

16:35:28.0676 2000  vwififlt - ok

16:35:28.0706 2000  [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys

16:35:28.0766 2000  vwifimp - ok

16:35:28.0806 2000  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time         C:\Windows\system32\w32time.dll

16:35:28.0936 2000  W32Time - ok

16:35:28.0956 2000  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys

16:35:29.0016 2000  WacomPen - ok

16:35:29.0066 2000  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys

16:35:29.0176 2000  WANARP - ok

16:35:29.0196 2000  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys

16:35:29.0296 2000  Wanarpv6 - ok

16:35:29.0366 2000  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe

16:35:29.0496 2000  WatAdminSvc - ok

16:35:29.0576 2000  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe

16:35:29.0726 2000  wbengine - ok

16:35:29.0746 2000  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll

16:35:29.0806 2000  WbioSrvc - ok

16:35:29.0856 2000  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc         C:\Windows\System32\wcncsvc.dll

16:35:29.0936 2000  wcncsvc - ok

16:35:29.0966 2000  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

16:35:30.0036 2000  WcsPlugInService - ok

16:35:30.0066 2000  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys

16:35:30.0096 2000  Wd - ok

16:35:30.0146 2000  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys

16:35:30.0236 2000  Wdf01000 - ok

16:35:30.0256 2000  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll

16:35:30.0366 2000  WdiServiceHost - ok

16:35:30.0376 2000  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost   C:\Windows\system32\wdi.dll

16:35:30.0448 2000  WdiSystemHost - ok

16:35:30.0498 2000  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient       C:\Windows\System32\webclnt.dll

16:35:30.0578 2000  WebClient - ok

16:35:30.0618 2000  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll

16:35:30.0748 2000  Wecsvc - ok

16:35:30.0768 2000  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport   C:\Windows\System32\wercplsupport.dll

16:35:30.0888 2000  wercplsupport - ok

16:35:30.0918 2000  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll

16:35:31.0018 2000  WerSvc - ok

16:35:31.0058 2000  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys

16:35:31.0168 2000  WfpLwf - ok

16:35:31.0178 2000  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys

16:35:31.0218 2000  WIMMount - ok

16:35:31.0249 2000  WinDefend - ok

16:35:31.0260 2000  WinHttpAutoProxySvc - ok

16:35:31.0310 2000  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll

16:35:31.0410 2000  Winmgmt - ok

16:35:31.0492 2000  [ BCB1310604AA415C4508708975B3931E ] WinRM           C:\Windows\system32\WsmSvc.dll

16:35:31.0722 2000  WinRM - ok

16:35:31.0792 2000  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys

16:35:31.0842 2000  WinUsb - ok

16:35:31.0882 2000  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc         C:\Windows\System32\wlansvc.dll

16:35:32.0002 2000  Wlansvc - ok

16:35:32.0042 2000  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys

16:35:32.0082 2000  WmiAcpi - ok

16:35:32.0112 2000  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe

16:35:32.0172 2000  wmiApSrv - ok

16:35:32.0202 2000  WMPNetworkSvc - ok

16:35:32.0222 2000  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll

16:35:32.0272 2000  WPCSvc - ok

16:35:32.0312 2000  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll

16:35:32.0362 2000  WPDBusEnum - ok

16:35:32.0392 2000  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys

16:35:32.0512 2000  ws2ifsl - ok

16:35:32.0544 2000  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll

16:35:32.0614 2000  wscsvc - ok

16:35:32.0624 2000  WSearch - ok

16:35:32.0664 2000  [ F7ADA10CF0F02435B1C9E5C6FD0EC3A4 ] wtsmpadap       C:\Windows\system32\DRIVERS\wtsmpadap.sys

16:35:32.0696 2000  wtsmpadap - ok

16:35:32.0716 2000  [ 4B604168F293A6AD8CE56B528E4DAD14 ] WtSmpFlt        C:\Windows\system32\DRIVERS\wtsmpflt.sys

16:35:32.0766 2000  WtSmpFlt - ok

16:35:32.0866 2000  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll

16:35:33.0048 2000  wuauserv - ok

16:35:33.0101 2000  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys

16:35:33.0170 2000  WudfPf - ok

16:35:33.0210 2000  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys

16:35:33.0260 2000  WUDFRd - ok

16:35:33.0320 2000  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll

16:35:33.0390 2000  wudfsvc - ok

16:35:33.0453 2000  [ FE90B750AB808FB9DD8FBB428B5FF83B ] WwanSvc         C:\Windows\System32\wwansvc.dll

16:35:33.0502 2000  WwanSvc - ok

16:35:33.0564 2000  [ B3EEACF62445E24FBB2CD4B0FB4DB026 ] yukonw7         C:\Windows\system32\DRIVERS\yk62x64.sys

16:35:33.0604 2000  yukonw7 - ok

16:35:33.0664 2000  ================ Scan global ===============================

16:35:33.0684 2000  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll

16:35:33.0724 2000  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll

16:35:33.0734 2000  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll

16:35:33.0764 2000  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll

16:35:33.0794 2000  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe

16:35:33.0804 2000  [Global] - ok

16:35:33.0804 2000  ================ Scan MBR ==================================

16:35:33.0814 2000  [ 71082E6CBC59BE6678A2777E9F50EA9D ] \Device\Harddisk0\DR0

16:35:34.0044 2000  \Device\Harddisk0\DR0 - ok

16:35:34.0044 2000  ================ Scan VBR ==================================

16:35:34.0054 2000  [ 3A5402FE95CDD36DCF11FDCA6DC5390B ] \Device\Harddisk0\DR0\Partition1

16:35:34.0054 2000  \Device\Harddisk0\DR0\Partition1 - ok

16:35:34.0074 2000  [ D105F586988F8AA989C5076B0DA7DF38 ] \Device\Harddisk0\DR0\Partition2

16:35:34.0084 2000  \Device\Harddisk0\DR0\Partition2 - ok

16:35:34.0114 2000  [ A4665F35D9EDC8FED61C9E6BD17E9170 ] \Device\Harddisk0\DR0\Partition3

16:35:34.0114 2000  \Device\Harddisk0\DR0\Partition3 - ok

16:35:34.0124 2000  [ B79403010F1FD6AF9819E94C690004BB ] \Device\Harddisk0\DR0\Partition4

16:35:34.0124 2000  \Device\Harddisk0\DR0\Partition4 - ok

16:35:34.0134 2000  ============================================================

16:35:34.0134 2000  Scan finished

16:35:34.0134 2000  ============================================================

16:35:34.0144 0476  Detected object count: 4

16:35:34.0144 0476  Actual detected object count: 4

16:35:52.0646 0476  Adobe LM Service ( UnsignedFile.Multi.Generic ) - skipped by user

16:35:52.0646 0476  Adobe LM Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:35:52.0646 0476  Adobe Version Cue CS2 ( UnsignedFile.Multi.Generic ) - skipped by user

16:35:52.0646 0476  Adobe Version Cue CS2 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:35:52.0646 0476  HP Health Check Service ( UnsignedFile.Multi.Generic ) - skipped by user

16:35:52.0646 0476  HP Health Check Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:35:52.0656 0476  LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user

16:35:52.0656 0476  LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:36:30.0689 5676  Deinitialize success

Hi,
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Code:

ComboFix 13-05-28.02 - roman 28.05.2013  18:33:09.1.2 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.41.1031.18.3999.2209 [GMT 2:00]

ausgeführt von:: c:\users\roman\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AV: Norton Internet Security *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

FW: Norton Internet Security *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Norton Internet Security *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\agiwoc.pad

c:\programdata\Codecv

c:\programdata\Codecv\background.html

c:\programdata\Codecv\content.js

c:\programdata\Codecv\kgjpgeghoihfjhcefchccfodloanbcgg.crx

c:\programdata\Codecv\settings.ini

c:\programdata\Codecv\uninstall.exe

c:\programdata\Local

c:\programdata\Local\Temp\WtUtilBlackBoard_EngineBBDashBoardV1_\10.bb

c:\programdata\Local\Temp\WtUtilBlackBoard_EngineBBDashBoardV1_\8.bb

c:\programdata\Local\Temp\WtUtilBlackBoard_EngineBBDashBoardV1_\9.bb

c:\programdata\rundll32.exe

c:\windows\SysWow64\muzapp.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-04-28 bis 2013-05-28  ))))))))))))))))))))))))))))))

.

.

2013-05-28 16:43 . 2013-05-28 16:43        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-05-28 16:43 . 2013-05-28 16:43        --------        d-----w-        c:\users\ADMINI~1\AppData\Local\temp

2013-05-28 16:28 . 2013-05-28 16:28        --------        d-----w-        c:\windows\E63D89610BA94CF39E94407ACA42846C.TMP

2013-05-28 14:56 . 2013-05-28 14:56        76232        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{8BEB67FE-C43D-4232-B417-D8D98FEF3FBF}\offreg.dll

2013-05-28 13:16 . 2013-05-28 14:00        --------        d-----w-        C:\_OTL

2013-05-27 20:15 . 2013-05-27 20:15        388096        ----a-r-        c:\users\roman\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2013-05-27 20:15 . 2013-05-27 20:15        --------        d-----w-        c:\program files (x86)\Trend Micro

2013-05-27 19:33 . 2013-05-27 19:33        --------        d-----w-        c:\program files\Enigma Software Group

2013-05-27 19:33 . 2013-05-27 19:33        --------        d-----w-        c:\program files (x86)\Common Files\Wise Installation Wizard

2013-05-27 19:04 . 2013-05-27 19:04        2633        ----a-w-        c:\programdata\agiwoc.js

2013-05-24 08:46 . 2013-05-13 06:37        9460464        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{8BEB67FE-C43D-4232-B417-D8D98FEF3FBF}\mpengine.dll

2013-05-23 16:45 . 2013-05-23 16:45        --------        d-----w-        c:\users\roman\AppData\Roaming\PerformerSoft

2013-05-23 16:45 . 2013-05-23 16:45        --------        d-----w-        c:\programdata\IBUpdaterService

2013-05-23 16:45 . 2012-12-19 13:53        19632        ----a-w-        c:\windows\system32\roboot64.exe

2013-05-23 16:45 . 2013-05-23 16:45        --------        d-----w-        c:\program files (x86)\PC Performer

2013-05-23 16:45 . 2013-05-23 16:53        --------        d-----w-        c:\users\roman\AppData\Roaming\PhotoScape

2013-05-23 16:45 . 2013-05-23 16:45        --------        d-----w-        c:\program files (x86)\PhotoScape

2013-05-14 21:53 . 2013-04-10 05:51        1111040        ----a-w-        c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll

2013-05-09 19:59 . 2013-05-09 19:59        83160        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2013-05-02 20:25 . 2013-05-02 20:34        --------        d-----w-        c:\users\roman\AppData\Roaming\Mp3tag

2013-05-02 20:24 . 2013-05-02 20:24        --------        d-----w-        c:\program files (x86)\Mp3tag

2013-04-30 17:05 . 2013-04-30 17:05        --------        d-----w-        c:\users\roman\AppData\Local\Programs

2013-04-30 12:34 . 2013-04-30 12:34        163504        ----a-w-        c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10144.bin

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-14 22:28 . 2010-03-29 14:44        75016696        ----a-w-        c:\windows\system32\MRT.exe

2013-05-14 21:49 . 2012-12-28 00:28        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-05-14 21:49 . 2011-07-24 22:02        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-05-02 00:06 . 2010-03-16 18:29        278800        ------w-        c:\windows\system32\MpSigStub.exe

2013-04-13 05:49 . 2013-05-14 21:54        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2013-04-13 05:49 . 2013-05-14 21:54        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

2013-04-13 05:49 . 2013-05-14 21:54        308736        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll

2013-04-13 05:49 . 2013-05-14 21:54        111104        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll

2013-04-13 04:45 . 2013-05-14 21:54        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll

2013-04-13 04:45 . 2013-05-14 21:54        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll

2013-04-12 14:45 . 2013-04-25 07:46        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys

2013-04-10 22:25 . 2013-04-10 22:25        28600        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2013-04-10 22:25 . 2013-04-10 22:25        130016        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2013-04-10 22:25 . 2013-04-10 22:25        100712        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2013-03-19 06:04 . 2013-04-10 22:24        5550424        ----a-w-        c:\windows\system32\ntoskrnl.exe

2013-03-19 05:46 . 2013-04-10 22:24        43520        ----a-w-        c:\windows\system32\csrsrv.dll

2013-03-19 05:04 . 2013-04-10 22:24        3968856        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2013-03-19 05:04 . 2013-04-10 22:24        3913560        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2013-03-19 04:47 . 2013-04-10 22:24        6656        ----a-w-        c:\windows\SysWow64\apisetschema.dll

2013-03-19 03:06 . 2013-04-10 22:24        112640        ----a-w-        c:\windows\system32\smss.exe

2013-03-07 12:51 . 2013-03-07 12:51        95648        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-03-07 12:51 . 2012-06-18 21:29        861088        ----a-w-        c:\windows\SysWow64\npdeployJava1.dll

2013-03-07 12:51 . 2010-05-25 17:38        782240        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2013-02-28 12:03 . 2013-03-13 16:44        1638912        ----a-w-        c:\windows\system32\mshtml.tlb

2013-02-28 11:38 . 2013-03-13 16:44        1638912        ----a-w-        c:\windows\SysWow64\mshtml.tlb

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-08-20 2363392]

"HP Officejet 6700 (NET)"="c:\program files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe" [2011-09-09 2676584]

"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2013-03-28 1511792]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"HPCam_Menu"="c:\program files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-08-20 322104]

"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2009-09-02 60464]

"WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-09-01 499768]

"NortonOnlineBackup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-08 1157976]

"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-08 1157976]

"Adobe Version Cue CS2"="c:\program files (x86)\DVD Maker\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-04-06 856064]

"Acrobat Assistant 7.0"="c:\program files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2012-06-07 522744]

"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-05-09 345312]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2013-03-28 310640]

"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2013-03-20 162856]

.

c:\users\roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk - c:\windows\system32\RunDll32.exe [2009-7-14 45568]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Acrobat - Schnellstart.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-100000000002}\SC_Acrobat.exe [2012-2-20 25214]

Adobe Gamma.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 1081632]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)

.

[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="userinit.exe"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

"AppInit_DLLs"=c:\progra~2\ZoomEx\sprotector.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 27136]

R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock64.sys [2012-06-07 107432]

R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-09-29 40448]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2013-02-22 102936]

R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-12-10 132608]

R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2009-12-10 116224]

R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]

R3 ONDAusbmdm6k;ONDA Proprietary USB Driver;c:\windows\system32\DRIVERS\ONDAusbmdm6k.sys [x]

R3 ONDAusbnet;ONDA USB-NDIS miniport;c:\windows\system32\DRIVERS\ONDAusbnet.sys [x]

R3 ONDAusbnmea;ONDA NMEA Port;c:\windows\system32\DRIVERS\ONDAusbnmea.sys [x]

R3 ONDAusbser6k;ONDA Diagnostic Port;c:\windows\system32\DRIVERS\ONDAusbser6k.sys [x]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-10-24 291328]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2013-02-22 203544]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-15 1255736]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-04-10 28600]

S1 DVMIO;DVMIO;c:\splash.sys\config\dvmio.sys [2009-09-27 21624]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\AESTSr64.exe [2009-03-02 89600]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2013-04-10 86752]

S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2009-07-08 30520]

S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\17.0.0.136\ccSvcHst.exe [2009-08-24 126392]

S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]

S2 SesamService;Sesam Control Service;c:\program files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe [2009-11-16 1414440]

S2 UDM Service;UDM Service;c:\program files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe [2009-12-10 128296]

S2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [2012-06-07 478712]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-09-17 35104]

S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]

S3 wtsmpadap;Sesam Virtual Adapter;c:\windows\system32\DRIVERS\wtsmpadap.sys [2009-07-20 56104]

S3 WtSmpFlt;Sesam Adapter;c:\windows\system32\DRIVERS\wtsmpflt.sys [2009-07-20 384808]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - 46007623

*Deregistered* - 46007623

.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

ezSharedSvc

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2009-08-20 12:24        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-04-11 13:15        1642448        ----a-w-        c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2013-05-28 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-28 21:49]

.

2013-05-28 c:\windows\Tasks\CodecUpdaterTask{A3BC3E92-28B6-42C0-93BD-0D1B5CF5C1C7}.job

- c:\programdata\Codec\Codec.exe [2012-08-31 10:57]

.

2013-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-11 14:09]

.

2013-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-11 14:09]

.

2013-05-24 c:\windows\Tasks\PC Performer_DEFAULT.job

- c:\program files (x86)\PC Performer\PCPerformer.exe [2013-05-23 13:53]

.

2013-05-23 c:\windows\Tasks\PC Performer_UPDATES.job

- c:\program files (x86)\PC Performer\PCPerformer.exe [2013-05-23 13:53]

.

2013-05-28 c:\windows\Tasks\ZoomExUpdaterTask{F23D1332-650C-41C4-A9AD-35612BEE4DA8}.job

- c:\programdata\Premium\ZoomEx\ZoomEx.exe [2012-12-26 09:39]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-19 165912]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-19 387608]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-19 365592]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-14 16405608]

"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-22 323584]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-09-21 487424]

"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-10-20 347648]

"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2009-08-25 610872]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-09 171520]

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://searchab.com/?aff=7&uid=10fce665-4fac-11e2-acef-00ade1ac1c1a

uLocal Page = c:\windows\system32\blank.htm

mStart Page = hxxp://searchab.com/?aff=7&uid=10fce665-4fac-11e2-acef-00ade1ac1c1a

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\program files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\program files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Auswahl in Adobe PDF konvertieren - c:\program files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\program files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Free YouTube Download - c:\users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to Mp3 Converter - c:\users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm

IE: In Adobe PDF konvertieren - c:\program files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: In vorhandene PDF-Datei konvertieren - c:\program files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\program files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\program files (x86)\DVD Maker\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

TCP: DhcpNameServer = 192.168.0.1

TCP: Interfaces\{C089350C-6EEE-4182-8057-A250ACEAF6AC}: NameServer = 195.186.1.111,195.186.4.162

FF - ProfilePath - c:\users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\

FF - prefs.js: browser.search.defaulturl - 

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.ch/

FF - prefs.js: keyword.URL - hxxp://searchab.com/?aff=7&uid=10fce665-4fac-11e2-acef-00ade1ac1c1a&q=

FF - prefs.js: network.proxy.type - 4

FF - user.js: extensions.BabylonToolbar.autoRvrt - false

FF - user.js: extensions.BabylonToolbar_i.newTab - false

FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=6429017300000000000000ade1ac1c1a&q=

FF - user.js: extensions.BabylonToolbar.id - 6429017300000000000000ade1ac1c1a

FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}

FF - user.js: extensions.BabylonToolbar.instlDay - 15583

FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.9.12

FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.9.12

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.9.1212:57

FF - user.js: extensions.BabylonToolbar.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar.tlbrId - base

FF - user.js: extensions.BabylonToolbar.instlRef - sst

FF - user.js: extensions.BabylonToolbar.dfltLng - en

FF - user.js: extensions.BabylonToolbar.excTlbr - false

FF - user.js: extensions.BabylonToolbar.admin - false

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112457&tt=3512_5

FF - user.js: extensions.BabylonToolbar_i.babExt - 

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKCU-Run-KiesAirMessage - c:\program files (x86)\Samsung\Kies\KiesAirMessage.exe

Wow6432Node-HKLM-Run-Dashboard - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe

AddRemove-PokerStars.eu - c:\program files (x86)\PokerStars.EU\PokerStarsUninstall.exe

AddRemove-{2EF17083-57D4-4D64-AE4F-55F32A2C4571} - c:\programdata\Codecv\uninstall.exe

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]

"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\17.0.0.136\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\17.0.0.136\diMaster.dll\" /prefetch:1"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-05-28  18:47:56

ComboFix-quarantined-files.txt  2013-05-28 16:47

.

Vor Suchlauf: 10 Verzeichnis(se), 185'096'867'840 Bytes frei

Nach Suchlauf: 22 Verzeichnis(se), 185'470'275'584 Bytes frei

.

- - End Of File - - 42D6FC9882E5364D09C0CC2A4DF50912

Hi,
malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.05.28.06
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 8.0.7601.17514

roman :: PC-ROMAN [Administrator]
 

28.05.2013 19:46:32

mbam-log-2013-05-28 (19-46-32).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 461603

Laufzeit: 1 Stunde(n), 24 Minute(n), 35 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Codec (Trojan.Dropper) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 1

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (Hijack.StartPage) -> Bösartig: (hxxp://searchab.com/?aff=7&uid=10fce665-4fac-11e2-acef-00ade1ac1c1a) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.
 

Infizierte Verzeichnisse: 1

C:\ProgramData\IBUpdaterService (PUP.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateien: 6

C:\ProgramData\Codec\Codec.exe (Trojan.Dropper) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\Premium\ZoomEx\ZoomEx.exe (Trojan.Startpage) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\roman\Desktop\bundleSetup.exe (PUP.BundleInstaller.IB) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\_OTL\MovedFiles.zip (Trojan.FakeMS) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\_OTL\MovedFiles\05282013_151602\C_ProgramData\cowiga.dat (Trojan.FakeMS) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\IBUpdaterService\repository.xml (PUP.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Hi,

lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Adobe AIR Adobe Systems Inc. 09.12.2009 1.5.0.7220 unbekannt
Adobe Creative Suite 2 20.02.2012 unbekannt
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 20.03.2010 10.0.45.2 notwendig
Adobe Flash Player 11 Plugin Adobe Systems Incorporated 14.05.2013 6.00MB 11.7.700.202 notwendig
Adobe Reader X (10.1.6) - Deutsch Adobe Systems Incorporated 04.03.2013 121MB 10.1.6 notwendig
Adobe SVG Viewer 3.0 Adobe Systems, Inc. 20.02.2012 3.0 unbekannt
Alcor Micro USB Card Reader Alcor Micro Corp. 04.01.2010 2.86MB 1.6.17.05187 unbekannt
Alps Touch Pad Driver ALPS ELECTRIC CO., LTD. 04.01.2010 unbekannt
Atheros Driver Installation Program Atheros 04.01.2010 5.0 unbekannt
Avira Free Antivirus Avira 09.05.2013 129MB 13.0.0.3640 notwendig
Brother MFL-Pro Suite MFC-J6510DW Brother Industries, Ltd. 08.05.2011 1.0.20.0 notwendig
CCleaner Piriform 24.05.2013 4.02 unbekannt
Cisco AnyConnect Secure Mobility Client Cisco Systems, Inc. 31.10.2012 3.0.08057 notwendig
Codecv Codecv 05.08.2012 unbekannt
Compatibility Pack für 2007 Office System Microsoft Corporation 01.02.2013 232MB 12.0.6612.1000 unbekannt
CyberLink DVD Suite CyberLink Corp. 09.12.2009 37.3MB 7.0.2216 unbekannt
Dropbox Dropbox, Inc. 23.03.2013 1.6.18 unnötig
DVD Menu Pack for HP MediaSmart Video Hewlett-Packard 04.01.2010 100MB 3.1.3224 notwendig
Free Audio CD Burner version 1.4 DVDVideoSoft Limited. 05.09.2010 8.08MB unbekannt
Free YouTube Download version 2.10.28 DVDVideoSoft Limited. 30.11.2010 28.2MB notwendig
Free YouTube to MP3 Converter version 3.8 DVDVideoSoft Limited. 05.09.2010 32.0MB notwendig
Google Chrome Google Inc. 11.03.2013 27.0.1453.94 unnötig
GPL Ghostscript Artifex Software Inc. 14.11.2011 9.04 unbekannt
HiJackThis Trend Micro 27.05.2013 369KB 1.0.0 unnötig
HP 3D DriveGuard Hewlett-Packard 04.01.2010 3.27MB 4.0.3.1 notwendig
HP Advisor Hewlett-Packard 09.12.2009 50.0MB 3.3.9512.3162 notwendig
HP Games WildTangent 04.01.2010 1.0.0.71 notwendig
HP Integrated Module with Bluetooth wireless technology Broadcom Corporation 04.01.2010 144MB 6.2.1.500 notwendig
HP MediaSmart DVD Hewlett-Packard 04.01.2010 96.8MB 3.1.3416 notwendig
HP MediaSmart Internet TV Hewlett-Packard 04.01.2010 40.6MB 3.1.2125 notwendig
HP MediaSmart Music/Photo/Video Hewlett-Packard 04.01.2010 314MB 3.1.3405 notwendig
HP MediaSmart SmartMenu Hewlett-Packard 04.01.2010 1.95MB 3.1.0.1 notwendig
HP MediaSmart Webcam Hewlett-Packard 04.01.2010 120MB 3.1.2207 notwendig
HP Officejet 6700 - Grundlegende Software für das Gerät Hewlett-Packard Co. 08.12.2012 180MB 25.0.619.0 notwendig
HP Officejet 6700 Hilfe Hewlett Packard 08.12.2012 18.4MB 140.0.2.2 notwendig
HP Quick Launch Buttons Hewlett-Packard 08.12.2009 6.50.7.1 notwendig
HP QuickWeb DeviceVM, Inc. 04.01.2010 372MB 1.1.2.2 notwendig
HP Setup Hewlett-Packard 08.12.2009 1.2.3560.3170 notwendig
HP Support Assistant Hewlett-Packard 04.01.2010 34.6MB 4.2.6.13 notwendig
HP Update Hewlett-Packard 08.12.2012 3.98MB 5.003.000.004 notwendig
HP User Guides 0174 Hewlett-Packard 09.12.2009 112MB 1.02.0000 notwendig
HP Wireless Assistant Hewlett-Packard 09.12.2009 4.01MB 3.50.10.1 notwendig
I.R.I.S. OCR HP 08.12.2012 68.9MB 12.3.4.0 unbekannt
IDT Audio IDT 04.01.2010 1.0.6242.0 unbekannt
Intel® Matrix Storage Manager Intel Corporation 04.01.2010 notwendig
Java 7 Update 17 Oracle 07.03.2013 129MB 7.0.170 unbekannt
Java 7 Update 7 (64-bit) Oracle 25.09.2012 127MB 7.0.70 unbekannt
Java SE Development Kit 7 Update 7 (64-bit) Oracle 25.09.2012 188MB 1.7.0.70 unbekannt
Java(TM) 6 Update 15 (64-bit) Sun Microsystems, Inc. 09.12.2009 90.8MB 6.0.150 unbekannt
Java(TM) 6 Update 17 Sun Microsystems, Inc. 27.03.2010 94.9MB 6.0.170 unbekannt
Java(TM) SE Development Kit 6 Update 15 (64-bit) Sun Microsystems, Inc. 09.12.2009 141MB 1.6.0.150 unbekannt
KESO-K4V3.2.A 25.04.2011 unbekannt
LabelPrint CyberLink Corp. 09.12.2009 280MB 2.5.2215 unbekannt
LightScribe System Software LightScribe 04.01.2010 23.9MB 1.18.8.1 unbekannt
Magic Desktop EasyBits Software AS 04.01.2010 unbekannt
Malwarebytes Anti-Malware Version 1.75.0.1300 Malwarebytes Corporation 28.05.2013 19.2MB 1.75.0.1300 unbekannt
MATLAB R2012a The MathWorks, Inc. 31.10.2012 7.14 notwendig
MediaMonkey 4.0 Ventis Media Inc. 28.02.2013 51.3MB 4.0 notwendig
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 08.04.2013 38.8MB 4.0.30320 unbekannt
Microsoft Office Enterprise 2007 Microsoft Corporation 22.02.2012 12.0.6612.1000 notwendig
Microsoft Office File Validation Add-In Microsoft Corporation 10.12.2011 7.95MB 14.0.5130.5003 notwendig
Microsoft Office Outlook Connector Microsoft Corporation 12.02.2012 3.38MB 14.0.6106.5001 notwendig
Microsoft Office PowerPoint Viewer 2007 (German) Microsoft Corporation 01.02.2013 48.5MB 12.0.6612.1000 notwendig
Microsoft Office Suite Activation Assistant Microsoft Corporation 08.12.2009 8.36MB 2.9 notwendig
Microsoft Silverlight Microsoft Corporation 13.03.2013 100MB 5.1.20125.0 notwendig
Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 10.03.2010 1.72MB 3.1.0000 notwendig
Microsoft Sync Framework Runtime Native v1.0 (x86) Microsoft Corporation 10.03.2010 625KB 1.0.1215.0
Microsoft Sync Framework Services Native v1.0 (x86) Microsoft Corporation 04.09.2010 1.44MB 1.0.1215.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 05.09.2010 250KB 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 18.06.2011 300KB 8.0.61001
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 31.10.2012 572KB 8.0.61000
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 Microsoft Corporation 17.05.2011 790KB 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Corporation 17.05.2011 598KB 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 10.06.2011 252KB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 04.01.2010 788KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 18.06.2011 788KB 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 04.01.2010 596KB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 04.01.2010 596KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 18.06.2011 600KB 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 04.09.2012 15.0MB 10.0.40219
Microsoft Works Microsoft Corporation 11.10.2012 1.01GB 9.7.0621
Movie Theme Pack for HP MediaSmart Video Hewlett-Packard 04.01.2010 332MB 3.1.3310 notwendig
Mozilla Firefox 21.0 (x86 de) Mozilla 23.05.2013 45.1MB 21.0 notwendig
Mozilla Maintenance Service Mozilla 23.05.2013 333KB 21.0 unbekannt
Mp3tag v2.55a Florian Heidenreich 02.05.2013 v2.55a notwendig
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 17.03.2010 1.27MB 4.20.9870.0 unbekannt
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 17.03.2010 1.33MB 4.20.9876.0
MyFreeCodec 08.04.2013 unbekannt
Norton Internet Security Symantec Corporation 04.01.2010 17.0.0.136 unbekannt
Norton Online Backup Symantec Corporation 11.06.2010 9.07MB 2.1.18320 unbekannt
NVIDIA Drivers NVIDIA Corporation 04.01.2010 1.10 notwendig
PC Performer PerformerSoft LLC 23.05.2013 11.8MB 11.10 unbekannt
PDF24 Creator 5.4.0 PDF24.org 30.04.2013 40.3MB notwendig
PhotoScape 23.05.2013 unbekannt
PokerStars PokerStars 07.01.2013 unnötig
PokerStars.eu PokerStars.eu 07.01.2013 unnötig
Power2Go CyberLink Corp. 09.12.2009 199MB 6.0.3415 unbekannt
PowerDirector CyberLink Corp. 09.12.2009 547MB 7.0.3420 unbekannt
Realtek Ethernet Controller Driver For Windows Vista and Later Realtek 04.01.2010 1.00.0011 unbekannt
RedMon - Redirection Port Monitor 14.11.2011 unbekannt
Samsung Kies Samsung Electronics Co., Ltd. 08.04.2013 158MB 2.5.2.13021_10 unnötig
SAMSUNG USB Driver for Mobile Phones SAMSUNG Electronics Co., Ltd. 08.04.2013 34.9MB 1.5.22.0 notwendig
SopCast 3.2.8 www.sopcast.com 23.03.2010 3.2.8 unnötig
TeamSpeak 3 Client TeamSpeak Systems GmbH 10.06.2011 unnötig
Torrent Stream 2.0.3 Torrent Stream 01.12.2012 2.0.3 unnötig
Uninstall 1.0.0.1 17.10.2010 10.5MB unbekannt
Unlimited Data Manager 9.1.0 Swisscom 01.07.2011 56.5MB 9.1.17491.0 unnötig
VLC media player 1.0.1 VideoLAN Team 30.08.2012 1.0.1 unnötig
Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000) Broadcom 04.01.2010 06/15/2009 6.2.0.9000 unbekannt
Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) Broadcom 04.01.2010 07/30/2009 6.2.0.9405 unbekannt
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) Broadcom 04.01.2010 07/28/2009 6.2.0.9800
Windows Live Anmelde-Assistent Microsoft Corporation 10.03.2010 1.93MB 5.000.818.5
Windows Live Essentials Microsoft Corporation 04.09.2010 14.0.8117.0416
Windows Live Sync Microsoft Corporation 04.09.2010 2.79MB 14.0.8117.416
Windows Live-Uploadtool Microsoft Corporation 10.03.2010 224KB 14.0.8014.1029
Windows Media Player Firefox Plugin Microsoft Corp 12.06.2010 296KB 1.0.0.8 notwendig
Windows Movie Maker 2.6 Microsoft Corporation 09.12.2010 8.85MB 2.6.4037.0
WinRAR 4.20 (32-Bit) win.rar GmbH 23.10.2012 4.20.0 notwendig
ZoomEx 26.12.2011 1.0 unbekannt
µTorrent BitTorrent Inc. 04.03.2013 3.3.0.29126 notwendig

bDeinstaliere:
Adobe Creative
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden, instalieren.
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen
bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
Sicherheit (erweitert)
Erweiterte Sicherheit anhaken
und alle Dateien auswählen.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
CyberLink
Dropbox
Free Audio
Google
HiJackThis
Java : alle
downloade Java jre:
Java-Downloads für alle Betriebssysteme
klicke:
Download der Java-Software für Windows Offline
laden, und instalieren
deinstaliere:

Norton : alle
PC Performer
PhotoScape
PokerStars: beide
Power2Go
PowerDirector
SopCast
TeamSpeak
Torrent Stream
Unlimited
VLC
Windows Live : alle für dich unnötigen
ZoomEx

Öffne CCleaner, analysieren, starten, PC neustarten.
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Code:

# AdwCleaner v2.301 - Datei am 28/05/2013 um 22:51:25 erstellt

# Aktualisiert am 16/05/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : roman - PC-ROMAN

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\roman\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml

Datei Gelöscht : C:\user.js

Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB

Ordner Gelöscht : C:\ProgramData\Babylon

Ordner Gelöscht : C:\ProgramData\InstallMate

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Codecv

Ordner Gelöscht : C:\ProgramData\Premium

Ordner Gelöscht : C:\Users\roman\AppData\Roaming\Babylon

Ordner Gelöscht : C:\Users\roman\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\Conduit

Ordner Gelöscht : C:\Users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\ConduitEngine

Ordner Gelöscht : C:\Users\roman\AppData\Roaming\PerformerSoft
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\AppDataLow\SProtector

Schlüssel Gelöscht : HKCU\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\PrivitizeVPNInstallDates

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\StartSearch

Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Schlüssel Gelöscht : HKLM\Software\Babylon

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap

Schlüssel Gelöscht : HKLM\Software\DeviceVM

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winrar_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winrar_RASMANCS

Schlüssel Gelöscht : HKLM\Software\SP Global

Schlüssel Gelöscht : HKLM\Software\SProtector

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2EF17083-57D4-4D64-AE4F-55F32A2C4571}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v8.0.7601.17514
 

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://searchab.com/?aff=7&uid=10fce665-4fac-11e2-acef-00ade1ac1c1a --> hxxp://www.google.com

Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affID=112457&tt=3512_5&babsrc=NT_ss&mntrId=6429017300000000000000ade1ac1c1a --> hxxp://www.google.com
 

-\\ Mozilla Firefox v21.0 (de)
 

Datei : C:\Users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\prefs.js
 

C:\Users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\user.js ... Gelöscht !
 

Gelöscht : user_pref("CT2269050.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Gelöscht : user_pref("CT2269050.CTID", "CT2269050");

Gelöscht : user_pref("CT2269050.CurrentServerDate", "5-9-2010");

Gelöscht : user_pref("CT2269050.DialogsAlignMode", "LTR");

Gelöscht : user_pref("CT2269050.DownloadReferralCookieData", "");

Gelöscht : user_pref("CT2269050.EMailNotifierPollDate", "Sun Sep 05 2010 13:11:37 GMT+0200");

Gelöscht : user_pref("CT2269050.FirstServerDate", "5-9-2010");

Gelöscht : user_pref("CT2269050.FirstTime", true);

Gelöscht : user_pref("CT2269050.FirstTimeFF3", true);

Gelöscht : user_pref("CT2269050.FirstTimeSettingsDone", true);

Gelöscht : user_pref("CT2269050.FixPageNotFoundErrors", true);

Gelöscht : user_pref("CT2269050.GroupingServerCheckInterval", 1440);

Gelöscht : user_pref("CT2269050.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Gelöscht : user_pref("CT2269050.Initialize", true);

Gelöscht : user_pref("CT2269050.InitializeCommonPrefs", true);

Gelöscht : user_pref("CT2269050.InstallationAndCookieDataSentCount", 1);

Gelöscht : user_pref("CT2269050.InstallationType", "UnknownIntegration");

Gelöscht : user_pref("CT2269050.InstalledDate", "Sun Sep 05 2010 13:11:37 GMT+0200");

Gelöscht : user_pref("CT2269050.InvalidateCache", false);

Gelöscht : user_pref("CT2269050.IsGrouping", false);

Gelöscht : user_pref("CT2269050.IsOpenThankYouPage", false);

Gelöscht : user_pref("CT2269050.IsOpenUninstallPage", false);

Gelöscht : user_pref("CT2269050.LanguagePackLastCheckTime", "Sun Sep 05 2010 13:11:40 GMT+0200");

Gelöscht : user_pref("CT2269050.LanguagePackReloadIntervalMM", 1440);

Gelöscht : user_pref("CT2269050.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]

Gelöscht : user_pref("CT2269050.LastLogin_2.7.2.0", "Sun Sep 05 2010 13:11:38 GMT+0200");

Gelöscht : user_pref("CT2269050.LatestVersion", "2.7.2.0");

Gelöscht : user_pref("CT2269050.Locale", "en");

Gelöscht : user_pref("CT2269050.LoginCache", 4);

Gelöscht : user_pref("CT2269050.MCDetectTooltipHeight", "83");

Gelöscht : user_pref("CT2269050.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

Gelöscht : user_pref("CT2269050.MCDetectTooltipWidth", "295");

Gelöscht : user_pref("CT2269050.RadioIsPodcast", false);

Gelöscht : user_pref("CT2269050.RadioLastCheckTime", "Sun Sep 05 2010 13:11:38 GMT+0200");

Gelöscht : user_pref("CT2269050.RadioLastUpdateIPServer", "3");

Gelöscht : user_pref("CT2269050.RadioLastUpdateServer", "129132338014870000");

Gelöscht : user_pref("CT2269050.RadioMediaID", "12473383");

Gelöscht : user_pref("CT2269050.RadioMediaType", "Media Player");

Gelöscht : user_pref("CT2269050.RadioMenuSelectedID", "EBRadioMenu_CT226905012473383");

Gelöscht : user_pref("CT2269050.RadioStationName", "Hotmix%20108");

Gelöscht : user_pref("CT2269050.RadioStationURL", "hxxp://67.202.67.18:8082");

Gelöscht : user_pref("CT2269050.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]

Gelöscht : user_pref("CT2269050.SearchFromAddressBarIsInit", true);

Gelöscht : user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT226[...]

Gelöscht : user_pref("CT2269050.SearchInNewTabEnabled", true);

Gelöscht : user_pref("CT2269050.SearchInNewTabIntervalMM", 1440);

Gelöscht : user_pref("CT2269050.SearchInNewTabLastCheckTime", "Sun Sep 05 2010 13:11:38 GMT+0200");

Gelöscht : user_pref("CT2269050.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]

Gelöscht : user_pref("CT2269050.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]

Gelöscht : user_pref("CT2269050.SettingsCheckIntervalMin", 120);

Gelöscht : user_pref("CT2269050.SettingsLastCheckTime", "Sun Sep 05 2010 13:11:36 GMT+0200");

Gelöscht : user_pref("CT2269050.SettingsLastUpdate", "1283351305");

Gelöscht : user_pref("CT2269050.ThirdPartyComponentsInterval", 504);

Gelöscht : user_pref("CT2269050.ThirdPartyComponentsLastCheck", "Sun Sep 05 2010 13:11:36 GMT+0200");

Gelöscht : user_pref("CT2269050.ThirdPartyComponentsLastUpdate", "1246790578");

Gelöscht : user_pref("CT2269050.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=[...]

Gelöscht : user_pref("CT2269050.UserID", "UN55427277122618779");

Gelöscht : user_pref("CT2269050.WeatherNetwork", "");

Gelöscht : user_pref("CT2269050.WeatherPollDate", "Sun Sep 05 2010 13:11:38 GMT+0200");

Gelöscht : user_pref("CT2269050.WeatherUnit", "C");

Gelöscht : user_pref("CT2269050.alertChannelId", "666138");

Gelöscht : user_pref("CT2269050.clientLogIsEnabled", true);

Gelöscht : user_pref("CT2269050.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]

Gelöscht : user_pref("CT2269050.myStuffEnabled", true);

Gelöscht : user_pref("CT2269050.myStuffPublihserMinWidth", 400);

Gelöscht : user_pref("CT2269050.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]

Gelöscht : user_pref("CT2269050.myStuffServiceIntervalMM", 1440);

Gelöscht : user_pref("CT2269050.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]

Gelöscht : user_pref("CT2269050.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]

Gelöscht : user_pref("CT2447621..clientLogIsEnabled", false);

Gelöscht : user_pref("CT2447621..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]

Gelöscht : user_pref("CT2447621..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]

Gelöscht : user_pref("CT2447621.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Gelöscht : user_pref("CT2447621.CTID", "CT2447621");

Gelöscht : user_pref("CT2447621.CurrentServerDate", "27-11-2010");

Gelöscht : user_pref("CT2447621.DialogsAlignMode", "LTR");

Gelöscht : user_pref("CT2447621.DownloadReferralCookieData", "{\"BannerName\":\"\",\"BannerTypeId\":\"\",\"Bann[...]

Gelöscht : user_pref("CT2447621.EnableClickToSearchBox", false);

Gelöscht : user_pref("CT2447621.EnableSearchHistory", false);

Gelöscht : user_pref("CT2447621.EnableSearchSuggest", false);

Gelöscht : user_pref("CT2447621.ExternalComponentPollDate129200355872125476", "Sat Nov 27 2010 12:30:14 GMT+010[...]

Gelöscht : user_pref("CT2447621.FirstServerDate", "27-11-2010");

Gelöscht : user_pref("CT2447621.FirstTime", true);

Gelöscht : user_pref("CT2447621.FirstTimeFF3", true);

Gelöscht : user_pref("CT2447621.FixPageNotFoundErrors", false);

Gelöscht : user_pref("CT2447621.GroupingServerCheckInterval", 1440);

Gelöscht : user_pref("CT2447621.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Gelöscht : user_pref("CT2447621.HasUserGlobalKeys", true);

Gelöscht : user_pref("CT2447621.Initialize", true);

Gelöscht : user_pref("CT2447621.InitializeCommonPrefs", true);

Gelöscht : user_pref("CT2447621.InstallationAndCookieDataSentCount", 1);

Gelöscht : user_pref("CT2447621.InstalledDate", "Sat Nov 27 2010 12:30:16 GMT+0100");

Gelöscht : user_pref("CT2447621.InvalidateCache", false);

Gelöscht : user_pref("CT2447621.IsGrouping", false);

Gelöscht : user_pref("CT2447621.IsMulticommunity", false);

Gelöscht : user_pref("CT2447621.IsOpenThankYouPage", true);

Gelöscht : user_pref("CT2447621.IsOpenUninstallPage", true);

Gelöscht : user_pref("CT2447621.LanguagePackLastCheckTime", "Sat Nov 27 2010 12:30:16 GMT+0100");

Gelöscht : user_pref("CT2447621.LanguagePackReloadIntervalMM", 1440);

Gelöscht : user_pref("CT2447621.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]

Gelöscht : user_pref("CT2447621.LastLogin_3.2.5.2", "Sat Nov 27 2010 12:30:14 GMT+0100");

Gelöscht : user_pref("CT2447621.LatestVersion", "2.7.2.0");

Gelöscht : user_pref("CT2447621.Locale", "en");

Gelöscht : user_pref("CT2447621.MCDetectTooltipHeight", "83");

Gelöscht : user_pref("CT2447621.MCDetectTooltipShow", false);

Gelöscht : user_pref("CT2447621.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

Gelöscht : user_pref("CT2447621.MCDetectTooltipWidth", "295");

Gelöscht : user_pref("CT2447621.RadioIsPodcast", false);

Gelöscht : user_pref("CT2447621.RadioLastCheckTime", "Sat Nov 27 2010 12:30:15 GMT+0100");

Gelöscht : user_pref("CT2447621.RadioLastUpdateIPServer", "3");

Gelöscht : user_pref("CT2447621.RadioLastUpdateServer", "3");

Gelöscht : user_pref("CT2447621.RadioMediaID", "9962");

Gelöscht : user_pref("CT2447621.RadioMediaType", "Media Player");

Gelöscht : user_pref("CT2447621.RadioMenuSelectedID", "EBRadioMenu_CT24476219962");

Gelöscht : user_pref("CT2447621.RadioStationName", "California%20Rock");

Gelöscht : user_pref("CT2447621.RadioStationURL", "hxxp://feedlive.net/california.asx");

Gelöscht : user_pref("CT2447621.SearchBackToDefaultEngine", false);

Gelöscht : user_pref("CT2447621.SearchFromAddressBarIsInit", true);

Gelöscht : user_pref("CT2447621.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT244[...]

Gelöscht : user_pref("CT2447621.SearchInNewTabEnabled", true);

Gelöscht : user_pref("CT2447621.SearchInNewTabIntervalMM", 1440);

Gelöscht : user_pref("CT2447621.SearchInNewTabLastCheckTime", "Sat Nov 27 2010 12:30:14 GMT+0100");

Gelöscht : user_pref("CT2447621.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]

Gelöscht : user_pref("CT2447621.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]

Gelöscht : user_pref("CT2447621.SearchInNewTabUserEnabled", false);

Gelöscht : user_pref("CT2447621.ServiceMapLastCheckTime", "Sat Nov 27 2010 12:30:13 GMT+0100");

Gelöscht : user_pref("CT2447621.SettingsLastCheckTime", "Sat Nov 27 2010 12:30:13 GMT+0100");

Gelöscht : user_pref("CT2447621.SettingsLastUpdate", "1290433062");

Gelöscht : user_pref("CT2447621.ThirdPartyComponentsInterval", 504);

Gelöscht : user_pref("CT2447621.ThirdPartyComponentsLastCheck", "Sat Nov 27 2010 12:30:13 GMT+0100");

Gelöscht : user_pref("CT2447621.ThirdPartyComponentsLastUpdate", "1246790578");

Gelöscht : user_pref("CT2447621.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=[...]

Gelöscht : user_pref("CT2447621.Uninstall", true);

Gelöscht : user_pref("CT2447621.UserID", "UN68992150358601423");

Gelöscht : user_pref("CT2447621.alertChannelId", "841606");

Gelöscht : user_pref("CT2447621.backendstorage.ct2447621ads1", "25374225323261647325323225334125354225374225323[...]

Gelöscht : user_pref("CT2447621.backendstorage.ct2447621current_term", "");

Gelöscht : user_pref("CT2447621.backendstorage.ct2447621sdate", "3237");

Gelöscht : user_pref("CT2447621.backendstorage.login.ok", "6F6B");

Gelöscht : user_pref("CT2447621.components.1000034", false);

Gelöscht : user_pref("CT2447621.components.1000082", false);

Gelöscht : user_pref("CT2447621.components.1000234", false);

Gelöscht : user_pref("CT2447621.components.129027576638012981", false);

Gelöscht : user_pref("CT2447621.components.129027576638481740", false);

Gelöscht : user_pref("CT2447621.components.129027576638794244", false);

Gelöscht : user_pref("CT2447621.components.129027576640513035", false);

Gelöscht : user_pref("CT2447621.components.129200355678375087", false);

Gelöscht : user_pref("CT2447621.components.129200355872125476", false);

Gelöscht : user_pref("CT2447621.components.129232331043397092", false);

Gelöscht : user_pref("CT2447621.components.129236719290638100", false);

Gelöscht : user_pref("CT2447621.components.4041894590456757234", false);

Gelöscht : user_pref("CT2447621.components.6620200540305086611", false);

Gelöscht : user_pref("CT2447621.components.9067988466807343128", false);

Gelöscht : user_pref("CT2447621.components.9200832915754370385", false);

Gelöscht : user_pref("CT2447621.myStuffEnabled", true);

Gelöscht : user_pref("CT2447621.myStuffPublihserMinWidth", 400);

Gelöscht : user_pref("CT2447621.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]

Gelöscht : user_pref("CT2447621.myStuffServiceIntervalMM", 1440);

Gelöscht : user_pref("CT2447621.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]

Gelöscht : user_pref("CT2447621.testingCtid", "");

Gelöscht : user_pref("CT2447621.toolbarAppMetaDataLastCheckTime", "Sat Nov 27 2010 12:30:14 GMT+0100");

Gelöscht : user_pref("CT2447621.toolbarContextMenuLastCheckTime", "Sat Nov 27 2010 12:30:15 GMT+0100");

Gelöscht : user_pref("CT2447621.usageEnabled", false);

Gelöscht : user_pref("CT2447621.usagesFlag", 2);

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/?aid=666138&fid=661999", "\"1-16[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/666138/661999/CH", "\"0\"")[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/666138/661999/DEFAULT", "\"[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/841606/837409/CH", "\"0\"")[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/841606/837409/DEFAULT", "\"[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/CH", "\"0\"")[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DEFAULT", "\"[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2447621", [...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"63425009534667[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2447621&octid=[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/StarFleet/equalize[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/StarFleet/minimize[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/StarFleet/play.gif[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/StarFleet/stop.gif[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/StarFleet/vol.gif"[...]

Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"634[...]

Gelöscht : user_pref("CommunityToolbar.EngineOwner", "ConduitEngine");

Gelöscht : user_pref("CommunityToolbar.EngineOwnerGuid", "engine@conduit.com");

Gelöscht : user_pref("CommunityToolbar.EngineOwnerToolbarId", "conduitengine");

Gelöscht : user_pref("CommunityToolbar.IsEngineShown", true);

Gelöscht : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);

Gelöscht : user_pref("CommunityToolbar.OriginalEngineOwner", "CT2447621");

Gelöscht : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{ef468e5b-5b30-4136-a833-7f2e3a31afdf}");

Gelöscht : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "2shared");

Gelöscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]

Gelöscht : user_pref("CommunityToolbar.ToolbarsList", "CT2269050,ConduitEngine,CT2447621");

Gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT2269050,CT2447621");

Gelöscht : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Mon Apr 18 2011 21:10:33 GMT+02[...]

Gelöscht : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);

Gelöscht : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Fri Jul 08 2011 18:45:08 GMT+0200");

Gelöscht : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");

Gelöscht : user_pref("CommunityToolbar.alert.firstTimeAlertShown", true);

Gelöscht : user_pref("CommunityToolbar.alert.locale", "en");

Gelöscht : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);

Gelöscht : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Fri Jul 08 2011 18:45:00 GMT+0200");

Gelöscht : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");

Gelöscht : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);

Gelöscht : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");

Gelöscht : user_pref("CommunityToolbar.alert.showTrayIcon", false);

Gelöscht : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);

Gelöscht : user_pref("CommunityToolbar.alert.userId", "{f24529c4-ba11-4b55-9e76-cf87662d154f}");

Gelöscht : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sat Nov 27 2010 12:30:14 GMT+0100");

Gelöscht : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

Gelöscht : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

Gelöscht : user_pref("ConduitEngine.FirstServerDate", "11/27/2010 13");

Gelöscht : user_pref("ConduitEngine.FirstTime", true);

Gelöscht : user_pref("ConduitEngine.FirstTimeFF3", true);

Gelöscht : user_pref("ConduitEngine.HasUserGlobalKeys", true);

Gelöscht : user_pref("ConduitEngine.HideEngineAfterRestart", false);

Gelöscht : user_pref("ConduitEngine.Initialize", true);

Gelöscht : user_pref("ConduitEngine.InitializeCommonPrefs", true);

Gelöscht : user_pref("ConduitEngine.InstalledDate", "Sat Nov 27 2010 12:30:14 GMT+0100");

Gelöscht : user_pref("ConduitEngine.IsGrouping", false);

Gelöscht : user_pref("ConduitEngine.IsMulticommunity", false);

Gelöscht : user_pref("ConduitEngine.IsOpenThankYouPage", false);

Gelöscht : user_pref("ConduitEngine.IsOpenUninstallPage", true);

Gelöscht : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Sat Nov 27 2010 12:30:14 GMT+0100");

Gelöscht : user_pref("ConduitEngine.LastLogin_3.2.5.2", "Sat Nov 27 2010 12:30:14 GMT+0100");

Gelöscht : user_pref("ConduitEngine.PublisherContainerWidth", 0);

Gelöscht : user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);

Gelöscht : user_pref("ConduitEngine.SettingsLastCheckTime", "Sat Nov 27 2010 12:30:13 GMT+0100");

Gelöscht : user_pref("ConduitEngine.UserID", "UN44485972423810327");

Gelöscht : user_pref("ConduitEngine.engineLocale", "de-DE");

Gelöscht : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Sat Nov 27 2010 12:30:14 GMT+0100");

Gelöscht : user_pref("ConduitEngine.initDone", true);

Gelöscht : user_pref("aol_toolbar.default.homepage.check", false);

Gelöscht : user_pref("aol_toolbar.default.search.check", false);

Gelöscht : user_pref("extensions.5040984f837b2.scode", "(function(){try{if('mystart.incredibar.com,premiumrepor[...]

Gelöscht : user_pref("extensions.BabylonToolbar.admin", false);

Gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");

Gelöscht : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");

Gelöscht : user_pref("extensions.BabylonToolbar.autoRvrt", "false");

Gelöscht : user_pref("extensions.BabylonToolbar.babExt", "");

Gelöscht : user_pref("extensions.BabylonToolbar.babTrack", "affID=112457&tt=3512_5");

Gelöscht : user_pref("extensions.BabylonToolbar.cntry", "CH");

Gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");

Gelöscht : user_pref("extensions.BabylonToolbar.dpk", "");

Gelöscht : user_pref("extensions.BabylonToolbar.envrmnt", "production");

Gelöscht : user_pref("extensions.BabylonToolbar.excTlbr", false);

Gelöscht : user_pref("extensions.BabylonToolbar.hdrMd5", "D1B17D262CB74F4C5AF2E3AE23063C11");

Gelöscht : user_pref("extensions.BabylonToolbar.hmpg", false);

Gelöscht : user_pref("extensions.BabylonToolbar.id", "6429017300000000000000ade1ac1c1a");

Gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15583");

Gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");

Gelöscht : user_pref("extensions.BabylonToolbar.isdcmntcmplt", true);

Gelöscht : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.6.9.1212:57:51");

Gelöscht : user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.1");

Gelöscht : user_pref("extensions.BabylonToolbar.newTab", false);

Gelöscht : user_pref("extensions.BabylonToolbar.pnu_base", "{\"newVrsn\":\"26\",\"lastVrsn\":\"26\",\"vrsnLoad\[...]

Gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");

Gelöscht : user_pref("extensions.BabylonToolbar.prtkDS", 0);

Gelöscht : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);

Gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");

Gelöscht : user_pref("extensions.BabylonToolbar.sg", "none");

Gelöscht : user_pref("extensions.BabylonToolbar.smplGrp", "none");

Gelöscht : user_pref("extensions.BabylonToolbar.srcExt", "ss");

Gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "base");

Gelöscht : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=[...]

Gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.6.9.12");

Gelöscht : user_pref("extensions.BabylonToolbar.vrsnTs", "1.6.9.1212:57:51");

Gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.6.9.12");

Gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");

Gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112457&tt=3512_5");

Gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", false);

Gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

Gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.6.9.1212:57:51");

Gelöscht : user_pref("keyword.URL", "hxxp://searchab.com/?aff=7&uid=10fce665-4fac-11e2-acef-00ade1ac1c1a&q=");

Gelöscht : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");

Gelöscht : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");

Gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");

Gelöscht : user_pref("sweetim.toolbar.previous.keyword.URL", "");

Gelöscht : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");

Gelöscht : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");

Gelöscht : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");

Gelöscht : user_pref("sweetim.toolbar.searchguard.enable", "");
 

*************************
 

AdwCleaner[S1].txt - [26395 octets] - [28/05/2013 22:51:25]
 

########## EOF - C:\AdwCleaner[S1].txt - [26456 octets] ##########

Hi,
neustarten bitte.
HitmanPro - Download - Filepony
Hitmanpro laden, doppelklicken.
Auf Scan, nichts löschen.
Auf weiter, Log speichern unter und posten, bzw als XML exportieren und posten, oder packen und anhängen

Code:



        Code:


        
HitmanPro 3.7.5.199

www.hitmanpro.com
 

   Computer name . . . . : PC-ROMAN

   Windows . . . . . . . : 6.1.1.7601.X64/2

   User name . . . . . . : pc-roman\roman

   UAC . . . . . . . . . : Enabled

   License . . . . . . . : Free
 

   Scan date . . . . . . : 2013-05-28 23:17:18

   Scan mode . . . . . . : Normal

   Scan duration . . . . : 5m 5s

   Disk access mode  . . : Direct disk access (SRB)

   Cloud . . . . . . . . : Internet

   Reboot  . . . . . . . : No
 

   Threats . . . . . . . : 0

   Traces  . . . . . . . : 63
 

   Objects scanned . . . : 2'615'695

   Files scanned . . . . : 19'686

   Remnants scanned  . . : 995'831 files / 1'600'178 keys
 

Cookies _____________________________________________________________________
 

   C:\Users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\cookies.sqlite:ads.low.biz

   C:\Users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\cookies.sqlite:apmebf.com

   C:\Users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\cookies.sqlite:atdmt.com

   C:\Users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\cookies.sqlite:burstnet.com

   C:\Users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\cookies.sqlite:doubleclick.net

   C:\Users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\cookies.sqlite:ladbrokesaccount.solution.weborama.fr

   C:\Users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\cookies.sqlite:tribalfusion.com

   C:\Users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\cookies.sqlite:weborama.fr

   C:\Users\roman\AppData\Roaming\Mozilla\Firefox\Profiles\m39annuf.default\cookies.sqlite:www.burstnet.com

OK, Hitmanpro Funde löschen, neustarten.

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

C:\Windows\system32\*.tsp

/md5start

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

explorer.exe

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\*.dll /lockedfiles

%USERPROFILE%\*.*

%USERPROFILE%\Local Settings\Temp\*.exe

%USERPROFILE%\Local Settings\Temp\*.dll

%USERPROFILE%\Application Data\*.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Hi, die extra.txt Datei kann ich irgendwie nicht finden. Habe das Gefühl es wurde gar keine erstellt, aber vielleicht irre ich mich auch.

Die OTL.txt Datei habe ich hier:

Code:

OTL logfile created on: 29.05.2013 14:10:04 - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\roman\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy

 

3,91 Gb Total Physical Memory | 2,47 Gb Available Physical Memory | 63,32% Memory free

7,81 Gb Paging File | 6,20 Gb Available in Paging File | 79,39% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 281,66 Gb Total Space | 181,75 Gb Free Space | 64,53% Space Free | Partition Type: NTFS

Drive D: | 16,13 Gb Total Space | 2,64 Gb Free Space | 16,34% Space Free | Partition Type: NTFS

Drive E: | 99,34 Mb Total Space | 92,74 Mb Free Space | 93,36% Space Free | Partition Type: FAT32

 

Computer Name: PC-ROMAN | User Name: roman | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\roman\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

PRC - C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)

PRC - C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)

PRC - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Cisco Systems, Inc.)

PRC - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)

PRC - C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe (Swisscom)

PRC - C:\Program Files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe (Swisscom)

PRC - c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)

PRC - C:\Programme\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe (Broadcom Corporation.)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\7a89b81a9a5c4a57d2b1b152beb9b481\PresentationFramework.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\e9784f6667e92cb4d3bc01731c8a3310\System.Configuration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\69236ea8029652460eff6fc27bfc742c\PresentationCore.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\c206c0d5425bc25640b647ac986fc236\System.Core.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\45c1597cf0c989dbbfdc5e3cb067306f\WindowsBase.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\40ec6eb5a95de56636ea90f638d1eb2c\System.ServiceProcess.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\2297aa4cb17f43a679db50ea05b2b811\System.Xaml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\353fd535963fff2f9086c2f655a47ace\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\73507c607e4c46f5e04122de0cc5f3fd\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3ef97e67e8d2c09fd2495ed952e1afbc\mscorlib.ni.dll ()

MOD - c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll ()

MOD - C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll ()

MOD - C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll ()

MOD - C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll ()

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - (STacSV) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\stacsv64.exe (IDT, Inc.)

SRV:64bit: - (hpsrv) -- C:\Windows\SysNative\hpservice.exe (Hewlett-Packard)

SRV:64bit: - (AESTFilters) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\AESTSr64.exe (Andrea Electronics Corporation)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (vpnagent) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (UDM Service) -- C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe (Swisscom)

SRV - (SesamService) -- C:\Program Files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe (Swisscom)

SRV - (STacSV) -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\STacSV64.exe (IDT, Inc.)

SRV - (btwdins) -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (GameConsoleService) -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe (WildTangent, Inc.)

SRV - (AESTFilters) -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_5ea32181aefd3364\AESTSr64.exe (Andrea Electronics Corporation)

SRV - (ezSharedSvc) -- C:\Windows\SysWOW64\ezsvc7.dll (EasyBits Sofware AS)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)

DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)

DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)

DRV:64bit: - (vpnva) -- C:\Windows\SysNative\drivers\vpnva64.sys (Cisco Systems, Inc.)

DRV:64bit: - (acsock) -- C:\Windows\SysNative\drivers\acsock64.sys (Cisco Systems, Inc.)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)

DRV:64bit: - (ewusbnet) -- C:\Windows\SysNative\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (hwusbfake) -- C:\Windows\SysNative\drivers\ewusbfake.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)

DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (AmUStor) -- C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)

DRV:64bit: - (STHDA) -- C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (btwrchid) -- C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)

DRV:64bit: - (btwl2cap) -- C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)

DRV:64bit: - (btwavdt) -- C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)

DRV:64bit: - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (WtSmpFlt) -- C:\Windows\SysNative\drivers\wtsmpflt.sys (Swisscom)

DRV:64bit: - (wtsmpadap) -- C:\Windows\SysNative\drivers\wtsmpadap.sys (Swisscom)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)

DRV:64bit: - (hpdskflt) -- C:\Windows\SysNative\drivers\hpdskflt.sys (Hewlett-Packard)

DRV:64bit: - (Accelerometer) -- C:\Windows\SysNative\drivers\Accelerometer.sys (Hewlett-Packard)

DRV:64bit: - (SrvHsfV92) -- C:\Windows\SysNative\drivers\VSTDPV6.SYS (Conexant Systems, Inc.)

DRV:64bit: - (SrvHsfWinac) -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS (Conexant Systems, Inc.)

DRV:64bit: - (SrvHsfHDA) -- C:\Windows\SysNative\drivers\VSTAZL6.SYS (Conexant Systems, Inc.)

DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys (Marvell)

DRV:64bit: - (netw5v64) -- C:\Windows\SysNative\drivers\netw5v64.sys (Intel Corporation)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)

DRV:64bit: - (HpqKbFiltr) -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)

DRV - (DVMIO) -- C:\SPLASH.SYS\config\dvmio.sys (DeviceVM, Inc.)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCON/12

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE:64bit: - HKLM\..\SearchScopes\{B8102C4D-2D2B-46BF-BF67-1AC9FF61E12B}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/12

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{B8102C4D-2D2B-46BF-BF67-1AC9FF61E12B}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

IE - HKCU\..\SearchScopes,DefaultScope = {B8102C4D-2D2B-46BF-BF67-1AC9FF61E12B}

IE - HKCU\..\SearchScopes\{B8102C4D-2D2B-46BF-BF67-1AC9FF61E12B}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox

IE - HKCU\..\SearchScopes\{D734C3F7-D9A3-4528-BE7F-766B998B8012}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=112457&tt=3512_5&babsrc=SP_ss&mntrId=6429017300000000000000ade1ac1c1a

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultengine: "Privitize VPN"

FF - prefs.js..browser.search.defaultenginename: "Privitize VPN"

FF - prefs.js..browser.search.defaultenginename,S: S", ""

FF - prefs.js..browser.search.defaultthis.engineName: ""

FF - prefs.js..browser.search.defaulturl: ""

FF - prefs.js..browser.search.order.1: "Privitize VPN"

FF - prefs.js..browser.search.order.1,S: S", ""

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.selectedEngine,S: S", ""

FF - prefs.js..browser.search.useDBForOrder: "false"

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.ch/"

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0

FF - prefs.js..extensions.enabledItems: {99999999-73df-4e76-b66c-87d3db104b03}:1.3.5

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1

FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {9d1f059c-cada-4111-9696-41a62d64e3ba}:0.5.3.4

FF - prefs.js..extensions.enabledItems: {7E77F5DF-8022-40e3-9122-F03DEBEFC43B}:1.0.25

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..network.proxy.type: 4

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Program Files (x86)\TVUPlayer\npTVUAx.dll File not found

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{E4D8AFFF-DA7C-412F-A976-05ED142C7806}: C:\Program Files (x86)\Swisscom\Unlimited Data Manager\FireFox_Remote\ [2011.07.01 12:12:43 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\quickprint@hp.com: C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2011.01.26 15:27:28 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.05.28 22:04:51 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.05.28 22:04:51 | 000,000,000 | ---D | M]

 

[2010.03.20 18:28:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\roman\AppData\Roaming\mozilla\Extensions

[2013.04.15 20:07:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\roman\AppData\Roaming\mozilla\Firefox\Profiles\m39annuf.default\extensions

[2013.05.23 18:48:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2013.05.23 18:48:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2013.05.23 18:48:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

[2013.05.23 18:48:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions

[2013.05.23 18:48:15 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

 

O1 HOSTS File: ([2013.05.28 18:43:58 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.

O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()

O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Cisco Systems, Inc.)

O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe (EasyBits Software AS)

O4 - HKLM..\Run: [HPCam_Menu] c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

O4 - HKLM..\Run: [NortonOnlineBackup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe File not found

O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)

O4 - HKCU..\Run: [HP Officejet 6700 (NET)] C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)

O4 - HKCU..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0

O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm File not found

O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm File not found

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8 - Extra context menu item: Free YouTube Download - C:\Users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm File not found

O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)

O9 - Extra 'Tools' menuitem : SmartPrint - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O13 - gopher Prefix: missing

O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (WRC Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BED56F8B-4D3D-4593-A4A5-7DF72E44F288}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C089350C-6EEE-4182-8057-A250ACEAF6AC}: NameServer = 195.186.1.111,195.186.4.162

O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.)

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"

ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker 2.6

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

NetSvcs: ezSharedSvc - C:\Windows\SysWOW64\ezsvc7.dll (EasyBits Sofware AS)

 

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.05.28 23:15:46 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro

[2013.05.28 22:22:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2013.05.28 22:22:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java

[2013.05.28 22:21:14 | 000,000,000 | ---D | C] -- C:\Program Files\Java

[2013.05.28 21:24:49 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2013.05.28 21:16:34 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2013.05.28 21:15:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Local

[2013.05.28 19:45:04 | 000,000,000 | ---D | C] -- C:\Users\roman\AppData\Roaming\Malwarebytes

[2013.05.28 19:44:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2013.05.28 19:44:24 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2013.05.28 19:44:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2013.05.28 18:31:50 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2013.05.28 18:31:50 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2013.05.28 18:31:50 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2013.05.28 18:31:22 | 000,000,000 | ---D | C] -- C:\Qoobox

[2013.05.28 18:31:11 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2013.05.28 18:29:39 | 005,073,758 | R--- | C] (Swearware) -- C:\Users\roman\Desktop\ComboFix.exe

[2013.05.28 16:32:42 | 002,237,968 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\roman\Desktop\tdsskiller.exe

[2013.05.28 15:16:02 | 000,000,000 | ---D | C] -- C:\_OTL

[2013.05.27 22:35:25 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\roman\Desktop\OTL.exe

[2013.05.27 22:15:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro

[2013.05.27 21:33:36 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group

[2013.05.27 21:33:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard

[2013.05.23 18:48:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

[2013.05.23 18:45:56 | 000,019,632 | ---- | C] (PerformerSoft LLC) -- C:\Windows\SysNative\roboot64.exe

[2013.05.23 18:45:45 | 000,000,000 | ---D | C] -- C:\Users\roman\AppData\Roaming\PhotoScape

[2013.05.23 18:45:01 | 021,322,864 | ---- | C] (Mooii) -- C:\Users\roman\Desktop\PhotoScape_V3-6-3.exe

[2013.05.09 21:59:57 | 000,083,160 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys

[2013.05.02 22:25:29 | 000,000,000 | ---D | C] -- C:\Users\roman\AppData\Roaming\Mp3tag

[2013.05.02 22:24:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mp3tag

[2013.04.30 19:05:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24

[2013.04.30 19:05:45 | 000,000,000 | ---D | C] -- C:\Users\roman\AppData\Local\Programs

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.05.29 14:06:04 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.05.29 14:06:04 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.05.29 13:57:28 | 000,001,922 | ---- | M] () -- C:\Users\roman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk

[2013.05.29 13:57:19 | 000,000,362 | -H-- | M] () -- C:\Windows\tasks\ZoomExUpdaterTask{F23D1332-650C-41C4-A9AD-35612BEE4DA8}.job

[2013.05.29 13:57:19 | 000,000,332 | -H-- | M] () -- C:\Windows\tasks\CodecUpdaterTask{A3BC3E92-28B6-42C0-93BD-0D1B5CF5C1C7}.job

[2013.05.29 13:57:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.05.29 13:57:02 | 3144,839,168 | -HS- | M] () -- C:\hiberfil.sys

[2013.05.29 10:27:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.05.28 23:24:49 | 000,003,430 | ---- | M] () -- C:\Users\roman\Desktop\HitmanPro_20130528_2324.xml

[2013.05.28 22:52:18 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2013.05.28 22:52:18 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2013.05.28 22:52:18 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2013.05.28 22:52:18 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2013.05.28 22:52:18 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2013.05.28 22:50:11 | 000,632,031 | ---- | M] () -- C:\Users\roman\Desktop\adwcleaner.exe

[2013.05.28 22:27:01 | 000,438,016 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2013.05.28 22:04:51 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk

[2013.05.28 21:24:59 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2013.05.28 19:44:27 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.05.28 18:43:58 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2013.05.28 18:30:16 | 005,073,758 | R--- | M] (Swearware) -- C:\Users\roman\Desktop\ComboFix.exe

[2013.05.28 16:32:46 | 002,237,968 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\roman\Desktop\tdsskiller.exe

[2013.05.27 22:35:28 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\roman\Desktop\OTL.exe

[2013.05.23 18:45:09 | 021,322,864 | ---- | M] (Mooii) -- C:\Users\roman\Desktop\PhotoScape_V3-6-3.exe

[2013.05.22 19:52:43 | 004,714,380 | ---- | M] () -- C:\Users\roman\Desktop\Mechanik Formelsammlung Lukas Frhlich.pdf

[2013.05.09 21:59:41 | 000,083,160 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys

[2013.05.02 22:24:40 | 000,000,983 | ---- | M] () -- C:\Users\Public\Desktop\Mp3tag.lnk

[2013.05.01 15:55:58 | 001,661,812 | ---- | M] () -- C:\Users\roman\Desktop\skript-1.pdf

[2013.04.30 19:48:04 | 000,211,626 | ---- | M] () -- C:\Users\roman\Desktop\loesung_annotated.pdf

[2013.04.30 19:05:56 | 000,001,063 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk

[2013.04.30 19:05:55 | 000,001,078 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Editor.lnk

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013.05.28 23:24:49 | 000,003,430 | ---- | C] () -- C:\Users\roman\Desktop\HitmanPro_20130528_2324.xml

[2013.05.28 22:50:04 | 000,632,031 | ---- | C] () -- C:\Users\roman\Desktop\adwcleaner.exe

[2013.05.28 22:04:51 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

[2013.05.28 22:04:51 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk

[2013.05.28 22:02:16 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.05.28 21:24:59 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2013.05.28 19:44:27 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.05.28 18:31:50 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2013.05.28 18:31:50 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2013.05.28 18:31:50 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2013.05.28 18:31:50 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2013.05.28 18:31:50 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2013.05.27 21:04:49 | 000,002,633 | ---- | C] () -- C:\ProgramData\agiwoc.js

[2013.05.22 19:52:42 | 004,714,380 | ---- | C] () -- C:\Users\roman\Desktop\Mechanik Formelsammlung Lukas Frhlich.pdf

[2013.05.02 22:24:40 | 000,000,983 | ---- | C] () -- C:\Users\Public\Desktop\Mp3tag.lnk

[2013.05.01 15:55:56 | 001,661,812 | ---- | C] () -- C:\Users\roman\Desktop\skript-1.pdf

[2013.04.30 19:48:04 | 000,211,626 | ---- | C] () -- C:\Users\roman\Desktop\loesung_annotated.pdf

[2013.04.30 19:05:56 | 000,001,063 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk

[2013.04.30 19:05:55 | 000,001,078 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Editor.lnk

[2013.02.05 17:52:54 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe

[2013.02.05 17:52:50 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll

[2013.02.05 17:52:50 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll

[2013.02.05 17:52:50 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll

[2013.02.05 17:52:50 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll

[2012.12.08 19:52:17 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini

[2012.02.20 21:11:21 | 000,016,384 | ---- | C] () -- C:\Windows\SysWow64\FileOps.exe

[2012.02.18 11:41:12 | 000,000,154 | ---- | C] () -- C:\Users\roman\.appletviewer

[2010.12.10 14:19:41 | 000,005,120 | ---- | C] () -- C:\Users\roman\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.03.18 21:10:01 | 000,000,000 | ---- | C] () -- C:\Users\roman\AppData\Roaming\wklnhst.dat

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2013.05.28 22:34:59 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\.Torrent Stream

[2010.10.17 13:55:04 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\DVDVideoSoft

[2012.09.06 15:42:32 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\FreePDF

[2013.04.10 16:34:04 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\MediaMonkey

[2013.05.02 22:34:16 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\Mp3tag

[2013.05.23 18:53:19 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\PhotoScape

[2013.04.08 13:31:38 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\Samsung

[2011.06.10 21:47:54 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\TS3Client

[2013.05.28 22:45:17 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\uTorrent

[2010.11.23 19:25:31 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\XMedia Recode

[2010.03.10 22:40:40 | 000,000,000 | ---D | M] -- C:\Users\roman\AppData\Roaming\_MDLogs

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %SYSTEMDRIVE%\*. >

[2013.05.28 21:16:34 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN

[2009.12.09 12:11:59 | 000,000,000 | ---D | M] -- C:\boot

[2011.05.08 13:01:41 | 000,000,000 | ---D | M] -- C:\Brother

[2013.05.28 22:41:16 | 000,000,000 | ---D | M] -- C:\Config.Msi

[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2010.03.10 20:08:43 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen

[2010.03.10 20:08:57 | 000,000,000 | ---D | M] -- C:\dvmexp

[2010.01.04 21:50:10 | 000,000,000 | ---D | M] -- C:\HP

[2010.03.10 20:08:57 | 000,000,000 | ---D | M] -- C:\HPMBackup

[2010.05.31 23:15:30 | 000,000,000 | R--D | M] -- C:\MSOCache

[2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2013.05.28 22:34:25 | 000,000,000 | R--D | M] -- C:\Program Files

[2013.05.28 22:41:41 | 000,000,000 | R--D | M] -- C:\Program Files (x86)

[2013.05.29 14:16:50 | 000,000,000 | ---D | M] -- C:\ProgramData

[2010.03.10 20:08:43 | 000,000,000 | -HSD | M] -- C:\Programme

[2013.05.28 18:48:00 | 000,000,000 | ---D | M] -- C:\Qoobox

[2010.03.10 20:14:36 | 000,000,000 | ---D | M] -- C:\Recovery

[2010.03.12 21:57:38 | 000,000,000 | ---D | M] -- C:\SPLASH.000

[2010.03.10 20:08:57 | 000,000,000 | ---D | M] -- C:\SPLASH.SYS

[2010.03.10 20:24:30 | 000,000,000 | ---D | M] -- C:\SwSetup

[2013.05.29 14:13:29 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2010.03.10 20:14:39 | 000,000,000 | ---D | M] -- C:\SYSTEM.SAV

[2013.03.07 20:46:36 | 000,000,000 | ---D | M] -- C:\TorrentStream

[2010.08.14 09:46:19 | 000,000,000 | R--D | M] -- C:\Users

[2013.05.28 22:46:47 | 000,000,000 | ---D | M] -- C:\Windows

[2013.05.28 21:11:53 | 000,000,000 | ---D | M] -- C:\_OTL

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 
 < C:\Windows\system32\*.tsp >

[2009.07.14 03:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp

[2009.07.14 03:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp

[2009.07.14 03:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp

[2009.07.14 03:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp

[2010.11.20 14:16:53 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp

[2009.07.14 07:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT

[2009.07.14 07:08:49 | 000,032,632 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2012.08.31 12:57:53 | 000,000,332 | -H-- | C] () -- C:\Windows\Tasks\CodecUpdaterTask{A3BC3E92-28B6-42C0-93BD-0D1B5CF5C1C7}.job

[2012.12.27 00:32:35 | 000,000,362 | -H-- | C] () -- C:\Windows\Tasks\ZoomExUpdaterTask{F23D1332-650C-41C4-A9AD-35612BEE4DA8}.job

[2013.05.28 22:02:16 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\erdnt\cache64\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\erdnt\cache86\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\erdnt\cache64\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: EXPLORER.EXE  >

[2009.12.09 09:00:54 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_b8b0208ee0ce1889\explorer.exe

[2011.02.26 08:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe

[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe

[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe

[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe

[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe

[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe

[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\erdnt\cache86\explorer.exe

[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe

[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe

[2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe

[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe

[2009.12.09 09:00:54 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=6D4F9E4B640B413C6F73414327484C80 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_addea9f19345cd81\explorer.exe

[2009.08.03 08:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe

[2009.10.31 08:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe

[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe

[2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

[2009.10.31 08:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe

[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe

[2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe

[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe

[2009.12.09 09:00:54 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=CA17F8620815267DC838E30B68CB5052 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_ae5b763cac6d568e\explorer.exe

[2011.02.26 08:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe

[2009.08.03 08:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

[2009.12.09 09:00:54 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_b8335443c7a68f7c\explorer.exe

 
 < MD5 for: IASTOR.SYS  >

[2009.06.04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys

[2009.06.04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysNative\drivers\iaStor.sys

[2009.06.04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_7fb62b08f6b7117a\iaStor.sys

[2009.06.04 19:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\erdnt\cache64\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\erdnt\cache86\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\erdnt\cache86\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\erdnt\cache64\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\erdnt\cache86\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\erdnt\cache64\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\erdnt\cache86\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\erdnt\cache64\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\erdnt\cache64\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2013.04.04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < %USERPROFILE%\*.* >

[2012.02.18 11:41:12 | 000,000,154 | ---- | M] () -- C:\Users\roman\.appletviewer

[2013.05.29 14:44:10 | 003,145,728 | -HS- | M] () -- C:\Users\roman\ntuser.dat

[2013.05.29 14:44:10 | 000,262,144 | -HS- | M] () -- C:\Users\roman\ntuser.dat.LOG1

[2010.03.10 20:08:48 | 000,000,000 | -HS- | M] () -- C:\Users\roman\ntuser.dat.LOG2

[2010.03.10 22:44:56 | 000,065,536 | -HS- | M] () -- C:\Users\roman\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf

[2010.03.10 22:44:56 | 000,524,288 | -HS- | M] () -- C:\Users\roman\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms

[2010.03.10 22:44:56 | 000,524,288 | -HS- | M] () -- C:\Users\roman\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms

[2011.07.12 23:38:51 | 000,065,536 | -HS- | M] () -- C:\Users\roman\ntuser.dat{67bc0534-accc-11e0-b107-e55b9245e8f8}.TM.blf

[2011.07.12 23:38:51 | 000,524,288 | -HS- | M] () -- C:\Users\roman\ntuser.dat{67bc0534-accc-11e0-b107-e55b9245e8f8}.TMContainer00000000000000000001.regtrans-ms

[2011.07.12 23:38:51 | 000,524,288 | -HS- | M] () -- C:\Users\roman\ntuser.dat{67bc0534-accc-11e0-b107-e55b9245e8f8}.TMContainer00000000000000000002.regtrans-ms

[2010.03.10 20:08:48 | 000,000,020 | -HS- | M] () -- C:\Users\roman\ntuser.ini

 
 < %USERPROFILE%\Local Settings\Temp\*.exe >

 
 < %USERPROFILE%\Local Settings\Temp\*.dll >

 
 < %USERPROFILE%\Application Data\*.exe >

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

 
 ========== Files - Unicode (All) ==========

[2013.02.23 15:56:01 | 000,000,040 | ---- | M] ()(C:\Windows\SysNative\?µ) -- C:\Windows\SysNative\漰µ

[2013.02.23 15:56:01 | 000,000,040 | ---- | C] ()(C:\Windows\SysNative\?µ) -- C:\Windows\SysNative\漰µ
 

< End of report >

Hi,

otl fix

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

:OTL

IE - HKCU\..\SearchScopes\{D734C3F7-D9A3-4528-BE7F-766B998B8012}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=112457&tt=3512_5&babsrc=SP_ss&mntrId=6429017300000000000000ade1ac1c1a

FF - prefs.js..browser.search.defaultengine: "Privitize VPN"

FF - prefs.js..browser.search.order.1: "Privitize VPN"

872b5b88-9db5-4310-bdd0-ac189557e5f5

FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.

O4 - HKLM..\Run: [NortonOnlineBackup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe File not found

O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm File not found

O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm File not found

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Free YouTube Download - C:\Users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm File not found

O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\roman\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

:files

:Commands

[emptytemp]

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

bitte teste, ob es im Firefox, internet explorer, und sonstigen
evtl. instalierte Browser, irgendwelche ungewollten toolbars, umleitungen oder sonstigen Probleme gibt.
Teste wie pc und programme allgemein laufen.

läuft alles wie geschmiert. es ist mir nichts ungewöhnliches mehr aufgefallen.
neigt sich dieser prozess dem ende zu? :D

Code:

All processes killed

========== OTL ==========

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D734C3F7-D9A3-4528-BE7F-766B998B8012}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D734C3F7-D9A3-4528-BE7F-766B998B8012}\ not found.

Prefs.js: "Privitize VPN" removed from browser.search.defaultengine

Prefs.js: "Privitize VPN" removed from browser.search.order.1

Prefs.js: engine@conduit.com:3.2.5.2 removed from extensions.enabledItems

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NortonOnlineBackup deleted successfully.

64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Free YouTube Download\ deleted successfully.

64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Free YouTube to Mp3 Converter\ deleted successfully.

64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xel exportieren\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Free YouTube Download\ not found.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Free YouTube to Mp3 Converter\ not found.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xel exportieren\ not found.

========== FILES ==========

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: ADMINI~1

->Temp folder emptied: 0 bytes

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

->Temp folder emptied: 0 bytes

 

User: roman

->Temp folder emptied: 62623583 bytes

->Temporary Internet Files folder emptied: 5929733 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 205229628 bytes

->Flash cache emptied: 3403 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 1525470 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 565714 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50501 bytes

%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 668 bytes

RecycleBin emptied: 0 bytes
 

Total Files Cleaned = 263,00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 05292013_174947
 

Files\Folders moved on Reboot...

C:\Users\roman\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Öffne OTL, bereinigen, PC startet neu, Remover werden gelöscht.
Lösche übrig gebliebene Setups, Logs, von uns verwendete Programme.
als antimalware programm würde ich emsisoft empfehlen.
diese haben für mich den besten schutz kostet aber etwas.
Computeractive Software Store - Emsisoft Anti-Malware 7 [1-PC] - 63% off RRP
testversion:
Meine Antivirus-Empfehlung: Emsisoft Anti-Malware
insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren.
vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen.

kostenlos, aber eben nicht ganz so gut währe avast zu empfehlen.
http://www.trojaner-board.de/110895-...antivirus.html

sag mir welches du nutzt, dann gebe ich konfigurationshinweise.
bitte dein bisheriges av deinstalieren
die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch!

http://www.trojaner-board.de/96344-a...-rechners.html
Starte bitte mit der Passage, Windows Vista und Windows 7
Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.
Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist.
aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen.
als browser rate ich dir zu chrome:
http://support.google.com/chrome/bin...&answer=118663
anleitung lesen bitte
falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung anpassen.

Sandboxie
Die devinition einer Sandbox ist hier nachzulesen:
Sandbox
Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen.

Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen.
Download Link:
Sandboxie - Download - Filepony

anleitung:
http://www.trojaner-board.de/71542-a...sandboxie.html
ausführliche anleitung als pdf, auch abarbeiten:
Sandbox Einstellungen |

bitte folgende zusatz konfiguration machen:
sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen.
dort klicke auf sandbox einstellungen.
beschrenkungen, bei programm start und internet zugriff schreibe:
chrome.exe
dann gehe auf anwendungen, webbrowser, chrome.
dort aktiviere alles außer gesammten profil ordner freigeben.
Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen.
Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate.
Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten.
Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten.
Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar.

Weiter mit:
Maßnahmen für ALLE Windows-Versionen
alles komplett durcharbeiten
anmerkung zu file hippo.
in den settings zusätzlich auswählen:
hide beta updates.
Run updateChecker when Windows starts

Backup Programm:
in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an:
http://www.trojaner-board.de/82962-w...en-backup.html
Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar.
Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist.

Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern
bitte auch lesen, wie mache ich programme für alle sichtbar:
Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe
surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox.
wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird sandboxie immer gestartet wenn du nen browser aufrufst.
wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser

passwort sicherheit:
jeder dienst benötigt ein eigenes, mindestens 12-stelliges passwort
bei der passwort verwaltung und erstellung hilft roboform
Passwort Manager, Formular Ausfueller, Passwort Management | RoboForm Passwort Manager
anleitung:
RoboForm-Bedienungsanleitung: Passwort-Manager, Verwalten von Passwörtern und persönlichen Daten

so weit so klar.

avast installiert, sonst noch nichts damit gemacht.
avira deinstalliert.

windows-update einstellungen geändert und alle updates heruntergeladen.

ich benutze firefox. bin vor kurzem wieder umgestiegen, war nicht mehr zufrieden mit chrome und arbeite deswegen wieder mit firefox.

sandboxie installiert. geht mir jetzt aber zu lange die ganze liste durchzuarbeiten, dazu fehlt mir momentan die zeit. lasse es aber auf dem pc und werde mich da mal einlesen.

danke dir! unglaublich gut diese hilfe.

anstelle chrome.exe in sandboxie freigeben
firefox.exe
plugin-container.exe
und unter anwendung, webbrowser firefox, alles außer gesammten Profilordner

Ok.

Ein grosses Dankeschön! Ich habe mich natürlich bevor ich mich hier angemeldet habe ein wenig umgesehen und war schon beeindruckt von diesem Forum.

Deine Hilfe war ausgezeichnet, keine Übertreibung!

Alles Gute!

ok kannst dich ja noch mal melden wenn du durch bist