Trojaner-Board - Ihr Windows System wurde aus Sicherheitsgründen blockiert!

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Ihr Windows System wurde aus Sicherheitsgründen blockiert! (https://www.trojaner-board.de/107858-windows-system-wurde-sicherheitsgruenden-blockiert.html)

Ihr Windows System wurde aus Sicherheitsgründen blockiert!

Hallo! Ich habe ebenfalls diesen Virus, wo die Meldung escheint: Achtung! Ihr Windows System wurde aus Sicherheitsgründen blockiert! und man für das Update bezahlen muss! Oben ist die Bundesflagge und sonst drumherum ist der Bildschrim schwarz! Ich kann nicht auf meinen Laptop zugreifen (gleich, wenn ich das Kennwort für mein Benutzerkennwort eingegeben hab kommt diese Meldung!) und ich weiß nicht, was ich machen soll! Kann mir vielleicht jemand helfen? Danke schonmal im Vorraus!

Funktioniert noch der abgesicherte Modus mit Netzwerktreibern?

Abgesicherter Modus zur Bereinigung

Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

Ja das funktioniert! :) Und was muss ich jetzt machen? :S

Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Ja das funktioniert! :) Und was muss ich jetzt machen?

Okay vielen Dank! Ich werde das jetzt mal versuchen! :)

Tut mir leid, dass es so lange dauert! :(Der Malware Suchlauf läuft noch! Es sind schon 2 infizierte Objekte gefunden worden! Soll ich die dann einfach wenns fertig ist in die Quarantäne verschieben und löschen?

Ja alles löschen und GANZ WICHTIG: Log posten!

Gut danke, ja das werd ich machen! :) Wenn dieser Scann mal fertig werden würde! Läuft jetzt schon seit einer Stunde! *__* Ist das normal?

Code:

 Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2012.01.10.03
 

Windows Vista Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)

Internet Explorer 7.0.6001.18000

staples :: STAPLES1-PC [Administrator]
 

10.01.2012 12:48:25

mbam-log-2012-01-10 (12-48-25).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 402715

Laufzeit: 1 Stunde(n), 10 Minute(n), 42 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|iexploer.exe (Trojan.Agent.BH) -> Daten: C:\Users\staples\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 3

C:\Users\staples\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe (Trojan.Agent.BH) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\staples\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WDFSK6Q8\files_load2[1].exe (Trojan.Agent.BH) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Windows\Temp\TMP00000001535A17EC2A6A4DBD (Trojan.Dropper) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Code:

 Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2012.01.10.03
 

Windows Vista Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)

Internet Explorer 7.0.6001.18000

staples :: STAPLES1-PC [Administrator]
 

10.01.2012 12:48:25

mbam-log-2012-01-10 (12-48-25).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 402715

Laufzeit: 1 Stunde(n), 10 Minute(n), 42 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|iexploer.exe (Trojan.Agent.BH) -> Daten: C:\Users\staples\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 3

C:\Users\staples\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe (Trojan.Agent.BH) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\staples\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WDFSK6Q8\files_load2[1].exe (Trojan.Agent.BH) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Windows\Temp\TMP00000001535A17EC2A6A4DBD (Trojan.Dropper) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

ich hoffe es hat geklappt? :) Und jetzt ladet ESEt gerade!

Ist mein Log angekommen? Vielen Dank schonmal! Im Moment funktioniert alles, obwohl ich den ESET-Scann noch nicht gemacht hab gibt es jetzt keine Fehler-Meldung mehr und ich kann den Laptop ganz normal hochfahren usw! :) Aber ich mache den ESEt-Scann trotzdem noch zur Sicherheit und poste ihn! :)

Dieser ESET-Scann (ich ihn jetzt ganz normal ablaufen lassen, nicht auf dem abgesicherten Modus, aber das macht kein Unterschied oder? ) läuft jetzt schon seit 6 Stunden! o.O Ist das normal? Und er hat jetzt noch 3 infizierte Dateien gefunden! Soll ich die auch einfach löschen?

Okay und hier ist der ESET log : :)

Code:

 all ok

ESETSmartInstaller@High as downloader log:

all ok

esets_scanner_update returned -1 esets_gle=53251

ESETSmartInstaller@High as downloader log:

all ok

esets_scanner_update returned -1 esets_gle=53251

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=dea761c9f506bf48aca4e33ae9a137a3

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-01-11 01:31:33

# local_time=2012-01-11 02:31:33 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6001 NT Service Pack 1

# compatibility_mode=1797 16775165 100 94 750694 62794342 1317347 0

# compatibility_mode=5892 16776637 100 100 4172 163793849 0 0

# compatibility_mode=8192 67108863 100 0 63401 63401 0 0

# scanned=219840

# found=3

# cleaned=0

# scan_time=27624

C:\Program Files\VideoConverter\VideoConverter.exe        a variant of Win32/InstallCore.A application (unable to clean)        00000000000000000000000000000000        I

C:\Users\staples\AppData\Local\Temp\is799009782\MyBabylonTB.exe        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Users\staples\Downloads\installer_Microsoft_Excel_Viewer_8_0_.exe        Win32/Toggle application (unable to clean)        00000000000000000000000000000000        I

hoffe man kann damit iwas anfangen? :)

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Okay alles klar, danke das werde ich machen! :) Und soll ich dann den ESET-Scann löschen?

Okay alles klar! :) Also hier ist jetzt der OTL-txt! Und dann gibt es da noch einen Extra-txt... Soll ich den auch posten? Mach ich einfach mal zur Sicherheit! :)

OTL Logfile:

Code:

OTL logfile created on: 11.01.2012 17:47:05 - Run 1

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\staples\Desktop

Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6001.18000)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,68 Gb Available Physical Memory | 56,09% Memory free

6,21 Gb Paging File | 4,96 Gb Available in Paging File | 79,81% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 289,17 Gb Total Space | 173,18 Gb Free Space | 59,89% Space Free | Partition Type: NTFS

Drive D: | 8,92 Gb Total Space | 1,63 Gb Free Space | 18,25% Space Free | Partition Type: NTFS

 

Computer Name: STAPLES1-PC | User Name: staples | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.01.11 17:34:02 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\staples\Desktop\OTL.exe

PRC - [2011.10.13 17:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\BingBar\SeaPort.EXE

PRC - [2011.06.28 17:39:27 | 000,428,200 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe

PRC - [2011.06.28 17:39:26 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.04.27 13:48:15 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2010.12.10 17:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe

PRC - [2010.12.10 17:29:30 | 029,293,408 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

PRC - [2010.12.10 17:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe

PRC - [2010.09.16 21:04:06 | 001,164,584 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe

PRC - [2010.08.02 16:09:32 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010.04.16 22:12:28 | 003,872,080 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Messenger\msnmsgr.exe

PRC - [2010.01.15 13:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe

PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.04.16 19:55:02 | 000,221,239 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f691e717\stacsv.exe

PRC - [2008.04.16 19:52:28 | 000,442,433 | ---- | M] (IDT, Inc.) -- C:\Programme\IDT\WDM\sttray.exe

PRC - [2008.03.26 14:26:56 | 000,341,328 | ---- | M] () -- C:\Windows\SMINST\BLService.exe

PRC - [2008.02.12 06:05:54 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f691e717\AEstSrv.exe

PRC - [2008.01.21 03:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2008.01.21 03:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe

PRC - [2008.01.21 03:24:13 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe

PRC - [2008.01.21 03:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe

PRC - [2008.01.21 03:23:29 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.07.31 14:49:24 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\1ba19f8efcff8ad7f972aa38ab9a15f5\System.Runtime.Remoting.ni.dll

MOD - [2011.07.31 14:49:08 | 011,800,576 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\0a1195c6b5fab213527364c9e8b26ef0\System.Web.ni.dll

MOD - [2011.07.31 11:11:24 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\cfb60f99da570cc494e27e0e8ee747e2\System.Xml.ni.dll

MOD - [2011.07.31 11:09:39 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\381fb23cb39e1a61e13b8770eb9800ba\System.Windows.Forms.ni.dll

MOD - [2011.07.31 11:08:41 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f1aa2385c0109f3059e0e6ba8b58ff68\System.Drawing.ni.dll

MOD - [2011.07.31 11:02:05 | 007,950,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dff86a62a525ec8dc827fe9f50298b7\System.ni.dll

MOD - [2011.07.31 11:00:07 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll

MOD - [2010.09.16 21:04:50 | 000,095,528 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll

MOD - [2010.09.16 21:04:06 | 001,164,584 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe

MOD - [2009.11.03 15:51:42 | 000,067,872 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2008.09.20 01:43:47 | 001,679,360 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3009.39983__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll

MOD - [2008.09.20 01:43:47 | 000,364,544 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.3009.40180__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll

MOD - [2008.09.20 01:43:47 | 000,253,952 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3009.39941__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll

MOD - [2008.09.20 01:43:47 | 000,196,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3009.39997__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll

MOD - [2008.09.20 01:43:47 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3009.40172__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll

MOD - [2008.09.20 01:43:47 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3009.40135__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll

MOD - [2008.09.20 01:43:47 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3009.39975__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll

MOD - [2008.09.20 01:43:47 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3009.40094__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll

MOD - [2008.09.20 01:43:47 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3009.39962__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll

MOD - [2008.09.20 01:43:46 | 000,483,328 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3009.40202__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll

MOD - [2008.09.20 01:43:18 | 000,135,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3009.40208__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll

MOD - [2008.09.20 01:43:18 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3009.39955__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll

MOD - [2008.09.20 01:43:17 | 000,352,256 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3009.40143__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll

MOD - [2008.09.20 01:43:17 | 000,147,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard\2.0.3009.40201__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.dll

MOD - [2008.09.20 01:43:17 | 000,090,112 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3009.40149__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll

MOD - [2008.09.20 01:43:17 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3009.40142__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll

MOD - [2008.09.20 01:43:17 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.3009.40200__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll

MOD - [2008.09.20 01:43:16 | 000,802,816 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3009.40102__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll

MOD - [2008.09.20 01:43:16 | 000,401,408 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3009.40163__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll

MOD - [2008.09.20 01:43:16 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3009.40102__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll

MOD - [2008.09.20 01:43:15 | 000,901,120 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.3009.40173__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll

MOD - [2008.09.20 01:43:15 | 000,585,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3009.40010__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll

MOD - [2008.09.20 01:43:15 | 000,479,232 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3009.40095__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll

MOD - [2008.09.20 01:43:15 | 000,442,368 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3009.40089__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll

MOD - [2008.09.20 01:43:15 | 000,438,272 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3009.39963__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll

MOD - [2008.09.20 01:43:15 | 000,401,408 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.3009.40129__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll

MOD - [2008.09.20 01:43:15 | 000,307,200 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.3009.40017__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll

MOD - [2008.09.20 01:43:15 | 000,217,088 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3009.40004__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll

MOD - [2008.09.20 01:43:15 | 000,118,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3009.40116__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll

MOD - [2008.09.20 01:43:15 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3009.40094__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll

MOD - [2008.09.20 01:43:15 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3009.40016__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll

MOD - [2008.09.20 01:43:15 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3009.40101__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll

MOD - [2008.09.20 01:43:15 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3009.40115__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll

MOD - [2008.09.20 01:43:15 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3009.40128__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll

MOD - [2008.09.20 01:43:14 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.2939.23687__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll

MOD - [2008.09.20 01:43:14 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.2939.23679__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll

MOD - [2008.09.20 01:43:14 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.2939.23767__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll

MOD - [2008.09.20 01:43:14 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.2939.23710__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll

MOD - [2008.09.20 01:43:14 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.2939.23768__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll

MOD - [2008.09.20 01:43:14 | 000,006,656 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll

MOD - [2008.09.20 01:43:13 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.2939.23668__90ba9c70f846762e\CLI.Foundation.dll

MOD - [2008.09.20 01:43:13 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll

MOD - [2008.09.20 01:43:13 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2939.23662__90ba9c70f846762e\LOG.Foundation.dll

MOD - [2008.09.20 01:43:13 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2939.23802__90ba9c70f846762e\CLI.Foundation.XManifest.dll

MOD - [2008.09.20 01:43:13 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2939.23667__90ba9c70f846762e\NEWAEM.Foundation.dll

MOD - [2008.09.20 01:43:13 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2939.23717__90ba9c70f846762e\DEM.OS.I0602.dll

MOD - [2008.09.20 01:43:13 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2939.23693__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll

MOD - [2008.09.20 01:43:13 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.2939.23687__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll

MOD - [2008.09.20 01:43:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2939.23707__90ba9c70f846762e\MOM.Foundation.dll

MOD - [2008.09.20 01:43:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.2939.23717__90ba9c70f846762e\DEM.OS.dll

MOD - [2008.09.20 01:43:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll

MOD - [2008.09.20 01:43:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.2939.23718__90ba9c70f846762e\DEM.Graphics.dll

MOD - [2008.09.20 01:43:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll

MOD - [2008.09.20 01:43:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.2939.23688__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll

MOD - [2008.09.20 01:43:12 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2965.22300__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll

MOD - [2008.09.20 01:43:12 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2939.23689__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll

MOD - [2008.09.20 01:43:12 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.2939.23743__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll

MOD - [2008.09.20 01:43:12 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.2939.23740__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll

MOD - [2008.09.20 01:43:12 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.2939.23764__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll

MOD - [2008.09.20 01:43:12 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.2939.23763__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll

MOD - [2008.09.20 01:43:12 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.2939.23735__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll

MOD - [2008.09.20 01:43:12 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.2939.23741__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll

MOD - [2008.09.20 01:43:12 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2939.23679__90ba9c70f846762e\CLI.Component.Client.Shared.dll

MOD - [2008.09.20 01:43:12 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2939.23719__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll

MOD - [2008.09.20 01:43:12 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2939.23734__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll

MOD - [2008.09.20 01:43:12 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.2939.23718__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll

MOD - [2008.09.20 01:43:11 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.2939.23739__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll

MOD - [2008.09.20 01:43:11 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.2939.23738__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll

MOD - [2008.09.20 01:43:11 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2939.23742__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll

MOD - [2008.09.20 01:43:11 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2939.23708__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll

MOD - [2008.09.20 01:43:11 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.2939.23719__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll

MOD - [2008.09.20 01:43:11 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2939.23711__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll

MOD - [2008.09.20 01:43:11 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Foundation\2.0.2939.23665__90ba9c70f846762e\AEM.Foundation.dll

MOD - [2008.09.20 01:43:11 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll

MOD - [2008.09.20 01:43:11 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.2939.23709__90ba9c70f846762e\APM.Foundation.dll

MOD - [2008.09.20 01:43:11 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2939.23687__90ba9c70f846762e\AEM.Server.Shared.dll

MOD - [2008.09.20 01:43:02 | 000,005,120 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray.resources\2.0.3009.40186_de_90ba9c70f846762e\CLI.Component.Systemtray.resources.dll

MOD - [2008.09.20 01:43:01 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3009.40217__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll

MOD - [2008.09.20 01:43:01 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.2939.23677__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll

MOD - [2008.09.20 01:43:01 | 000,011,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3009.40228__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll

MOD - [2008.09.20 01:43:01 | 000,006,656 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3009.39933__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll

MOD - [2008.09.20 01:43:00 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3009.39969__90ba9c70f846762e\CLI.Component.Wizard.dll

MOD - [2008.09.20 01:43:00 | 000,413,696 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3009.40186__90ba9c70f846762e\CLI.Component.Systemtray.dll

MOD - [2008.09.20 01:43:00 | 000,102,400 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3009.40194__90ba9c70f846762e\MOM.Implementation.dll

MOD - [2008.09.20 01:43:00 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3009.39933__90ba9c70f846762e\CLI.Component.Runtime.dll

MOD - [2008.09.20 01:43:00 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3009.40193__90ba9c70f846762e\LOG.Foundation.Implementation.dll

MOD - [2008.09.20 01:43:00 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2939.23713__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll

MOD - [2008.09.20 01:43:00 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2939.23678__90ba9c70f846762e\CLI.Foundation.Private.dll

MOD - [2008.09.20 01:43:00 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2939.23679__90ba9c70f846762e\LOG.Foundation.Private.dll

MOD - [2008.09.20 01:43:00 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2939.23694__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll

MOD - [2008.09.20 01:43:00 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2939.23712__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll

MOD - [2008.09.20 01:43:00 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.2939.23711__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll

MOD - [2008.09.20 01:42:59 | 001,507,328 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3009.39949__90ba9c70f846762e\CLI.Component.Dashboard.dll

MOD - [2008.09.20 01:42:59 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.3009.39934__90ba9c70f846762e\ATIDEMOS.dll

MOD - [2008.09.20 01:42:59 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3009.39931__90ba9c70f846762e\APM.Server.dll

MOD - [2008.09.20 01:42:59 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3009.39932__90ba9c70f846762e\AEM.Server.dll

MOD - [2008.09.20 01:42:59 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2939.23689__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll

MOD - [2008.09.20 01:42:59 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3009.40194__90ba9c70f846762e\CCC.Implementation.dll

MOD - [2008.09.20 01:42:59 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll

MOD - [2008.09.20 01:42:59 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2939.23746__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll

MOD - [2008.09.16 20:18:06 | 000,132,608 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll

MOD - [2008.07.27 19:03:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2008.05.25 11:01:11 | 000,430,080 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll

MOD - [2008.05.14 21:56:52 | 000,345,384 | ---- | M] () -- C:\Programme\HP\QuickPlay\Kernel\TV\CLTinyDB.dll

MOD - [2008.05.14 21:56:46 | 000,120,216 | ---- | M] () -- C:\Programme\HP\QuickPlay\Kernel\TV\CLSchMgr.dll

MOD - [2008.05.14 21:56:46 | 000,038,184 | ---- | M] () -- C:\Programme\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll

MOD - [2008.05.14 21:56:42 | 000,259,480 | ---- | M] () -- C:\Programme\HP\QuickPlay\Kernel\TV\CLCapEngine.dll

MOD - [2008.05.14 21:56:42 | 000,066,856 | ---- | M] () -- C:\Programme\HP\QuickPlay\Kernel\common\MCEMediaStatus.dll

MOD - [2008.03.28 10:19:10 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll

MOD - [2008.02.27 13:48:46 | 000,016,384 | R--- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll

MOD - [2008.02.04 12:29:02 | 000,688,128 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

MOD - [2006.08.24 13:17:52 | 000,004,096 | ---- | M] () -- C:\Programme\Messenger Plus! Live\Detoured.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.10.21 15:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)

SRV - [2011.10.13 17:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)

SRV - [2011.06.28 17:39:27 | 000,428,200 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)

SRV - [2011.06.28 17:39:26 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.04.27 13:48:15 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)

SRV - [2008.04.16 19:55:02 | 000,221,239 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f691e717\stacsv.exe -- (STacSV)

SRV - [2008.03.26 14:26:56 | 000,341,328 | ---- | M] () [Auto | Running] -- C:\Windows\SMINST\BLService.exe -- (Recovery Service for Windows)

SRV - [2008.02.12 06:05:54 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f691e717\AEstSrv.exe -- (AESTFilters)

SRV - [2008.02.03 11:00:00 | 000,129,992 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\System32\ezsvc7.dll -- (ezSharedSvc)

SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.08.30 10:19:04 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggsemc.sys -- (ggsemc)

DRV - [2011.08.30 10:19:04 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggflt.sys -- (ggflt)

DRV - [2011.06.28 17:39:29 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.06.28 17:39:29 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010.03.18 20:22:20 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2010.03.18 20:22:17 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2009.03.25 16:48:00 | 000,114,728 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mdm.sys -- (s1018mdm)

DRV - [2009.03.25 16:48:00 | 000,109,864 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018unic.sys -- (s1018unic) Sony Ericsson Device 1018 USB Ethernet Emulation (WDM)

DRV - [2009.03.25 16:48:00 | 000,106,208 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mgmt.sys -- (s1018mgmt) Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM)

DRV - [2009.03.25 16:48:00 | 000,104,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018obex.sys -- (s1018obex)

DRV - [2009.03.25 16:48:00 | 000,086,824 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018bus.sys -- (s1018bus) Sony Ericsson Device 1018 driver (WDM)

DRV - [2009.03.25 16:48:00 | 000,026,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018nd5.sys -- (s1018nd5) Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS)

DRV - [2009.03.25 16:48:00 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mdfl.sys -- (s1018mdfl)

DRV - [2008.04.27 10:07:44 | 000,909,824 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)

DRV - [2008.04.16 19:58:24 | 000,379,904 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)

DRV - [2008.04.14 23:56:18 | 000,170,000 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\ahcix86s.sys -- (ahcix86s)

DRV - [2008.04.14 20:05:08 | 000,118,784 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2008.04.01 12:14:00 | 000,081,296 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR)

DRV - [2008.03.28 12:24:16 | 003,544,064 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)

DRV - [2008.03.27 11:12:12 | 000,024,424 | ---- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\hpdskflt.sys -- (hpdskflt)

DRV - [2008.03.27 11:11:34 | 000,034,664 | ---- | M] (Hewlett-Packard Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Accelerometer.sys -- (Accelerometer)

DRV - [2008.01.23 22:23:12 | 000,052,736 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\enecir.sys -- (enecir)

DRV - [2008.01.07 21:42:04 | 000,015,416 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\Amddfltr.sys -- (Amddfltr)

DRV - [2007.07.11 09:30:22 | 000,007,168 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\HpqRemHid.sys -- (HpqRemHid)

DRV - [2007.06.18 16:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)

DRV - [2006.11.02 08:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)

DRV - [2006.10.29 21:23:12 | 000,007,680 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arcor.de

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=Pavilion&pf=cnnb

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.arcor.de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/home?G=1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Users\staples\Desktop\DivX\DivX Player\npDivxPlayerPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()

FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\staples\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.01.11 16:19:46 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.01.11 16:15:34 | 000,000,000 | ---D | M]

 

[2012.01.11 16:20:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\staples\AppData\Roaming\mozilla\Extensions

[2012.01.11 16:19:46 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2009.02.22 20:11:03 | 000,000,000 | ---D | M] (ToggleEN Toolbar) -- C:\Programme\Mozilla Firefox\extensions\{038cb5c7-48ea-4af9-94e0-a1646542e62b}

[2011.12.21 08:42:29 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.08.30 10:15:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2011.12.21 06:08:50 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2010.10.18 10:47:50 | 000,002,226 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml

[2011.12.21 06:02:40 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2011.12.21 06:08:50 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2011.12.21 06:08:50 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.12.21 06:08:50 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.12.21 06:08:50 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)

O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (no name) -  - No CLSID value found.

O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)

O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Programme\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)

O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10w_Plugin.exe (Adobe Systems, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0

O8 - Extra context menu item: Free YouTube Download - C:\Users\staples\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\staples\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000033 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O13 - gopher Prefix: missing

O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A4551A49-FB3A-49D9-A774-7387C2D2DA86}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{ED6D12E4-183A-43DD-B6F8-51AB3B4E17F8}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\staples\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\staples\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{abe74b8a-9cc5-11df-9849-001e68f6c48f}\Shell - "" = AutoRun

O33 - MountPoints2\{abe74b8a-9cc5-11df-9849-001e68f6c48f}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

NetSvcs: ezSharedSvc - C:\Windows\System32\ezsvc7.dll (EasyBits Sofware AS)

 

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1

ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)

Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.01.11 17:34:02 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\staples\Desktop\OTL.exe

[2012.01.11 16:41:44 | 000,000,000 | ---D | C] -- C:\Users\staples\AppData\Local\AskToolbar

[2012.01.10 14:15:20 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.01.10 12:46:38 | 000,000,000 | ---D | C] -- C:\Users\staples\AppData\Roaming\Malwarebytes

[2012.01.10 12:46:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.01.10 12:46:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.01.10 12:46:33 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.01.10 12:46:33 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2011.12.27 12:45:53 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software

[2011.12.27 12:45:52 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software

[2011.12.26 22:33:12 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com

[2011.08.30 09:21:45 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpeE1C8.dll

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.01.11 18:05:00 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{63085E01-5952-4B37-A840-C0CDB97A2D15}.job

[2012.01.11 17:34:02 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\staples\Desktop\OTL.exe

[2012.01.11 16:42:39 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.01.11 16:42:39 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.01.11 16:19:49 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.01.11 06:45:04 | 000,000,269 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini

[2012.01.11 06:44:40 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics

[2012.01.11 06:42:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.01.11 06:42:17 | 3216,891,904 | -HS- | M] () -- C:\hiberfil.sys

[2012.01.10 20:45:01 | 000,000,562 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for staples.job

[2012.01.10 17:19:05 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{7CE242C4-A2C2-4962-B558-B87CF4BC257C}.job

[2012.01.10 12:46:35 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2011.12.27 15:38:17 | 000,000,000 | ---- | M] () -- C:\Users\staples\AppData\Local\{11602EDB-52E2-4794-A62A-E8F3365017B7}

[2011.12.27 13:06:02 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt

[2011.12.26 22:27:09 | 000,006,944 | ---- | M] () -- C:\Users\staples\AppData\Local\d3d9caps.dat

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.01.11 16:19:49 | 000,000,858 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2012.01.11 16:19:49 | 000,000,846 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2012.01.10 14:57:07 | 3216,891,904 | -HS- | C] () -- C:\hiberfil.sys

[2012.01.10 12:46:35 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2011.12.27 15:38:17 | 000,000,000 | ---- | C] () -- C:\Users\staples\AppData\Local\{11602EDB-52E2-4794-A62A-E8F3365017B7}

[2011.11.07 23:15:45 | 000,057,344 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll

[2010.10.21 08:33:37 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE

[2010.03.19 16:09:05 | 000,000,054 | ---- | C] () -- C:\Windows\mpsettings.ini

[2010.03.18 20:22:19 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2010.03.18 20:22:17 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2010.02.15 17:32:39 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat

[2009.01.10 11:48:43 | 000,000,000 | ---- | C] () -- C:\Windows\PROTOCOL.INI

[2009.01.04 18:58:02 | 000,168,448 | ---- | C] () -- C:\Windows\System32\unrar.dll

[2009.01.03 10:45:25 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat

[2008.12.26 17:44:14 | 000,006,944 | ---- | C] () -- C:\Users\staples\AppData\Local\d3d9caps.dat

[2008.12.15 18:02:22 | 000,001,156 | ---- | C] () -- C:\Users\staples\AppData\Roaming\wklnhst.dat

[2008.12.13 09:43:45 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2008.12.13 09:43:45 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2008.12.08 13:42:36 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat

[2008.11.03 08:45:17 | 000,020,992 | ---- | C] () -- C:\Users\staples\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll

[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll

[2008.09.20 02:14:05 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2008.05.25 11:02:26 | 000,675,450 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2008.05.25 11:02:26 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2008.05.25 11:02:26 | 000,143,976 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2008.05.25 11:02:26 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2008.05.25 02:54:03 | 000,008,308 | ---- | C] () -- C:\Windows\System32\ezdigsgn.dat

[2008.03.28 10:19:10 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll

[2008.03.28 09:51:08 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat

[2008.03.05 20:40:54 | 000,168,883 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2008.03.04 05:02:00 | 000,090,112 | ---- | C] () -- C:\Windows\System32\atibrtmon.exe

[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 13:47:37 | 000,416,232 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 11:33:01 | 000,642,704 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 11:33:01 | 000,121,592 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2006.03.08 18:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

 
 ========== LOP Check ==========

 

[2011.08.25 09:47:42 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\DVDVideoSoft

[2011.05.17 20:15:51 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.11.14 16:57:20 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\GetRightToGo

[2011.08.11 14:44:29 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Jens Lorek

[2009.01.04 21:33:01 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\KompoZer

[2010.02.04 19:20:25 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien

[2010.03.14 19:31:38 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\NVD

[2008.12.15 18:26:09 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\OpenOffice.org

[2010.05.31 16:18:15 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\SoftGrid Client

[2011.08.30 09:18:44 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Sony

[2009.03.15 20:47:19 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Template

[2010.05.31 16:15:45 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\TP

[2010.03.11 17:37:35 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\TubeBox

[2010.07.26 13:22:11 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Unity

[2012.01.11 00:04:37 | 000,032,610 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2012.01.11 18:05:00 | 000,000,424 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{63085E01-5952-4B37-A840-C0CDB97A2D15}.job

[2012.01.10 17:19:05 | 000,000,422 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{7CE242C4-A2C2-4962-B558-B87CF4BC257C}.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2008.12.17 15:06:04 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Adobe

[2011.05.07 16:04:48 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Apple Computer

[2008.11.01 16:11:16 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\ATI

[2011.03.21 16:02:44 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Avira

[2008.12.29 22:52:02 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\CyberLink

[2011.08.30 09:19:18 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\DivX

[2011.08.25 09:47:42 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\DVDVideoSoft

[2011.05.17 20:15:51 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.11.14 16:57:20 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\GetRightToGo

[2011.10.09 18:01:08 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\GTek

[2008.11.01 16:11:48 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Hewlett-Packard

[2008.11.01 16:10:41 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Identities

[2011.08.11 14:44:29 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Jens Lorek

[2009.01.04 21:33:01 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\KompoZer

[2008.11.03 12:14:27 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Macromedia

[2012.01.10 12:46:38 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Malwarebytes

[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Media Center Programs

[2010.02.04 19:20:25 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien

[2011.08.11 00:05:50 | 000,000,000 | --SD | M] -- C:\Users\staples\AppData\Roaming\Microsoft

[2010.05.22 16:38:10 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Move Networks

[2012.01.11 16:20:34 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Mozilla

[2010.03.14 19:31:38 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\NVD

[2008.12.15 18:26:09 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\OpenOffice.org

[2012.01.10 23:04:12 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Skype

[2012.01.10 16:06:08 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\skypePM

[2010.05.31 16:18:15 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\SoftGrid Client

[2011.08.30 09:18:44 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Sony

[2008.11.01 16:11:11 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Symantec

[2009.03.15 20:47:19 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Template

[2010.05.31 16:15:45 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\TP

[2010.03.11 17:37:35 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\TubeBox

[2010.10.10 20:25:27 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\U3

[2010.07.26 13:22:11 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\Unity

[2011.08.25 15:14:58 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\vlc

[2009.01.04 21:31:59 | 000,000,000 | ---D | M] -- C:\Users\staples\AppData\Roaming\WinRAR

 
 < %APPDATA%\*.exe /s >

[2011.08.11 14:29:51 | 000,010,134 | R--- | M] () -- C:\Users\staples\AppData\Roaming\Microsoft\Installer\{24F5BFDD-18E0-41F6-8A68-A22C742FC4A1}\_0F341F58BFBE20EFADEE80.exe

[2011.08.11 14:29:51 | 000,355,574 | R--- | M] () -- C:\Users\staples\AppData\Roaming\Microsoft\Installer\{24F5BFDD-18E0-41F6-8A68-A22C742FC4A1}\_4D80B784D15D49ECBF5A0B.exe

[2011.08.11 14:29:49 | 000,034,494 | R--- | M] () -- C:\Users\staples\AppData\Roaming\Microsoft\Installer\{24F5BFDD-18E0-41F6-8A68-A22C742FC4A1}\_6FEFF9B68218417F98F549.exe

[2011.08.11 14:29:49 | 000,080,992 | R--- | M] () -- C:\Users\staples\AppData\Roaming\Microsoft\Installer\{24F5BFDD-18E0-41F6-8A68-A22C742FC4A1}\_72A5724C31215BEBBACE39.exe

[2011.08.11 14:29:51 | 000,355,574 | R--- | M] () -- C:\Users\staples\AppData\Roaming\Microsoft\Installer\{24F5BFDD-18E0-41F6-8A68-A22C742FC4A1}\_748E2FBA50E030F9090CC4.exe

[2010.04.18 16:13:40 | 000,009,662 | R--- | M] () -- C:\Users\staples\AppData\Roaming\Microsoft\Installer\{4527481F-E36D-408E-9F40-89E2630E2120}\_6FEFF9B68218417F98F549.exe

[2010.04.14 18:35:02 | 000,009,662 | R--- | M] () -- C:\Users\staples\AppData\Roaming\Microsoft\Installer\{B95416CC-D7EA-4636-A8FC-600A1880DBC8}\_6FEFF9B68218417F98F549.exe

[2010.03.20 14:18:26 | 000,009,662 | R--- | M] () -- C:\Users\staples\AppData\Roaming\Microsoft\Installer\{D761C5D2-E727-415A-BC4E-52642CEA1A1C}\_6FEFF9B68218417F98F549.exe

 
 < %SYSTEMDRIVE%\*.exe >

[2009.11.27 09:10:32 | 003,177,984 | ---- | M] () -- C:\TubeBox.exe

 

 
 < MD5 for: AGP440.SYS  >

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: AHCIX86S.SYS  >

[2008.04.14 23:56:18 | 000,170,000 | ---- | M] (AMD Technologies Inc.) MD5=E331924FDF522CD7CEA1B647503784E8 -- C:\SWSetup\Drivers\AHCI\Packages\Drivers\SBDrv\SB7xx\RAID\LH\ahcix86s.sys

[2008.04.14 23:56:18 | 000,170,000 | ---- | M] (AMD Technologies Inc.) MD5=E331924FDF522CD7CEA1B647503784E8 -- C:\Windows\System32\drivers\ahcix86s.sys

[2008.04.14 23:56:18 | 000,170,000 | ---- | M] (AMD Technologies Inc.) MD5=E331924FDF522CD7CEA1B647503784E8 -- C:\Windows\System32\DriverStore\FileRepository\ahcix86s.inf_2908f969\ahcix86s.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: EVENTLOG.DLL  >

[2007.01.12 21:30:08 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\CyberLink\PowerDirector\EventLog.dll

 
 < MD5 for: IASTORV.SYS  >

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll

[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll

[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe

[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2008.03.28 10:19:20 | 000,372,736 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\system32\ATIDEMGX.dll

 
 ========== Files - Unicode (All) ==========

[2011.11.14 07:04:36 | 000,596,248 | ---- | C] ()(C:\Users\staples\Desktop\01 HQ SHINee ??? -  &#39_Ring Ding 1.m4r) -- C:\Users\staples\Desktop\01 HQ SHINee 샤이니 -  &#39_Ring Ding 1.m4r

[2011.11.14 07:04:26 | 000,596,248 | ---- | M] ()(C:\Users\staples\Desktop\01 HQ SHINee ??? -  &#39_Ring Ding 1.m4r) -- C:\Users\staples\Desktop\01 HQ SHINee 샤이니 -  &#39_Ring Ding 1.m4r
 

< End of report >

--- --- ---

Und der Extra-txt:

OTL EXTRAS Logfile:

Code:

OTL Extras logfile created on: 11.01.2012 17:47:05 - Run 1

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\staples\Desktop

Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6001.18000)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,68 Gb Available Physical Memory | 56,09% Memory free

6,21 Gb Paging File | 4,96 Gb Available in Paging File | 79,81% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 289,17 Gb Total Space | 173,18 Gb Free Space | 59,89% Space Free | Partition Type: NTFS

Drive D: | 8,92 Gb Total Space | 1,63 Gb Free Space | 18,25% Space Free | Partition Type: NTFS

 

Computer Name: STAPLES1-PC | User Name: staples | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"UacDisableNotify" = 0

"InternetSettingsDisableNotify" = 0

"AutoUpdateDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

"DefaultOutboundAction" = 0

"DefaultInboundAction" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{01168D3F-D26C-43A7-B33E-046B682A77CF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{02BF4DAE-A85C-45F1-A78E-C768F3B39DFA}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{0303E187-2BE3-4132-81F8-938476A64AE4}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{05007E02-DE02-4D3B-AE50-DB42FACF505C}" = rport=2869 | protocol=6 | dir=out | app=system | 

"{22F85BD3-BFB3-4199-ACF9-56468DE18CD5}" = rport=445 | protocol=6 | dir=out | app=system | 

"{2605F3DF-309D-4446-9A25-7294461FD97C}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{2693EF53-23BC-43FA-A210-465697B82D35}" = rport=139 | protocol=6 | dir=out | app=system | 

"{27628995-550F-451D-9853-B0BED575E909}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{28B2C2ED-4DDA-4931-B609-22EA53178FA3}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 

"{335A679E-898B-4A29-891B-FB2C1F5E4C19}" = lport=139 | protocol=6 | dir=in | app=system | 

"{4431B9F8-9037-4C77-A8EF-79E7F4D9370E}" = rport=138 | protocol=17 | dir=out | app=system | 

"{4685FC2D-EE5C-4DA1-9172-68D1E447DE54}" = lport=138 | protocol=17 | dir=in | app=system | 

"{5137001B-6FCC-426A-B63D-390D4B78DD1C}" = rport=137 | protocol=17 | dir=out | app=system | 

"{52AD391C-6FF3-456D-A998-CBBC269D918A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{550B47B9-7A15-484F-8C51-BF19E3377A07}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{6C6E4489-015E-465A-A39F-8AA42F87B98F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{78B0627F-EF26-476F-B78B-04B8105766D6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{7BD71CFF-F56B-47A6-B96F-61C609F7CF45}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{95DA8506-8C92-4370-B29F-5A8A01C4E706}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{9C563CB7-BED1-4746-BF94-FECE7E0C4ACC}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{9F69B650-93BB-4F52-BB75-49066C6358DD}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{A5734F7D-6BBD-461C-AC6F-E0E14FFCA432}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{AC637D10-6CC3-4F1C-A3A2-5AA00EDFE672}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{B1232A6D-2497-4B18-B66C-7F90582AD9FC}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{BDDB1E10-9124-4008-9183-CC27ED57C5FE}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{D41D9F4F-65CC-4505-9CB6-AC8967FD0439}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{DC0DF5CD-FAC8-4A74-8414-CE05DA55016E}" = lport=445 | protocol=6 | dir=in | app=system | 

"{FAD32DF8-05F5-4A19-8D0D-5D695E47A852}" = lport=137 | protocol=17 | dir=in | app=system | 

"{FB937B8C-C950-4FB2-A9AC-B284C245B5A2}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0B0B93A7-3EB7-481C-B609-D801459B97E3}" = protocol=17 | dir=in | app=c:\program files\electronic arts\die schlacht um mittelerde ii\game.dat | 

"{0E594D82-F296-4C91-8F58-88B71C32CB1B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{19A76E59-576E-4432-98F0-B98CE6C8307C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{1DD16557-8952-4253-A037-A8EF4C97AA10}" = dir=in | app=c:\program files\itunes\itunes.exe | 

"{20AB4BAF-A546-44D8-844B-B4418880E2DD}" = dir=in | app=c:\program files\hp\quickplay\qp.exe | 

"{2602284E-2D65-489F-B449-616A39193E91}" = protocol=6 | dir=in | app=c:\users\staples\downloads\videoconverter_setup.exe | 

"{26753D1D-A574-4A76-9194-9C56AE56387D}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 

"{3F8DDB3C-C848-455F-83DA-BDDC04D4FA1B}" = protocol=6 | dir=in | app=c:\program files\electronic arts\die schlacht um mittelerde ii\game.dat | 

"{5AC633C6-5AE9-4D4D-B5B3-738FA5FFF38E}" = protocol=6 | dir=in | app=c:\program files\electronic arts\the battle for middle-earth (tm) ii\game.dat | 

"{685A638C-C157-4443-B208-27102CFFAD81}" = protocol=17 | dir=in | app=c:\users\staples\appdata\local\temp\7zsdf85.tmp\symnrt.exe | 

"{6A9DB92F-FE8B-4728-B95F-4CB9667901A0}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 

"{76D76B7D-8D2C-4AFF-BEB4-6CB22FCC5E81}" = protocol=17 | dir=in | app=c:\program files\electronic arts\the lord of the rings, the rise of the witch-king\game.dat | 

"{7837B5C6-B360-471A-8421-82C96C1F09BA}" = protocol=6 | dir=in | app=c:\users\staples\appdata\local\temp\7zsdf85.tmp\symnrt.exe | 

"{78C222D9-CB60-4066-B09E-A4D37A220331}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 

"{7DCDBBEE-72F0-4152-80D8-797DAD717613}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe | 

"{8366FB58-9D62-4AEF-9EB4-4FE6C4CEC046}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 

"{8615DCC9-86DF-493D-B10D-042AC684FB3E}" = protocol=6 | dir=in | app=c:\program files\ea games\die schlacht um mittelerde(tm)\game.dat | 

"{865460EE-C118-4545-8DB9-234740446E47}" = protocol=17 | dir=in | app=c:\program files\ea games\die schlacht um mittelerde(tm)\game.dat | 

"{96785393-D730-41B3-BE83-A61D4CAE2125}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{A21FA6D4-4F19-4295-BAD7-36827067BEFB}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\mountblade warband\mb_warband.exe | 

"{A553B10B-905B-4AE2-B1B1-725B8E5D1523}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{A757C31D-A6F1-4281-AA9B-1BCC750D00A6}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 

"{AC0D1A95-ACAB-4A9A-83C6-58A20B7E55CF}" = protocol=17 | dir=in | app=c:\users\staples\downloads\videoconverter_setup.exe | 

"{B4542F7C-12AE-44C5-97E4-C285E351C360}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 

"{B9C360F6-2EE1-46BF-977B-80D0682B7A5B}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{B9EDEFB2-AF9C-4F6D-97FE-5C688DFBEE40}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 

"{BFBC325C-72B3-402D-9955-3189DC9E59E5}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{CB74D085-50E6-4D09-AD37-D503A2B7E3B2}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{D0590A55-64DC-4E22-99CE-3F14752D7E0E}" = protocol=6 | dir=in | app=c:\program files\electronic arts\the lord of the rings, the rise of the witch-king\game.dat | 

"{E1FFBFDC-63F7-447A-8D7C-7A7B8DC5C64B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{E29669D4-2C9A-4F32-8DF1-7972346FA66E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E2B81110-4014-4092-BC6E-643E2FD561C7}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 

"{E6A25001-4818-4E03-A369-D990559CBE5E}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{ED786B7C-5387-4906-8DCB-8F9DDD838220}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\mountblade warband\mb_warband.exe | 

"{FB020391-857E-45C7-B992-4D83209AB308}" = protocol=17 | dir=in | app=c:\program files\electronic arts\the battle for middle-earth (tm) ii\game.dat | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre

"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam

"{024D1716-9F42-0039-06E5-F4279D6C4382}" = CCC Help Russian

"{04556846-E511-3FE9-E824-3588075C8036}" = Catalyst Control Center Graphics Full Existing

"{05CD72BE-7783-AAB9-0C05-2D8DBD2DD444}" = Catalyst Control Center Localization Dutch

"{0612E132-33FF-4488-9C31-F8D485D6866D}" = Catalyst Control Center Graphics Light

"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer

"{0B3DB1B2-404C-AAA8-B32E-E65520EDE74D}" = CCC Help Polish

"{10504622-2818-C312-55CC-A72D36A31DBC}" = CCC Help Swedish

"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter

"{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2

"{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}" = Adobe Shockwave Player

"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{20ACB2F8-3BCA-45A8-80A2-9D3CB5C25F43}" = Safari

"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{24F5BFDD-18E0-41F6-8A68-A22C742FC4A1}" = TubeBox!

"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check for Health Check

"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller

"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 27

"{28C3E5E6-5ACA-408D-9A46-089C5334EC97}" = HP Help and Support

"{2A34320A-56F9-9C4F-D325-77AC8A54C8B6}" = Catalyst Control Center Localization Japanese

"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)

"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie

"{2C9FF444-79C0-C0C4-7B21-0E77C872AF53}" = CCC Help Danish

"{2CA3E0A5-9281-6E67-1843-A6CC0B00BD74}" = Catalyst Control Center Localization French

"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 5.007.01

"{30DAA715-5032-40F9-A0AE-95C9AEBB3E3F}" = HP QuickTouch 1.00 D2

"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform

"{31775690-0E29-2AB1-75DE-C406152CBD1D}" = Catalyst Control Center Localization Chinese Standard

"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7

"{3466C4D1-508A-0E36-EB05-2E53766F27E0}" = CCC Help Italian

"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 D3

"{38DCD6F5-C4DC-25E5-C113-0A909558FC2C}" = CCC Help Norwegian

"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker

"{3FA160E2-066B-8D77-FCF4-F001F236E8E7}" = CCC Help Spanish

"{3FA93E4C-CB3B-4B25-B091-9DB0FCC56A74}" = Catalyst Control Center - Branding

"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go

"{415B2719-AD3A-4944-B404-C472DB6085B3}" = Cisco EAP-FAST Module

"{431CED44-A6D3-4E4A-2B76-04D1A861FCCE}" = Catalyst Control Center Localization Swedish

"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.7

"{475144D0-A4D6-C553-42B5-7BB60FCEF9EC}" = Catalyst Control Center Localization German

"{49BA6327-744C-3D20-16DB-6E98BF66D0FD}" = Catalyst Control Center Localization Danish

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4B4D411D-E363-7E6B-68C3-C8E2EF02B7C6}" = CCC Help Chinese Traditional

"{4BFA6EEB-AAED-4334-8E98-A907DE4DD5CF}" = AMD Driver Support for HP 3D DriverGuard

"{50DB0F17-4180-31F7-F26B-B40CBA8BA6E0}" = CCC Help German

"{51E5C397-0AA0-48DD-9CB6-7259AFFDFB0A}" = HP Easy Setup - Frontend

"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent

"{5396C246-53B5-4BBA-62DC-8308C7357EFE}" = Catalyst Control Center Localization Polish

"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)

"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features

"{54CAEF60-0258-2D8E-F01F-24BC689EA8A9}" = Catalyst Control Center Localization Portuguese

"{560BB29B-41C5-88E4-4847-B4B1DDB47B9B}" = Catalyst Control Center Localization Czech

"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime

"{582287DA-0806-4AC0-BF19-C15E3A466034}" = LightScribe System Software  1.12.33.2

"{59748B12-406B-7EA4-355D-3BBD62E97C69}" = Catalyst Control Center Localization Turkish

"{5B4E5823-7265-9A19-A871-36E75824F7BE}" = CCC Help French

"{5EBC76DA-573E-7D96-A6F8-F4B9DE97A15F}" = Catalyst Control Center Localization Greek

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{623AD94E-1621-5AA1-BD6D-0EF08C9D7851}" = Catalyst Control Center Core Implementation

"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module

"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check

"{6DBCFFF6-2A7B-4AE4-8FC8-1216442E2814}" = CCC Help Korean

"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2

"{6FCBD7F7-6A29-089F-E5DB-E33EFCF306CD}" = Catalyst Control Center Localization Spanish

"{70B7A167-0B88-445D-A3EA-97C73AA88CAC}" = Windows Live Toolbar

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{762D9F20-593B-436E-CAC3-B3D9F4DA7A90}" = Catalyst Control Center Localization Chinese Traditional

"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync

"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client

"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}" = MobileMe Control Panel

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{80C2AD19-97A2-C829-38DE-5FD5B47F122B}" = ATI Catalyst Install Manager

"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module

"{8436F8D7-AA62-83DA-3BC5-E04871BF5F61}" = CCC Help Portuguese

"{84F40C39-1E61-B3A7-833A-3A376AB53394}" = CCC Help Japanese

"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support

"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)

"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0015-0407-0000-0000000FF1CE}_PROR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}_PROR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}_PROR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}_PROR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}_PROR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}_PROR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_PROR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_PROR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_PROR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_PROR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_PROR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90840409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Excel Viewer 2003

"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components

"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007

"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)

"{931FB38C-D5D4-4DBD-3723-50140A67F276}" = CCC Help Turkish

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{96A959C9-51E1-C920-A9FA-269BB462A940}" = CCC Help Czech

"{994223F3-A99B-4DDD-9E1D-0190A17C6860}" = Windows Live Family Safety

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9E2CCD5E-1990-4EF2-9B61-32F0BBACC29B}" = HP Active Support Library

"{A102E7E3-2A4E-F509-3EF6-019F45C83196}" = CCC Help Dutch

"{A57222BD-51E3-7765-A008-9B6428402A59}" = CCC Help Hungarian

"{A5CE7175-080D-49AC-B5A3-E7E3502428F5}" = HP Wireless Assistant

"{A8ACD338-255C-B53D-7F19-ED7293B291E8}" = Catalyst Control Center Localization Norwegian

"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.3 - Deutsch

"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8

"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger

"{B16DA0F8-26BC-4FFC-9363-1D9F3E6C3E21}" = HP Customer Experience Enhancements

"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar

"{BD41A0CF-79B4-98D8-B9B9-3DE8BEC8A861}" = Catalyst Control Center Localization Finnish

"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)

"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour

"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program

"{C4B2636B-D76D-7C23-3010-99E96693F0B5}" = Catalyst Control Center Graphics Previews Vista

"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail

"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint

"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update

"{C9E9386A-7E81-796A-3465-8471A239A8A0}" = CCC Help Chinese Standard

"{CA4498C8-5146-E527-27A7-1B4F81C9BF05}" = CCC Help Thai

"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support

"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials

"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector

"{CB71A20E-B1B4-4562-81FA-33E1DBD0342F}" = ProtectSmart Hard Drive Protection

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1

"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call

"{D761C5D2-E727-415A-BC4E-52642CEA1A1C}" = TubeBox!

"{DEC3A80C-49D3-2885-2A03-3FBA61A5D40F}" = Catalyst Control Center Localization Italian

"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer

"{E0B276B1-97D7-7AD2-548F-248A7745A1ED}" = CCC Help Greek

"{E2ADC6FA-4233-54E6-29EC-E60EAD096A50}" = Catalyst Control Center Localization Hungarian

"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio

"{E3EA025D-29A0-530C-9CA7-DBB5C49BB6DB}" = Skins

"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218

"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer

"{E96FFA19-E94B-D32B-E103-E78A0877245A}" = Catalyst Control Center Localization Thai

"{EAE4AD65-89F2-3DE8-DF46-CCB34393CAA0}" = Catalyst Control Center Localization Russian

"{EC84A68C-D149-42FF-9E1F-A8C6D1802A9B}" = Fritz10

"{EE3D717C-D93F-2A2B-F641-F59F48E11895}" = ccc-utility

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{f32502b5-5b64-4882-bf61-77f23edcac4f}" = HP Total Care Advisor

"{F447BD4C-65C3-A6D9-8A5F-5E822E32E1BC}" = Catalyst Control Center Localization Korean

"{F48098CD-2D66-4861-85EC-DC1D4D09D5F9}" = HP User Guides 0102

"{F48FEA7A-2B87-8270-927C-20A0E7E5EBC2}" = CCC Help English

"{F59A9E08-A6A4-4ACF-91F2-D0344956C30B}" = iTunes

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FCC92CBC-F520-A906-C002-9A6236308916}" = Catalyst Control Center Graphics Full New

"{FEC99680-66C4-C8C7-084B-2FB1B257777C}" = CCC Help Finnish

"{FEEDAB32-F937-8319-D3F1-FFFC98C2111E}" = ccc-core-static

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"AIM_6" = AIM

"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.13 (Unicode)

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"AviSynth" = AviSynth 2.5

"conduitEngine" = Conduit Engine

"Cucusoft iPhone Ringtone Maker_is1" = Cucusoft iPhone Ringtone Maker 2.45

"DivX Setup.divx.com" = DivX-Setup

"ESET Online Scanner" = ESET Online Scanner v3

"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.8

"Free YouTube Download_is1" = Free YouTube Download version 2.10.36.517

"Free YouTube to iPod Converter_is1" = Free YouTube to iPod Converter version 3.9

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.8.815

"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam

"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector

"KLiteCodecPack_is1" = K-Lite Codec Pack 4.4.5 (Standard)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.0.1800

"McAfee Security Scan" = McAfee Security Scan Plus

"Messenger Plus! Live" = Messenger Plus! Live

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Microsoft SQL Server 2005" = Microsoft SQL Server 2005

"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)

"NSS" = Norton Security Scan

"PowerROM Französisch" = PowerROM Französisch

"PROR" = Microsoft Office Professional 2007-Testversion

"SlingMedia.QPSlingPlayer_is1" = QuickPlay SlingPlayer 0.4.6

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"The Best Movie Player_is1" = The Best Movie Player 1.56

"Uninstall_is1" = Uninstall 1.0.0.1

"ViewpointMediaPlayer" = Viewpoint Media Player

"VLC media player" = VLC media player 1.0.5

"WildTangent hp Master Uninstall" = My HP Games

"WinLiveSuite_Wave3" = Windows Live Essentials

"WinRAR archiver" = WinRAR

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"UnityWebPlayer" = Unity Web Player

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 10.01.2012 09:58:47 | Computer Name = staples1-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 10.01.2012 10:01:32 | Computer Name = staples1-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

Error - 10.01.2012 19:01:34 | Computer Name = staples1-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 10.01.2012 19:04:23 | Computer Name = staples1-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

Error - 11.01.2012 01:43:53 | Computer Name = staples1-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 11.01.2012 01:45:08 | Computer Name = staples1-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

Error - 11.01.2012 11:41:47 | Computer Name = staples1-PC | Source = Application Error | ID = 1000

Description = Fehlerhafte Anwendung SaUpdate.exe, Version 0.0.0.0, Zeitstempel 0x4da8ef01,

 fehlerhaftes Modul gdiplus.dll_unloaded, Version 0.0.0.0, Zeitstempel 0x4cd536ec,

 Ausnahmecode 0xc0000005, Fehleroffset 0x743b8311,  Prozess-ID 0x16ec, Anwendungsstartzeit

 01ccd07782637285.

 

Error - 11.01.2012 12:37:40 | Computer Name = staples1-PC | Source = Application Hang | ID = 1002

Description = Programm OTL.exe, Version 3.2.31.0 arbeitet nicht mehr mit Windows

 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen

 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem

 zu suchen.  Prozess-ID: 14b4  Anfangszeit: 01ccd07ee65e8615  Zeitpunkt der Beendigung:

 24

 

Error - 11.01.2012 12:42:00 | Computer Name = staples1-PC | Source = Application Hang | ID = 1002

Description = Programm OTL.exe, Version 3.2.31.0 arbeitet nicht mehr mit Windows

 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen

 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem

 zu suchen.  Prozess-ID: 14bc  Anfangszeit: 01ccd07f5e704945  Zeitpunkt der Beendigung:

 17

 

Error - 11.01.2012 12:44:36 | Computer Name = staples1-PC | Source = Application Hang | ID = 1002

Description = Programm OTL.exe, Version 3.2.31.0 arbeitet nicht mehr mit Windows

 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen

 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem

 zu suchen.  Prozess-ID: 12c8  Anfangszeit: 01ccd07ff56686c5  Zeitpunkt der Beendigung:

 16

 

[ System Events ]

Error - 10.01.2012 19:01:41 | Computer Name = staples1-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 10.01.2012 19:03:21 | Computer Name = staples1-PC | Source = DCOM | ID = 10005

Description = 

 

Error - 10.01.2012 19:03:21 | Computer Name = staples1-PC | Source = Service Control Manager | ID = 7009

Description = 

 

Error - 10.01.2012 19:03:22 | Computer Name = staples1-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 11.01.2012 01:42:47 | Computer Name = staples1-PC | Source = HTTP | ID = 15016

Description = 

 

Error - 11.01.2012 01:43:55 | Computer Name = staples1-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 11.01.2012 12:32:05 | Computer Name = staples1-PC | Source = PlugPlayManager | ID = 12

Description = Das Gerät "JMB38X SD/MMC Host Controller" (PCI\VEN_197B&DEV_2382&SUBSYS_3600103C&REV_00\4&2c5d624a&0&0150)

 wurde ohne vorbereitende Maßnahmen vom System entfernt.

 

Error - 11.01.2012 12:32:05 | Computer Name = staples1-PC | Source = PlugPlayManager | ID = 12

Description = Das Gerät "JMB38X SD Host Controller" (PCI\VEN_197B&DEV_2381&SUBSYS_3600103C&REV_00\4&2c5d624a&0&0250)

 wurde ohne vorbereitende Maßnahmen vom System entfernt.

 

Error - 11.01.2012 12:32:05 | Computer Name = staples1-PC | Source = PlugPlayManager | ID = 12

Description = Das Gerät "JMB38X MS Host Controller" (PCI\VEN_197B&DEV_2383&SUBSYS_3600103C&REV_00\4&2c5d624a&0&0350)

 wurde ohne vorbereitende Maßnahmen vom System entfernt.

 

Error - 11.01.2012 12:32:05 | Computer Name = staples1-PC | Source = PlugPlayManager | ID = 12

Description = Das Gerät "JMB38X xD Host Controller" (PCI\VEN_197B&DEV_2384&SUBSYS_3600103C&REV_00\4&2c5d624a&0&0450)

 wurde ohne vorbereitende Maßnahmen vom System entfernt.

 

 

< End of report >

--- --- ---

Hoffe das kann iwie weiterhelfen? :)

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.arcor.de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=Pavilion&pf=cnnb

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.arcor.de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/home?G=1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found

[2010.10.18 10:47:50 | 000,002,226 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml

O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)

O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (no name) -  - No CLSID value found.

O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)

O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{abe74b8a-9cc5-11df-9849-001e68f6c48f}\Shell - "" = AutoRun

O33 - MountPoints2\{abe74b8a-9cc5-11df-9849-001e68f6c48f}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a

:Files

C:\Programme\Ask*

C:\Programme\Baby*

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Code:

 All processes killed

========== OTL ==========

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Search_URL| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\First Home Page| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully!

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\StartPageCache| /E : value set successfully!

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{51a86bb3-6602-4c85-92a5-130ee4864f13} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51a86bb3-6602-4c85-92a5-130ee4864f13}\ not found.

C:\Programme\Mozilla Firefox\searchplugins\babylon.xml moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}\ deleted successfully.

C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.

C:\Programme\ConduitEngine\ConduitEngine.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\ deleted successfully.

C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ deleted successfully.

C:\Programme\Microsoft\BingBar\BingExt.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.

C:\Programme\Ask.com\GenericAskToolbar.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}\ not found.

File C:\Programme\Windows Live\Toolbar\wltcore.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.

File C:\Programme\Windows Live\Toolbar\wltcore.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.

File C:\Programme\ConduitEngine\ConduitEngine.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f}\ deleted successfully.

File C:\Program Files\Microsoft\BingBar\BingExt.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.

File C:\Programme\Ask.com\GenericAskToolbar.dll not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.

File C:\Programme\Windows Live\Toolbar\wltcore.dll not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.

File C:\Programme\ConduitEngine\ConduitEngine.dll not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.

File C:\Programme\Ask.com\GenericAskToolbar.dll not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\autoexec.bat moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{abe74b8a-9cc5-11df-9849-001e68f6c48f}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abe74b8a-9cc5-11df-9849-001e68f6c48f}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{abe74b8a-9cc5-11df-9849-001e68f6c48f}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abe74b8a-9cc5-11df-9849-001e68f6c48f}\ not found.

File G:\LaunchU3.exe -a not found.

========== FILES ==========

File\Folder C:\Programme\Ask* not found.

File\Folder C:\Programme\Baby* not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Gast

->Temp folder emptied: 648794 bytes

->Temporary Internet Files folder emptied: 10069446 bytes

->Google Chrome cache emptied: 17136992 bytes

->Flash cache emptied: 470 bytes

 

User: Public

 

User: staples

->Temp folder emptied: 5438147674 bytes

->Temporary Internet Files folder emptied: 131936278 bytes

->Java cache emptied: 13459587 bytes

->FireFox cache emptied: 78834113 bytes

->Apple Safari cache emptied: 24010752 bytes

->Flash cache emptied: 178043 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 293949 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 140144349 bytes

RecycleBin emptied: 432419921 bytes

 

Total Files Cleaned = 5.996,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.31.0 log created on 01122012_201343
 

Files\Folders moved on Reboot...

C:\Users\staples\AppData\Local\Temp\ehmsas.txt moved successfully.
 

Registry entries deleted on Reboot...

Okay hier ist der OTL-Fix... und jetzt? :)

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Vielen Dank, der Tipp mit Laufwerk C war wirklich sehr hilfreich!! :)

Hier ist also der Log :

Code:

 22:25:57.0215 0476        TDSS rootkit removing tool 2.7.0.0 Jan 10 2012 09:14:26

22:25:57.0432 0476        ============================================================

22:25:57.0432 0476        Current date / time: 2012/01/12 22:25:57.0432

22:25:57.0432 0476        SystemInfo:

22:25:57.0432 0476        

22:25:57.0433 0476        OS Version: 6.0.6001 ServicePack: 1.0

22:25:57.0433 0476        Product type: Workstation

22:25:57.0433 0476        ComputerName: STAPLES1-PC

22:25:57.0434 0476        UserName: staples

22:25:57.0434 0476        Windows directory: C:\Windows

22:25:57.0434 0476        System windows directory: C:\Windows

22:25:57.0434 0476        Processor architecture: Intel x86

22:25:57.0434 0476        Number of processors: 2

22:25:57.0434 0476        Page size: 0x1000

22:25:57.0435 0476        Boot type: Normal boot

22:25:57.0435 0476        ============================================================

22:25:59.0355 0476        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000, SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000050

22:25:59.0598 0476        Initialize success

22:26:20.0459 5604        ============================================================

22:26:20.0459 5604        Scan started

22:26:20.0459 5604        Mode: Manual; SigCheck; TDLFS; 

22:26:20.0459 5604        ============================================================

22:26:21.0519 5604        Accelerometer   (3b10711ad8656c097e0d16a41b29c54c) C:\Windows\system32\DRIVERS\Accelerometer.sys

22:26:21.0905 5604        Accelerometer - ok

22:26:22.0038 5604        ACPI            (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys

22:26:22.0097 5604        ACPI - ok

22:26:22.0214 5604        adp94xx         (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys

22:26:22.0284 5604        adp94xx - ok

22:26:22.0362 5604        adpahci         (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys

22:26:22.0419 5604        adpahci - ok

22:26:22.0498 5604        adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys

22:26:22.0547 5604        adpu160m - ok

22:26:22.0776 5604        adpu320         (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys

22:26:22.0821 5604        adpu320 - ok

22:26:22.0993 5604        AFD             (48eb99503533c27ac6135648e5474457) C:\Windows\system32\drivers\afd.sys

22:26:23.0061 5604        AFD - ok

22:26:23.0275 5604        agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys

22:26:23.0310 5604        agp440 - ok

22:26:23.0543 5604        ahcix86s        (e331924fdf522cd7cea1b647503784e8) C:\Windows\system32\DRIVERS\ahcix86s.sys

22:26:23.0809 5604        ahcix86s - ok

22:26:24.0108 5604        aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

22:26:24.0147 5604        aic78xx - ok

22:26:24.0494 5604        aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys

22:26:24.0532 5604        aliide - ok

22:26:24.0668 5604        amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys

22:26:24.0707 5604        amdagp - ok

22:26:24.0814 5604        Amddfltr        (bafec23fc76ab781dfe9169f9b8dbebb) C:\Windows\system32\DRIVERS\Amddfltr.sys

22:26:24.0845 5604        Amddfltr - ok

22:26:24.0954 5604        amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys

22:26:24.0987 5604        amdide - ok

22:26:25.0228 5604        AmdK7           (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys

22:26:25.0330 5604        AmdK7 - ok

22:26:25.0478 5604        AmdK8           (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys

22:26:25.0582 5604        AmdK8 - ok

22:26:25.0886 5604        arc             (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys

22:26:25.0924 5604        arc - ok

22:26:25.0979 5604        arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys

22:26:26.0020 5604        arcsas - ok

22:26:26.0207 5604        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

22:26:26.0308 5604        AsyncMac - ok

22:26:26.0452 5604        atapi           (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys

22:26:26.0485 5604        atapi - ok

22:26:26.0889 5604        athr            (600efe56f37adbd65a0fb076b50d1b8d) C:\Windows\system32\DRIVERS\athr.sys

22:26:26.0982 5604        athr - ok

22:26:27.0900 5604        atikmdag        (5000e60040e45b3e72791b19e1ced1e9) C:\Windows\system32\DRIVERS\atikmdag.sys

22:26:28.0189 5604        atikmdag - ok

22:26:28.0452 5604        AtiPcie         (4aa1eb65481c392955939e735d27118b) C:\Windows\system32\DRIVERS\AtiPcie.sys

22:26:28.0491 5604        AtiPcie - ok

22:26:28.0776 5604        atksgt          (f0d933b42cd0594048e4d5200ae9e417) C:\Windows\system32\DRIVERS\atksgt.sys

22:26:28.0828 5604        atksgt - ok

22:26:28.0938 5604        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys

22:26:28.0985 5604        avgntflt - ok

22:26:29.0088 5604        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys

22:26:29.0130 5604        avipbb - ok

22:26:29.0541 5604        BCM43XV         (cf6a67c90951e3e763d2135dede44b85) C:\Windows\system32\DRIVERS\bcmwl6.sys

22:26:29.0761 5604        BCM43XV - ok

22:26:30.0000 5604        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

22:26:30.0105 5604        Beep - ok

22:26:30.0424 5604        blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys

22:26:30.0528 5604        blbdrive - ok

22:26:30.0850 5604        bowser          (8153396d5551276227fa146900f734e6) C:\Windows\system32\DRIVERS\bowser.sys

22:26:30.0899 5604        bowser - ok

22:26:30.0975 5604        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

22:26:31.0057 5604        BrFiltLo - ok

22:26:31.0254 5604        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

22:26:31.0328 5604        BrFiltUp - ok

22:26:31.0457 5604        Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

22:26:31.0651 5604        Brserid - ok

22:26:31.0957 5604        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

22:26:32.0157 5604        BrSerWdm - ok

22:26:32.0282 5604        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

22:26:32.0465 5604        BrUsbMdm - ok

22:26:32.0706 5604        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

22:26:32.0896 5604        BrUsbSer - ok

22:26:33.0116 5604        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

22:26:33.0313 5604        BTHMODEM - ok

22:26:33.0367 5604        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

22:26:33.0470 5604        cdfs - ok

22:26:33.0599 5604        cdrom           (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys

22:26:33.0701 5604        cdrom - ok

22:26:33.0813 5604        circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys

22:26:33.0917 5604        circlass - ok

22:26:34.0185 5604        CLFS            (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys

22:26:34.0243 5604        CLFS - ok

22:26:34.0465 5604        CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys

22:26:34.0567 5604        CmBatt - ok

22:26:34.0731 5604        cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys

22:26:34.0764 5604        cmdide - ok

22:26:35.0002 5604        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys

22:26:35.0035 5604        Compbatt - ok

22:26:35.0184 5604        crcdisk         (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys

22:26:35.0219 5604        crcdisk - ok

22:26:35.0479 5604        Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys

22:26:35.0581 5604        Crusoe - ok

22:26:35.0824 5604        DfsC            (a3e9fa213f443ac77c7746119d13feec) C:\Windows\system32\Drivers\dfsc.sys

22:26:35.0872 5604        DfsC - ok

22:26:36.0139 5604        disk            (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys

22:26:36.0176 5604        disk - ok

22:26:36.0265 5604        drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

22:26:36.0342 5604        drmkaud - ok

22:26:36.0675 5604        DXGKrnl         (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys

22:26:36.0793 5604        DXGKrnl - ok

22:26:36.0922 5604        E1G60           (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys

22:26:37.0029 5604        E1G60 - ok

22:26:37.0131 5604        Ecache          (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys

22:26:37.0173 5604        Ecache - ok

22:26:37.0426 5604        elxstor         (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys

22:26:37.0486 5604        elxstor - ok

22:26:37.0687 5604        enecir          (4cd6b056c5fd9e97c06fe74c81479517) C:\Windows\system32\DRIVERS\enecir.sys

22:26:37.0739 5604        enecir - ok

22:26:37.0856 5604        ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys

22:26:37.0957 5604        ErrDev - ok

22:26:38.0170 5604        exfat           (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys

22:26:38.0278 5604        exfat - ok

22:26:38.0557 5604        fastfat         (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys

22:26:38.0666 5604        fastfat - ok

22:26:38.0987 5604        fdc             (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys

22:26:39.0088 5604        fdc - ok

22:26:39.0167 5604        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

22:26:39.0203 5604        FileInfo - ok

22:26:39.0379 5604        Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

22:26:39.0482 5604        Filetrace - ok

22:26:39.0846 5604        flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys

22:26:39.0947 5604        flpydisk - ok

22:26:40.0275 5604        FltMgr          (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys

22:26:40.0319 5604        FltMgr - ok

22:26:40.0494 5604        fssfltr         (b74b0578fd1d3f897e95f2a2b69ea051) C:\Windows\system32\DRIVERS\fssfltr.sys

22:26:40.0535 5604        fssfltr - ok

22:26:40.0778 5604        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

22:26:40.0859 5604        Fs_Rec - ok

22:26:41.0198 5604        gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys

22:26:41.0233 5604        gagp30kx - ok

22:26:41.0363 5604        GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

22:26:41.0390 5604        GEARAspiWDM - ok

22:26:41.0527 5604        ggflt           (007aea2e06e7cef7372e40c277163959) C:\Windows\system32\DRIVERS\ggflt.sys

22:26:41.0557 5604        ggflt - ok

22:26:41.0668 5604        ggsemc          (c73de35960ca75c5ab4ae636b127c64e) C:\Windows\system32\DRIVERS\ggsemc.sys

22:26:41.0703 5604        ggsemc - ok

22:26:41.0964 5604        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys

22:26:42.0163 5604        HdAudAddService - ok

22:26:42.0347 5604        HDAudBus        (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys

22:26:42.0453 5604        HDAudBus - ok

22:26:42.0613 5604        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

22:26:42.0809 5604        HidBth - ok

22:26:43.0133 5604        HidIr           (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys

22:26:43.0208 5604        HidIr - ok

22:26:43.0310 5604        HidUsb          (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys

22:26:43.0412 5604        HidUsb - ok

22:26:43.0633 5604        HpCISSs         (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys

22:26:43.0672 5604        HpCISSs - ok

22:26:43.0783 5604        hpdskflt        (24f3f496c18efc234777723a67a85f81) C:\Windows\system32\DRIVERS\hpdskflt.sys

22:26:43.0809 5604        hpdskflt - ok

22:26:43.0913 5604        HpqKbFiltr      (35956140e686d53bf676cf0c778880fc) C:\Windows\system32\DRIVERS\HpqKbFiltr.sys

22:26:43.0989 5604        HpqKbFiltr - ok

22:26:44.0124 5604        HpqRemHid       (115c0933b3ed51dfbec4449348c8065b) C:\Windows\system32\DRIVERS\HpqRemHid.sys

22:26:44.0183 5604        HpqRemHid - ok

22:26:44.0400 5604        HSFHWAZL        (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS

22:26:44.0512 5604        HSFHWAZL - ok

22:26:44.0866 5604        HSF_DPV         (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS

22:26:45.0030 5604        HSF_DPV - ok

22:26:45.0324 5604        HTTP            (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys

22:26:45.0404 5604        HTTP - ok

22:26:45.0481 5604        i2omp           (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys

22:26:45.0516 5604        i2omp - ok

22:26:45.0728 5604        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

22:26:45.0807 5604        i8042prt - ok

22:26:45.0868 5604        iaStorV         (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys

22:26:45.0919 5604        iaStorV - ok

22:26:46.0034 5604        iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

22:26:46.0069 5604        iirsp - ok

22:26:46.0325 5604        intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys

22:26:46.0361 5604        intelide - ok

22:26:46.0508 5604        intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys

22:26:46.0614 5604        intelppm - ok

22:26:46.0821 5604        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

22:26:46.0930 5604        IpFilterDriver - ok

22:26:47.0098 5604        IpInIp - ok

22:26:47.0341 5604        IPMIDRV         (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys

22:26:47.0443 5604        IPMIDRV - ok

22:26:47.0601 5604        IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

22:26:47.0705 5604        IPNAT - ok

22:26:47.0943 5604        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

22:26:48.0060 5604        IRENUM - ok

22:26:48.0322 5604        isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys

22:26:48.0357 5604        isapnp - ok

22:26:48.0725 5604        iScsiPrt        (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys

22:26:48.0770 5604        iScsiPrt - ok

22:26:49.0145 5604        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

22:26:49.0177 5604        iteatapi - ok

22:26:49.0436 5604        iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

22:26:49.0469 5604        iteraid - ok

22:26:49.0623 5604        JMCR            (858c550ebbd243826a2193262c1b54a3) C:\Windows\system32\DRIVERS\jmcr.sys

22:26:49.0691 5604        JMCR - ok

22:26:49.0881 5604        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

22:26:49.0926 5604        kbdclass - ok

22:26:50.0230 5604        kbdhid          (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys

22:26:50.0330 5604        kbdhid - ok

22:26:50.0781 5604        KSecDD          (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys

22:26:50.0859 5604        KSecDD - ok

22:26:51.0208 5604        lirsgt          (f8a7212d0864ef5e9185fb95e6623f4d) C:\Windows\system32\DRIVERS\lirsgt.sys

22:26:51.0239 5604        lirsgt - ok

22:26:51.0559 5604        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

22:26:51.0665 5604        lltdio - ok

22:26:51.0961 5604        LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys

22:26:52.0001 5604        LSI_FC - ok

22:26:52.0123 5604        LSI_SAS         (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys

22:26:52.0160 5604        LSI_SAS - ok

22:26:52.0287 5604        LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys

22:26:52.0325 5604        LSI_SCSI - ok

22:26:52.0701 5604        luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

22:26:52.0806 5604        luafv - ok

22:26:53.0042 5604        megasas         (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys

22:26:53.0077 5604        megasas - ok

22:26:53.0157 5604        MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys

22:26:53.0221 5604        MegaSR - ok

22:26:53.0398 5604        Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

22:26:53.0506 5604        Modem - ok

22:26:53.0591 5604        monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

22:26:53.0695 5604        monitor - ok

22:26:54.0064 5604        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

22:26:54.0099 5604        mouclass - ok

22:26:54.0375 5604        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

22:26:54.0479 5604        mouhid - ok

22:26:54.0652 5604        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

22:26:54.0687 5604        MountMgr - ok

22:26:54.0762 5604        mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys

22:26:54.0811 5604        mpio - ok

22:26:54.0895 5604        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

22:26:54.0973 5604        mpsdrv - ok

22:26:55.0109 5604        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

22:26:55.0142 5604        Mraid35x - ok

22:26:55.0313 5604        MRxDAV          (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys

22:26:55.0365 5604        MRxDAV - ok

22:26:55.0614 5604        mrxsmb          (5734a0f2be7e495f7d3ed6efd4b9f5a1) C:\Windows\system32\DRIVERS\mrxsmb.sys

22:26:55.0691 5604        mrxsmb - ok

22:26:55.0834 5604        mrxsmb10        (6b5fa5adfacac9dbbe0991f4566d7d55) C:\Windows\system32\DRIVERS\mrxsmb10.sys

22:26:55.0890 5604        mrxsmb10 - ok

22:26:55.0967 5604        mrxsmb20        (5c80d8159181c7abf1b14ba703b01e0b) C:\Windows\system32\DRIVERS\mrxsmb20.sys

22:26:56.0015 5604        mrxsmb20 - ok

22:26:56.0211 5604        msahci          (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys

22:26:56.0247 5604        msahci - ok

22:26:56.0416 5604        msdsm           (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys

22:26:56.0456 5604        msdsm - ok

22:26:56.0832 5604        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

22:26:56.0935 5604        Msfs - ok

22:26:56.0998 5604        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

22:26:57.0029 5604        msisadrv - ok

22:26:57.0201 5604        MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

22:26:57.0306 5604        MSKSSRV - ok

22:26:57.0469 5604        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

22:26:57.0577 5604        MSPCLOCK - ok

22:26:57.0932 5604        MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

22:26:58.0034 5604        MSPQM - ok

22:26:58.0382 5604        MsRPC           (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys

22:26:58.0426 5604        MsRPC - ok

22:26:58.0555 5604        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

22:26:58.0592 5604        mssmbios - ok

22:26:58.0810 5604        MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

22:26:58.0909 5604        MSTEE - ok

22:26:59.0230 5604        Mup             (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys

22:26:59.0266 5604        Mup - ok

22:26:59.0465 5604        NativeWifiP     (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys

22:26:59.0537 5604        NativeWifiP - ok

22:26:59.0753 5604        NDIS            (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys

22:26:59.0862 5604        NDIS - ok

22:27:00.0202 5604        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

22:27:00.0277 5604        NdisTapi - ok

22:27:00.0346 5604        Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

22:27:00.0463 5604        Ndisuio - ok

22:27:00.0718 5604        NdisWan         (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys

22:27:00.0828 5604        NdisWan - ok

22:27:01.0147 5604        NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

22:27:01.0225 5604        NDProxy - ok

22:27:01.0354 5604        NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

22:27:01.0462 5604        NetBIOS - ok

22:27:01.0686 5604        netbt           (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys

22:27:01.0807 5604        netbt - ok

22:27:01.0982 5604        nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

22:27:02.0015 5604        nfrd960 - ok

22:27:02.0089 5604        Npfs            (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys

22:27:02.0194 5604        Npfs - ok

22:27:02.0504 5604        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

22:27:02.0608 5604        nsiproxy - ok

22:27:03.0082 5604        Ntfs            (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys

22:27:03.0208 5604        Ntfs - ok

22:27:03.0375 5604        ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

22:27:03.0563 5604        ntrigdigi - ok

22:27:03.0915 5604        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

22:27:04.0016 5604        Null - ok

22:27:04.0164 5604        NVENETFD        (1657f3fbd9061526c14ff37e79306f98) C:\Windows\system32\DRIVERS\nvm60x32.sys

22:27:04.0383 5604        NVENETFD - ok

22:27:04.0545 5604        nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys

22:27:04.0584 5604        nvraid - ok

22:27:04.0984 5604        nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys

22:27:05.0019 5604        nvstor - ok

22:27:05.0351 5604        nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys

22:27:05.0391 5604        nv_agp - ok

22:27:05.0590 5604        NwlnkFlt - ok

22:27:05.0656 5604        NwlnkFwd - ok

22:27:05.0810 5604        ohci1394        (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys

22:27:05.0914 5604        ohci1394 - ok

22:27:06.0231 5604        Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

22:27:06.0791 5604        Parport - ok

22:27:07.0006 5604        partmgr         (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys

22:27:07.0307 5604        partmgr - ok

22:27:07.0386 5604        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

22:27:07.0609 5604        Parvdm - ok

22:27:07.0887 5604        pci             (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys

22:27:07.0929 5604        pci - ok

22:27:08.0300 5604        pciide          (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys

22:27:08.0333 5604        pciide - ok

22:27:08.0691 5604        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

22:27:08.0734 5604        pcmcia - ok

22:27:09.0012 5604        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

22:27:09.0991 5604        PEAUTH - ok

22:27:10.0356 5604        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

22:27:10.0639 5604        PptpMiniport - ok

22:27:10.0772 5604        Processor       (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\DRIVERS\processr.sys

22:27:11.0042 5604        Processor - ok

22:27:11.0194 5604        PSched          (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys

22:27:11.0320 5604        PSched - ok

22:27:11.0465 5604        ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys

22:27:11.0919 5604        ql2300 - ok

22:27:12.0134 5604        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

22:27:12.0177 5604        ql40xx - ok

22:27:12.0458 5604        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

22:27:12.0511 5604        QWAVEdrv - ok

22:27:12.0651 5604        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

22:27:12.0754 5604        RasAcd - ok

22:27:13.0098 5604        Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

22:27:13.0203 5604        Rasl2tp - ok

22:27:13.0457 5604        RasPppoe        (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys

22:27:13.0561 5604        RasPppoe - ok

22:27:13.0858 5604        RasSstp         (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys

22:27:13.0964 5604        RasSstp - ok

22:27:14.0330 5604        rdbss           (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys

22:27:14.0446 5604        rdbss - ok

22:27:14.0762 5604        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

22:27:14.0875 5604        RDPCDD - ok

22:27:15.0229 5604        rdpdr           (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys

22:27:15.0343 5604        rdpdr - ok

22:27:15.0486 5604        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

22:27:15.0587 5604        RDPENCDD - ok

22:27:15.0903 5604        RDPWD           (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys

22:27:16.0017 5604        RDPWD - ok

22:27:16.0423 5604        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

22:27:16.0545 5604        rspndr - ok

22:27:16.0865 5604        RTL8169         (7157e70a90cce49deb8885d23a073a39) C:\Windows\system32\DRIVERS\Rtlh86.sys

22:27:16.0975 5604        RTL8169 - ok

22:27:17.0305 5604        s1018bus        (1c5c2cb892553d2cf3f45a4bb323fcd6) C:\Windows\system32\DRIVERS\s1018bus.sys

22:27:17.0338 5604        s1018bus - ok

22:27:17.0474 5604        s1018mdfl       (38f5ea219593f19b6b3a1b9c169e3b61) C:\Windows\system32\DRIVERS\s1018mdfl.sys

22:27:17.0500 5604        s1018mdfl - ok

22:27:17.0574 5604        s1018mdm        (666af6b64fc7df92d3ca4819ea91631d) C:\Windows\system32\DRIVERS\s1018mdm.sys

22:27:17.0608 5604        s1018mdm - ok

22:27:18.0046 5604        s1018mgmt       (f4ceda6e2ddff2af8bd745615a7ca9c0) C:\Windows\system32\DRIVERS\s1018mgmt.sys

22:27:18.0120 5604        s1018mgmt - ok

22:27:18.0357 5604        s1018nd5        (3622d9ff2253dcbe885b10736609a4ca) C:\Windows\system32\DRIVERS\s1018nd5.sys

22:27:18.0387 5604        s1018nd5 - ok

22:27:18.0577 5604        s1018obex       (49431efda842b474531c29ffae9f5d09) C:\Windows\system32\DRIVERS\s1018obex.sys

22:27:18.0610 5604        s1018obex - ok

22:27:18.0908 5604        s1018unic       (ac6b514cb4474f4c867d7cdc9cd54f05) C:\Windows\system32\DRIVERS\s1018unic.sys

22:27:18.0942 5604        s1018unic - ok

22:27:19.0270 5604        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

22:27:19.0307 5604        sbp2port - ok

22:27:19.0541 5604        sdbus           (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys

22:27:19.0648 5604        sdbus - ok

22:27:19.0876 5604        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

22:27:20.0067 5604        secdrv - ok

22:27:20.0294 5604        Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

22:27:20.0487 5604        Serenum - ok

22:27:20.0747 5604        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

22:27:20.0937 5604        Serial - ok

22:27:21.0097 5604        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

22:27:21.0199 5604        sermouse - ok

22:27:21.0375 5604        sffdisk         (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys

22:27:21.0449 5604        sffdisk - ok

22:27:21.0586 5604        sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys

22:27:21.0688 5604        sffp_mmc - ok

22:27:21.0814 5604        sffp_sd         (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys

22:27:21.0918 5604        sffp_sd - ok

22:27:22.0063 5604        sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

22:27:22.0270 5604        sfloppy - ok

22:27:22.0430 5604        sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys

22:27:22.0466 5604        sisagp - ok

22:27:22.0598 5604        SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys

22:27:22.0637 5604        SiSRaid2 - ok

22:27:22.0769 5604        SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys

22:27:22.0806 5604        SiSRaid4 - ok

22:27:22.0916 5604        Smb             (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys

22:27:23.0036 5604        Smb - ok

22:27:23.0178 5604        spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

22:27:23.0212 5604        spldr - ok

22:27:23.0376 5604        srv             (2252aef839b1093d16761189f45af885) C:\Windows\system32\DRIVERS\srv.sys

22:27:23.0456 5604        srv - ok

22:27:23.0664 5604        srv2            (b7ff59408034119476b00a81bb53d5d1) C:\Windows\system32\DRIVERS\srv2.sys

22:27:23.0733 5604        srv2 - ok

22:27:23.0888 5604        srvnet          (2accc9b12af02030f531e6cca6f8b76e) C:\Windows\system32\DRIVERS\srvnet.sys

22:27:23.0953 5604        srvnet - ok

22:27:24.0073 5604        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys

22:27:24.0101 5604        ssmdrv - ok

22:27:24.0221 5604        STHDA           (2449940565c8590961b4b1e9402ea43e) C:\Windows\system32\DRIVERS\stwrt.sys

22:27:24.0284 5604        STHDA - ok

22:27:24.0419 5604        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

22:27:24.0452 5604        swenum - ok

22:27:24.0528 5604        Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

22:27:24.0571 5604        Symc8xx - ok

22:27:24.0612 5604        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

22:27:24.0648 5604        Sym_hi - ok

22:27:24.0723 5604        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

22:27:24.0756 5604        Sym_u3 - ok

22:27:24.0918 5604        SynTP           (bf7aa84d5af0faa0978c840e63b17dbf) C:\Windows\system32\DRIVERS\SynTP.sys

22:27:24.0960 5604        SynTP - ok

22:27:25.0255 5604        Tcpip           (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\drivers\tcpip.sys

22:27:25.0377 5604        Tcpip - ok

22:27:25.0568 5604        Tcpip6          (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\DRIVERS\tcpip.sys

22:27:25.0678 5604        Tcpip6 - ok

22:27:25.0824 5604        tcpipreg        (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys

22:27:25.0932 5604        tcpipreg - ok

22:27:26.0136 5604        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

22:27:26.0241 5604        TDPIPE - ok

22:27:26.0454 5604        TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

22:27:26.0560 5604        TDTCP - ok

22:27:26.0764 5604        tdx             (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys

22:27:26.0870 5604        tdx - ok

22:27:26.0972 5604        TermDD          (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys

22:27:27.0007 5604        TermDD - ok

22:27:27.0235 5604        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

22:27:27.0356 5604        tssecsrv - ok

22:27:27.0660 5604        tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

22:27:27.0756 5604        tunmp - ok

22:27:27.0856 5604        tunnel          (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS\tunnel.sys

22:27:27.0913 5604        tunnel - ok

22:27:28.0062 5604        uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys

22:27:28.0098 5604        uagp35 - ok

22:27:28.0202 5604        udfs            (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys

22:27:28.0315 5604        udfs - ok

22:27:28.0518 5604        uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys

22:27:28.0555 5604        uliagpkx - ok

22:27:28.0633 5604        uliahci         (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys

22:27:28.0686 5604        uliahci - ok

22:27:28.0781 5604        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

22:27:28.0820 5604        UlSata - ok

22:27:28.0980 5604        ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

22:27:29.0019 5604        ulsata2 - ok

22:27:29.0204 5604        umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

22:27:29.0307 5604        umbus - ok

22:27:29.0533 5604        USBAAPL         (d4fb6ecc60a428564ba8768b0e23c0fc) C:\Windows\system32\Drivers\usbaapl.sys

22:27:29.0590 5604        USBAAPL - ok

22:27:29.0767 5604        usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

22:27:29.0844 5604        usbccgp - ok

22:27:30.0132 5604        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

22:27:30.0329 5604        usbcir - ok

22:27:30.0633 5604        usbehci         (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys

22:27:30.0743 5604        usbehci - ok

22:27:30.0817 5604        usbhub          (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys

22:27:30.0930 5604        usbhub - ok

22:27:31.0165 5604        usbohci         (7bdb7b0e7d45ac0402d78b90789ef47c) C:\Windows\system32\DRIVERS\usbohci.sys

22:27:31.0272 5604        usbohci - ok

22:27:31.0413 5604        usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

22:27:31.0526 5604        usbprint - ok

22:27:31.0788 5604        USBSTOR         (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS

22:27:31.0897 5604        USBSTOR - ok

22:27:31.0972 5604        usbuhci         (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys

22:27:32.0050 5604        usbuhci - ok

22:27:32.0272 5604        usbvideo        (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys

22:27:32.0385 5604        usbvideo - ok

22:27:32.0492 5604        vga             (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys

22:27:32.0601 5604        vga - ok

22:27:32.0878 5604        VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

22:27:32.0982 5604        VgaSave - ok

22:27:33.0043 5604        viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys

22:27:33.0082 5604        viaagp - ok

22:27:33.0284 5604        ViaC7           (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys

22:27:33.0388 5604        ViaC7 - ok

22:27:33.0451 5604        viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys

22:27:33.0486 5604        viaide - ok

22:27:33.0623 5604        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

22:27:33.0659 5604        volmgr - ok

22:27:33.0974 5604        volmgrx         (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys

22:27:34.0029 5604        volmgrx - ok

22:27:34.0391 5604        volsnap         (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys

22:27:34.0439 5604        volsnap - ok

22:27:34.0731 5604        vsmraid         (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys

22:27:34.0773 5604        vsmraid - ok

22:27:34.0878 5604        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

22:27:35.0069 5604        WacomPen - ok

22:27:35.0197 5604        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

22:27:35.0277 5604        Wanarp - ok

22:27:35.0319 5604        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

22:27:35.0397 5604        Wanarpv6 - ok

22:27:35.0551 5604        Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys

22:27:35.0584 5604        Wd - ok

22:27:35.0958 5604        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

22:27:36.0031 5604        Wdf01000 - ok

22:27:36.0308 5604        winachsf        (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS

22:27:36.0475 5604        winachsf - ok

22:27:37.0098 5604        WmiAcpi         (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys

22:27:37.0175 5604        WmiAcpi - ok

22:27:37.0542 5604        WpdUsb          (0cec23084b51b8288099eb710224e955) C:\Windows\system32\DRIVERS\wpdusb.sys

22:27:37.0627 5604        WpdUsb - ok

22:27:38.0001 5604        ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

22:27:38.0113 5604        ws2ifsl - ok

22:27:38.0463 5604        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

22:27:38.0576 5604        WUDFRd - ok

22:27:38.0697 5604        MBR (0x1B8)     (85d751f0e41b8e520aee8c07a8da777b) \Device\Harddisk0\DR0

22:27:39.0169 5604        \Device\Harddisk0\DR0 - ok

22:27:39.0189 5604        Boot (0x1200)   (5535184864af2a4e65e6520b769992bd) \Device\Harddisk0\DR0\Partition0

22:27:39.0202 5604        \Device\Harddisk0\DR0\Partition0 - ok

22:27:39.0219 5604        Boot (0x1200)   (e82372856637cd1a10cb217f4db18466) \Device\Harddisk0\DR0\Partition1

22:27:39.0222 5604        \Device\Harddisk0\DR0\Partition1 - ok

22:27:39.0232 5604        ============================================================

22:27:39.0232 5604        Scan finished

22:27:39.0232 5604        ============================================================

22:27:39.0284 4020        Detected object count: 0

22:27:39.0284 4020        Actual detected object count: 0

Und was muss jetzt gemacht werden? :)

Zitat:

Vielen Dank, der Tipp mit Laufwerk C war wirklich sehr hilfreich!!

Ich weiß :rofl:

Nach ca. 5000 Fragen wo denn das Log zu finden sei hab ich das mal im Baustein aufgenommen, der TO muss es dann nur noch komplett lesen so wie du :daumenhoc

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

hahaha :D oh man dann hast du ja echt schon einiges über dich ergehn lassen müssen! ^^
und ja wer lesen kann ist klar im vorteil haha :D aber du hast es ja auch gut erklärt! XD

Combofix Logfile:

Code:

ComboFix 12-01-12.04 - staples 13.01.2012  10:54:37.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.3069.1888 [GMT 1:00]

ausgeführt von:: c:\users\staples\Desktop\ComboFix.exe

AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\hpeE1C8.dll

c:\users\staples\AppData\Roaming\Microsoft\Windows\Recent\httpwww.google.com.trimgresq=guzel+genckiz+resimleri&hl=tr&gbv=2&tbm=isch&tbnid=ZGUxJu-urF0XsM&imgrefurl=httpwww.loadtr.com4.URL

c:\windows\system32\drivers\etc\hosts.ics

c:\windows\unin0407.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-12-13 bis 2012-01-13  ))))))))))))))))))))))))))))))

.

.

2012-01-13 10:17 . 2012-01-13 10:17        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-01-13 09:44 . 2012-01-13 09:44        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{FD7E48FE-0D05-4F7A-9D58-DF80288A2DB5}\offreg.dll

2012-01-13 09:44 . 2011-11-21 10:47        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{FD7E48FE-0D05-4F7A-9D58-DF80288A2DB5}\mpengine.dll

2012-01-12 19:13 . 2012-01-12 19:13        --------        d-----w-        C:\_OTL

2012-01-11 15:41 . 2012-01-11 15:41        --------        d-----w-        c:\users\staples\AppData\Local\AskToolbar

2012-01-10 13:15 . 2012-01-10 13:15        --------        d-----w-        c:\program files\ESET

2012-01-10 11:46 . 2012-01-10 11:46        --------        d-----w-        c:\users\staples\AppData\Roaming\Malwarebytes

2012-01-10 11:46 . 2012-01-10 11:46        --------        d-----w-        c:\programdata\Malwarebytes

2012-01-10 11:46 . 2012-01-10 11:46        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-01-10 11:46 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-12-27 11:45 . 2012-01-09 16:04        --------        d-----w-        c:\programdata\AVAST Software

2011-12-27 11:45 . 2011-12-27 11:45        --------        d-----w-        c:\program files\AVAST Software

2011-12-26 21:33 . 2012-01-12 19:14        --------        d-----w-        c:\program files\Ask.com

2011-12-26 21:28 . 2011-12-26 21:28        --------        d-----w-        c:\users\Gast

2011-12-14 18:24 . 2011-12-14 18:24        1207568        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-15 13:29 . 2009-10-04 17:16        222080        ------w-        c:\windows\system32\MpSigStub.exe

2011-12-21 07:42 . 2012-01-11 15:19        121816        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-17 1033512]

"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-04-16 442433]

"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]

"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-05-14 468264]

"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-14 202032]

"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-11-01 554288]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-11-20 488752]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-16 1164584]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-26 421160]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f691e717\aestsrv.exe [2008-02-12 73728]

.

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

ezSharedSvc

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-02-26 12:06        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Inhalt des "geplante Tasks" Ordners

.

2012-01-10 c:\windows\Tasks\Norton Security Scan for staples.job

- c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-06-02 07:48]

.

2012-01-13 c:\windows\Tasks\User_Feed_Synchronization-{63085E01-5952-4B37-A840-C0CDB97A2D15}.job

- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]

.

2012-01-12 c:\windows\Tasks\User_Feed_Synchronization-{7CE242C4-A2C2-4962-B558-B87CF4BC257C}.job

- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

mStart Page = 

mLocal Page = 

mWindow Title = Arcor AG & Co. KG

uInternet Settings,ProxyOverride = *.local

IE: Free YouTube Download - c:\users\staples\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\staples\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\staples\AppData\Roaming\Mozilla\Firefox\Profiles\rk7opiww.default\

FF - prefs.js: browser.startup.homepage - www.msn.de

FF - prefs.js: network.proxy.type - 0

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-PowerROM Französisch - c:\windows\unin0407.exe

AddRemove-{7585478E9D9B42108671C12F8714CEFE} - c:\users\staples\Desktop\DivX\DivXConverterUninstall.exe

AddRemove-UnityWebPlayer - c:\users\staples\AppData\Local\Unity\WebPlayer\Uninstall.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-01-13 11:17

Windows 6.0.6001 Service Pack 1 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-2404174722-3493010150-628698586-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*+*`%\OpenWithList]

@Class="Shell"

.

[HKEY_USERS\S-1-5-21-2404174722-3493010150-628698586-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*Ó*Q%’%]

@Class="Shell"

@Allowed: (Read) (RestrictedCode)

.

[HKEY_USERS\S-1-5-21-2404174722-3493010150-628698586-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*Ó*Q%’%\OpenWithList]

@Class="Shell"

.

[HKEY_USERS\S-1-5-21-2404174722-3493010150-628698586-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ö*±**%\OpenWithList]

@Class="Shell"

.

[HKEY_USERS\S-1-5-21-2404174722-3493010150-628698586-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*P%µ*G*]

@Class="Shell"

@Allowed: (Read) (RestrictedCode)

.

[HKEY_USERS\S-1-5-21-2404174722-3493010150-628698586-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*P%µ*G*\OpenWithList]

@Class="Shell"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Zeit der Fertigstellung: 2012-01-13  11:23:55

ComboFix-quarantined-files.txt  2012-01-13 10:23

.

Vor Suchlauf: 15 Verzeichnis(se), 189.861.916.672 Bytes frei

Nach Suchlauf: 21 Verzeichnis(se), 190.777.044.992 Bytes frei

.

- - End Of File - - D5FC5C0423D4C000B0C3906693E1CCF3

--- --- ---

gut und muss jetzt getan werden? :)

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Okay also mit GMER hat es leider nicht geklappt! :( Hier sind dann der OSAM und der aswMBR-Log :

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 10:48:57 on 14.01.2012
 

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit

Default Browser: Mozilla Corporation Firefox 9.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"Norton Security Scan for staples.job" - "Symantec Corporation" - C:\Program Files\Norton Security Scan\Norton Security Scan\Engine\2.7.3.34\Nss.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl

"hpaccelerometercp.CPL" - "Hewlett-Packard Corporation" - C:\Windows\system32\hpaccelerometercp.CPL

"PhysX.cpl" - "NVIDIA Corporation" - C:\Windows\system32\PhysX.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLCFG32.CPL

"ProtectSmart Hard Drive Protection" - "Hewlett-Packard Corporation" - C:\Windows\system32\hpaccelerometercp.CPL

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Amd Disk Lower Filter Driver" (Amddfltr) - "Advanced Micro Devices" - C:\Windows\System32\DRIVERS\Amddfltr.sys

"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\Users\staples\AppData\Local\Temp\catchme.sys  (File not found)

"FssFltr" (fssfltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\fssfltr.sys

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\OLKFSTUB.DLL

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{7F67036B-66F1-411A-AD85-759FB9C5B0DB} "ShellViewRTF" - "XSS" - C:\Windows\System32\ShellvRTF.dll

{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll

{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.6.0_05" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_27" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab

{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} "Java Plug-in 1.6.0_27" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_27" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_27.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab

{C3F79A2B-B9B4-4A66-B012-3EE46475B072} "MessengerStatsClient Class" - "Microsoft Corporation" - C:\Windows\Downloaded Program Files\MessengerStatsPAClient.dll / hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{77BF5300-1474-4EC7-9980-D32B190E9B07} "ClsidExtension" - ? - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll  (File not found)

{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

{77BF5300-1474-4EC7-9980-D32B190E9B07} "Skype" - ? - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\staples\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"McAfee Security Scan Plus.lnk" - "McAfee, Inc." - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe  (Shortcut exists | File exists)

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"HP Health Check Scheduler" - "Hewlett-Packard" - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

"HP Software Update" - "Hewlett-Packard" - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

"hpWirelessAssistant" - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"OnScreenDisplay" - " Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe

"QlbCtrl.exe" - " Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

"QPService" - "CyberLink Corp." - "C:\Program Files\HP\QuickPlay\QPService.exe"

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

"UCam_Menu" - "CyberLink Corp." - "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Avira AntiVir WebGuard" (AntiVirWebService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

"BBUpdate" (BBUpdate) - "Microsoft Corporation" - C:\Program Files\Microsoft\BingBar\SeaPort.EXE

"Bing Bar Update Service" (BBSvc) - "Microsoft Corporation." - C:\Program Files\Microsoft\BingBar\BBSvc.EXE

"Com4QLBEx" (Com4QLBEx) - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"Easybits Shared Services for Windows" (ezSharedSvc) - "EasyBits Sofware AS" - C:\Windows\System32\ezsvc7.dll

"GameConsoleService" (GameConsoleService) - "WildTangent, Inc." - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe

"HP Health Check Service" (HP Health Check Service) - "Hewlett-Packard" - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

"hpqwmiex" (hpqwmiex) - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

"McAfee Security Scan Component Host Service" (McComponentHostService) - "McAfee, Inc." - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"QuickPlay Background Capture Service (QBCS)" (QPCapSvc) - ? - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe

"QuickPlay Task Scheduler (QTS)" (QPSched) - ? - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe

"Recovery Service for Windows" (Recovery Service for Windows) - ? - C:\Windows\SMINST\BLService.exe

"SQL Server (MSSMLBIZ)" (MSSQL$MSSMLBIZ) - "Microsoft Corporation" - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

"SQL Server Browser" (SQLBrowser) - "Microsoft Corporation" - c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

"Windows Live Family Safety-Dienst" (fsssvc) - "Microsoft Corporation" - C:\Program Files\Windows Live\Family Safety\fsssvc.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"AVSDA" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avsda.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru [/code]

Code:

 aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software

Run date: 2012-01-14 11:07:39

-----------------------------

11:07:39.830    OS Version: Windows 6.0.6001 Service Pack 1

11:07:39.832    Number of processors: 2 586 0x301

11:07:39.836    ComputerName: STAPLES1-PC  UserName: staples

11:08:33.844    Initialize success

11:09:03.454    AVAST engine defs: 12011400

11:09:17.068    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000090

11:09:17.084    Disk 0 Vendor: FUJITSU_ 1.89 Size: 305245MB BusType: 8

11:09:17.101    Disk 0 MBR read successfully

11:09:17.112    Disk 0 MBR scan

11:09:17.132    Disk 0 unknown MBR code

11:09:17.157    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       296104 MB offset 63

11:09:17.199    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS         9137 MB offset 606423040

11:09:17.231    Disk 0 scanning sectors +625135616

11:09:17.373    Disk 0 scanning C:\Windows\system32\drivers

11:09:49.260    Service scanning

11:09:56.530    Modules scanning

11:10:21.583    Disk 0 trace - called modules:

11:10:23.003    ntkrnlpa.exe CLASSPNP.SYS disk.sys hpdskflt.sys hal.dll Amddfltr.sys storport.sys ahcix86s.sys ndis.sys athr.sys tcpip.sys NETIO.SYS dxgkrnl.sys atikmdag.sys watchdog.sys nwifi.sys ndisuio.sys lltdio.sys ipnat.sys pacer.sys partmgr.sys vo??

11:10:23.034    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x861ed2f8]

11:10:23.128    3 CLASSPNP.SYS[8079b745] -> nt!IofCallDriver -> [0x861ed9f8]

11:10:23.159    5 hpdskflt.sys[8b3aff05] -> nt!IofCallDriver -> [0x861edcd0]

11:10:23.190    7 Amddfltr.sys[8b3d10b6] -> nt!IofCallDriver -> \Device\00000090[0x85f3ec90]

11:10:23.206    9 CLASSPNP.SYS[8079b745] -> nt!IofCallDriver -> [0x861ed9f8]

11:10:23.237    11 hpdskflt.sys[8b3aff05] -> nt!IofCallDriver -> [0x861edcd0]

11:10:23.268    13 Amddfltr.sys[8b3d10b6] -> nt!IofCallDriver -> \Device\00000090[0x85f3ec90]

11:10:23.284    15 CLASSPNP.SYS[8079a25e] -> nt!IofCallDriver -> \Device\00000091[0x85f3e8f0]

11:10:23.315    17 CLASSPNP.SYS[8079a25e] -> nt!IofCallDriver -> \Device\00000091[0x85f3e8f0]

11:10:23.346    19 CLASSPNP.SYS[8079a25e] -> nt!IofCallDriver -> \Device\00000091[0x85f3e8f0]

11:10:25.858    AVAST engine scan C:\Windows

11:10:52.799    AVAST engine scan C:\Windows\system32

11:17:56.042    AVAST engine scan C:\Windows\system32\drivers

11:18:32.718    AVAST engine scan C:\Users\staples

11:37:57.164    File: C:\Users\staples\Downloads\installer_Microsoft_Excel_Viewer_8_0_.exe  **INFECTED** Win32:Shutdowner-BM [Trj]

11:47:11.276    AVAST engine scan C:\ProgramData

11:54:49.370    Scan finished successfully

12:11:52.528    Disk 0 MBR has been saved successfully to "C:\Users\staples\Desktop\MBR.dat"

12:11:52.637    The log file has been saved successfully to "C:\Users\staples\Desktop\aswMBR.txt"

Hoffe es hat alles geklappt auch mit dem Überspringen der Online-Abfrage duch OSAM und so? Und wie gehts jetzt weiter? :)

Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.
Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

Ist der Fix eig schon beendet, wenn da steht Disk 0 Windows 600 MBR fixed successfully? Iwie ging das sehr schnell! :D

Du solltest neu starten und ein neues Log mit aswMBR machen

Sry, dass meine Antwort so lange gedauert hat! ^^ Aber der Scann funktioniert leider nicht!!! :( Er bricht immer an der gleichen Stelle ab und der Laptop hängt sich auf, dann kommen immer so Streifen auf den Bildschirm und es geht gar nichts mehr!! :(( Was soll ich jetzt machen? Hoffe es ist nicht schlimm! :S

Ging doch vorher immer? :confused:
Windows startet an sich aber schon normal?
Probier es im abgesicherten Modus mit Netzwerk

Jaa es ging vorher immer! :( Deswegen hat mich das auch echt verwundert! Kann es vielleicht daran liegen, dass ich vorgestern Abend denn Scann gestartet hatte und dann der Laptop ausersehen zugeklappt wurde? Aber eig kann man denn Scann doch immer wieder machen oder? Und das Anti-Virus-Programm muss doch auch ausgeschaltet werden vorher oder? Weiß auch nicht woran es liegt, dass ist echt komisch! ^^ Und Windows startet auch soweit normal und es ist eig alles wie immer! :) Okay alles klar, das werde ich jetzt mal versuchen, hoffe es klappt! :)

Oder vielleicht wurde es nicht richtig gefixt? Im abgesicherten Modus scheint der Scann zu klappen, bis jetzt läuft es gut! :)

Code:

 aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software

Run date: 2012-01-17 09:31:50

-----------------------------

09:31:50.606    OS Version: Windows 6.0.6001 Service Pack 1

09:31:50.606    Number of processors: 2 586 0x301

09:31:50.606    ComputerName: STAPLES1-PC  UserName: staples

09:31:52.354    Initialize success

09:32:02.712    AVAST engine defs: 12011600

09:32:19.373    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000090

09:32:19.373    Disk 0 Vendor: FUJITSU_ 1.89 Size: 305245MB BusType: 8

09:32:19.388    Disk 0 MBR read successfully

09:32:19.388    Disk 0 MBR scan

09:32:19.388    Disk 0 Windows VISTA default MBR code

09:32:19.404    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       296104 MB offset 63

09:32:19.435    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS         9137 MB offset 606423040

09:32:19.451    Disk 0 scanning sectors +625135616

09:32:19.498    Disk 0 scanning C:\Windows\system32\drivers

09:32:30.418    Service scanning

09:32:32.960    Modules scanning

09:32:37.219    Disk 0 trace - called modules:

09:32:37.250    ntkrnlpa.exe CLASSPNP.SYS disk.sys hpdskflt.sys hal.dll Amddfltr.sys storport.sys ahcix86s.sys 

09:32:37.781    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85c21ac8]

09:32:37.796    3 CLASSPNP.SYS[8279a745] -> nt!IofCallDriver -> [0x85c21020]

09:32:37.828    5 hpdskflt.sys[8b5a4f05] -> nt!IofCallDriver -> [0x864ec620]

09:32:37.843    7 Amddfltr.sys[8b5c60b6] -> nt!IofCallDriver -> \Device\00000090[0x85c17498]

09:32:39.294    AVAST engine scan C:\Windows

09:32:44.582    AVAST engine scan C:\Windows\system32

09:35:17.884    AVAST engine scan C:\Windows\system32\drivers

09:35:36.011    AVAST engine scan C:\Users\staples

09:44:40.591    File: C:\Users\staples\Downloads\installer_Microsoft_Excel_Viewer_8_0_.exe  **INFECTED** Win32:Shutdowner-BM [Trj]

09:50:16.506    AVAST engine scan C:\ProgramData

09:54:24.265    Scan finished successfully

09:55:34.699    Disk 0 MBR has been saved successfully to "C:\Users\staples\Desktop\MBR.dat"

09:55:34.746    The log file has been saved successfully to "C:\Users\staples\Desktop\aswMBR.txt"

Soo.. hoffe da kann man iwas machen? :)

Zitat:

File: C:\Users\staples\Downloads\installer_Microsoft_Excel_Viewer_8_0_.exe **INFECTED** Win32:Shutdowner-BM [Trj]

Also der MBR ist ok, aber das hier ist merkwürdig :wtf:
Hast du das Teil erst eben runtergeladen oder hab ich es vorher übersehen oder sieht aswMBR das jetzt erst? :confused:

oh wo kommt das denn her? XD also den microsoft excel viewer hab ich auf jeden fall nicht in letzter zeit heruntergeladen weiß auch nicht, ob das erst jetzt bemerkt wurde oder vorher schon da war!^^ ah hab eben nachgeguckt und es war im letzten scann auch schon drinn! aber wird das nicht durch den fix eig weggemacht? und was mussjetzt getan werden? :)

Das kann auch ein Fehlalarm sein. Wenn du den nicht brauchst weg damit

Okay ich habs gelöscht! :) Soll ich jetzt nochmal einen Scann machen?

Ja mach mal bitte :)

Ah der Scann funktioniert immer noch nicht, er bricht wieder ab beim letzten Mal! :( Soll ich's wieder im abgesicherten Modus machen? :S

Ja wirst do wohl müssen :D

okaay! :D hatte es schon vorsorglich gemacht! :) hier ist er :

Code:

 aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software

Run date: 2012-01-18 17:01:40

-----------------------------

17:01:40.892    OS Version: Windows 6.0.6001 Service Pack 1

17:01:40.892    Number of processors: 2 586 0x301

17:01:40.907    ComputerName: STAPLES1-PC  UserName: staples

17:01:42.327    Initialize success

17:01:54.183    AVAST engine defs: 12011800

17:01:56.258    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000090

17:01:56.258    Disk 0 Vendor: FUJITSU_ 1.89 Size: 305245MB BusType: 8

17:01:56.273    Disk 0 MBR read successfully

17:01:56.273    Disk 0 MBR scan

17:01:56.289    Disk 0 Windows VISTA default MBR code

17:01:56.289    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       296104 MB offset 63

17:01:56.336    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS         9137 MB offset 606423040

17:01:56.351    Disk 0 scanning sectors +625135616

17:01:56.414    Disk 0 scanning C:\Windows\system32\drivers

17:02:08.550    Service scanning

17:02:11.452    Modules scanning

17:02:15.898    Disk 0 trace - called modules:

17:02:15.914    ntkrnlpa.exe CLASSPNP.SYS disk.sys hpdskflt.sys hal.dll Amddfltr.sys storport.sys ahcix86s.sys usbhub.sys ndis.sys athr.sys tcpip.sys NETIO.SYS 

17:02:16.428    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85c25030]

17:02:16.428    3 CLASSPNP.SYS[807a8745] -> nt!IofCallDriver -> [0x864ea3a0]

17:02:16.444    5 hpdskflt.sys[8b3aff05] -> nt!IofCallDriver -> [0x864ea860]

17:02:16.444    7 Amddfltr.sys[8b3d10b6] -> nt!IofCallDriver -> \Device\00000090[0x85f3f848]

17:02:18.347    AVAST engine scan C:\Windows

17:02:24.572    AVAST engine scan C:\Windows\system32

17:05:37.684    AVAST engine scan C:\Windows\system32\drivers

17:06:03.174    AVAST engine scan C:\Users\staples

17:23:15.801    AVAST engine scan C:\ProgramData

17:28:13.730    Scan finished successfully

17:28:48.627    Disk 0 MBR has been saved successfully to "C:\Users\staples\Desktop\MBR.dat"

17:28:48.674    The log file has been saved successfully to "C:\Users\staples\Desktop\aswMBR.txt"

und wie geht es jetzt weiter? :)

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

okay der malwarebytes-scann ist gemacht und der superantispy läuft! :) aber da steht jetzt schon was von 107 erkannte bedrohungen! o.O

Code:

 Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2012.01.18.04
 

Windows Vista Service Pack 1 x86 NTFS

Internet Explorer 7.0.6001.18000

staples :: STAPLES1-PC [limitiert]
 

18.01.2012 20:22:01

mbam-log-2012-01-18 (20-22-01).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 403273

Laufzeit: 2 Stunde(n), 34 Minute(n), 50 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

 SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 01/19/2012 at 12:29 PM
 

Application Version : 5.0.1142
 

Core Rules Database Version : 8144

Trace Rules Database Version: 5956
 

Scan type       : Complete Scan

Total Scan Time : 04:00:53
 

Operating System Information

Windows Vista Home Premium 32-bit, Service Pack 1 (Build 6.00.6001)

UAC On - Administrator
 

Memory items scanned      : 831

Memory threats detected   : 0

Registry items scanned    : 38999

Registry threats detected : 0

File items scanned        : 107222

File threats detected     : 181
 

Adware.Tracking Cookie

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@ad.adition[1].txt [ /ad.adition ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@ad.adnet[2].txt [ /ad.adnet ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@ad.reklamport[2].txt [ /ad.reklamport ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@ad.yieldmanager[2].txt [ /ad.yieldmanager ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@ad.zanox[1].txt [ /ad.zanox ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@ad1.adfarm1.adition[1].txt [ /ad1.adfarm1.adition ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@ad2.adfarm1.adition[1].txt [ /ad2.adfarm1.adition ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@ad3.adfarm1.adition[1].txt [ /ad3.adfarm1.adition ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@adcentriconline[2].txt [ /adcentriconline ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@adfarm1.adition[1].txt [ /adfarm1.adition ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@ads.creative-serving[1].txt [ /ads.creative-serving ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@ads.medienhaus[1].txt [ /ads.medienhaus ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@adtech[1].txt [ /adtech ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@adx.chip[2].txt [ /adx.chip ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@apmebf[1].txt [ /apmebf ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@atdmt.combing[2].txt [ /atdmt.combing ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@atdmt[2].txt [ /atdmt ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@bs.serving-sys[1].txt [ /bs.serving-sys ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@bs.serving-sys[2].txt [ /bs.serving-sys ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@bs.serving-sys[3].txt [ /bs.serving-sys ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@collective-media[1].txt [ /collective-media ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@content.yieldmanager[2].txt [ /content.yieldmanager ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@content.yieldmanager[3].txt [ /content.yieldmanager ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@doubleclick[1].txt [ /doubleclick ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@eas.apm.emediate[1].txt [ /eas.apm.emediate ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@ehg-systemax.hitbox[2].txt [ /ehg-systemax.hitbox ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@fastclick[1].txt [ /fastclick ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@hitbox[2].txt [ /hitbox ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@im.banner.t-online[2].txt [ /im.banner.t-online ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@imrworldwide[2].txt [ /imrworldwide ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@mediaplex[2].txt [ /mediaplex ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@microsoftwllivemkt.112.2o7[1].txt [ /microsoftwllivemkt.112.2o7 ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@msnportal.112.2o7[1].txt [ /msnportal.112.2o7 ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@pointroll[1].txt [ /pointroll ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@questionmarket[1].txt [ /questionmarket ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@revsci[2].txt [ /revsci ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@serving-sys[1].txt [ /serving-sys ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@serving-sys[2].txt [ /serving-sys ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@smartadserver[1].txt [ /smartadserver ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@tracking.hannoversche[2].txt [ /tracking.hannoversche ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@tracking.mindshare[2].txt [ /tracking.mindshare ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@tracking.quisma[2].txt [ /tracking.quisma ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@tradedoubler[2].txt [ /tradedoubler ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@traffictrack[2].txt [ /traffictrack ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@unitymedia[2].txt [ /unitymedia ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@vdwp.solution.weborama[2].txt [ /vdwp.solution.weborama ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@webmasterplan[2].txt [ /webmasterplan ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@weborama[1].txt [ /weborama ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@www.active-tracking[2].txt [ /www.active-tracking ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@zanox-affiliate[1].txt [ /zanox-affiliate ]

        C:\Users\staples\AppData\Roaming\Microsoft\Windows\Cookies\staples@zanox[1].txt [ /zanox ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\Low\gast@invitemedia[1].txt [ Cookie:gast@invitemedia.com/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\Low\gast@adx.chip[1].txt [ Cookie:gast@adx.chip.de/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\Low\gast@adfarm1.adition[2].txt [ Cookie:gast@adfarm1.adition.com/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\Low\gast@doubleclick[2].txt [ Cookie:gast@doubleclick.net/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\Low\gast@ad.yieldmanager[2].txt [ Cookie:gast@ad.yieldmanager.com/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\Low\gast@smartadserver[1].txt [ Cookie:gast@smartadserver.com/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\Low\gast@apmebf[1].txt [ Cookie:gast@apmebf.com/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\Low\gast@ww251.smartadserver[1].txt [ Cookie:gast@ww251.smartadserver.com/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\Low\gast@ad3.adfarm1.adition[1].txt [ Cookie:gast@ad3.adfarm1.adition.com/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@adform[1].txt [ Cookie:staples@adform.net/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@serving-sys[1].txt [ Cookie:staples@serving-sys.com/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@adfarm1.adition[1].txt [ Cookie:staples@adfarm1.adition.com/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@zanox[1].txt [ Cookie:staples@zanox.com/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@tracking.mlsat02[1].txt [ Cookie:staples@tracking.mlsat02.de/tmobile/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@ad.zanox[1].txt [ Cookie:staples@ad.zanox.com/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@traffictrack[1].txt [ Cookie:staples@traffictrack.de/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@track.adform[2].txt [ Cookie:staples@track.adform.net/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@statse.webtrendslive[2].txt [ Cookie:staples@statse.webtrendslive.com/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@doubleclick[1].txt [ Cookie:staples@doubleclick.net/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@vodafonegroup.122.2o7[1].txt [ Cookie:staples@vodafonegroup.122.2o7.net/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@ad.dyntracker[1].txt [ Cookie:staples@ad.dyntracker.com/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@mediaplex[1].txt [ Cookie:staples@mediaplex.com/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@adx.chip[1].txt [ Cookie:staples@adx.chip.de/ ]

        C:\USERS\STAPLES\AppData\Roaming\Microsoft\Windows\Cookies\Low\staples@webmasterplan[1].txt [ Cookie:staples@webmasterplan.com/ ]

        C:\USERS\STAPLES\Cookies\staples@serving-sys[1].txt [ Cookie:staples@serving-sys.com/ ]

        C:\USERS\STAPLES\Cookies\staples@collective-media[1].txt [ Cookie:staples@collective-media.net/ ]

        C:\USERS\STAPLES\Cookies\staples@adfarm1.adition[1].txt [ Cookie:staples@adfarm1.adition.com/ ]

        C:\USERS\STAPLES\Cookies\staples@hitbox[2].txt [ Cookie:staples@hitbox.com/ ]

        C:\USERS\STAPLES\Cookies\staples@eas.apm.emediate[1].txt [ Cookie:staples@eas.apm.emediate.eu/ ]

        C:\USERS\STAPLES\Cookies\staples@smartadserver[1].txt [ Cookie:staples@smartadserver.com/ ]

        C:\USERS\STAPLES\Cookies\staples@ad2.adfarm1.adition[1].txt [ Cookie:staples@ad2.adfarm1.adition.com/ ]

        C:\USERS\STAPLES\Cookies\staples@ad.adition[1].txt [ Cookie:staples@ad.adition.net/ ]

        C:\USERS\STAPLES\Cookies\staples@tracking.mindshare[2].txt [ Cookie:staples@tracking.mindshare.de/ ]

        C:\USERS\STAPLES\Cookies\staples@zanox[1].txt [ Cookie:staples@zanox.com/ ]

        C:\USERS\STAPLES\Cookies\staples@atdmt.combing[2].txt [ Cookie:staples@atdmt.combing.com/ ]

        C:\USERS\STAPLES\Cookies\staples@imrworldwide[2].txt [ Cookie:staples@imrworldwide.com/cgi-bin ]

        C:\USERS\STAPLES\Cookies\staples@vdwp.solution.weborama[2].txt [ Cookie:staples@vdwp.solution.weborama.fr/ ]

        C:\USERS\STAPLES\Cookies\staples@ad.zanox[1].txt [ Cookie:staples@ad.zanox.com/ ]

        C:\USERS\STAPLES\Cookies\staples@traffictrack[2].txt [ Cookie:staples@traffictrack.de/ ]

        C:\USERS\STAPLES\Cookies\staples@content.yieldmanager[2].txt [ Cookie:staples@content.yieldmanager.com/ ]

        C:\USERS\STAPLES\Cookies\staples@doubleclick[1].txt [ Cookie:staples@doubleclick.net/ ]

        C:\USERS\STAPLES\Cookies\staples@revsci[2].txt [ Cookie:staples@revsci.net/ ]

        C:\USERS\STAPLES\Cookies\staples@ad3.adfarm1.adition[1].txt [ Cookie:staples@ad3.adfarm1.adition.com/ ]

        C:\USERS\STAPLES\Cookies\staples@microsoftwllivemkt.112.2o7[1].txt [ Cookie:staples@microsoftwllivemkt.112.2o7.net/ ]

        C:\USERS\STAPLES\Cookies\staples@weborama[1].txt [ Cookie:staples@weborama.fr/ ]

        C:\USERS\STAPLES\Cookies\staples@msnportal.112.2o7[1].txt [ Cookie:staples@msnportal.112.2o7.net/ ]

        C:\USERS\STAPLES\Cookies\staples@fastclick[1].txt [ Cookie:staples@fastclick.net/ ]

        C:\USERS\STAPLES\Cookies\staples@mediaplex[2].txt [ Cookie:staples@mediaplex.com/ ]

        C:\USERS\STAPLES\Cookies\staples@questionmarket[1].txt [ Cookie:staples@questionmarket.com/ ]

        C:\USERS\STAPLES\Cookies\staples@adx.chip[2].txt [ Cookie:staples@adx.chip.de/ ]

        C:\USERS\STAPLES\Cookies\staples@unitymedia[2].txt [ Cookie:staples@unitymedia.de/ ]

        C:\USERS\STAPLES\Cookies\staples@ehg-systemax.hitbox[2].txt [ Cookie:staples@ehg-systemax.hitbox.com/ ]

        C:\USERS\STAPLES\Cookies\staples@im.banner.t-online[2].txt [ Cookie:staples@im.banner.t-online.de/ ]

        C:\USERS\STAPLES\Cookies\staples@ad.adnet[2].txt [ Cookie:staples@ad.adnet.de/ ]

        C:\USERS\STAPLES\Cookies\staples@www.active-tracking[2].txt [ Cookie:staples@www.active-tracking.de/ ]

        C:\USERS\STAPLES\Cookies\staples@webmasterplan[2].txt [ Cookie:staples@webmasterplan.com/ ]

        .doubleclick.net [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .zanox.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .atdmt.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .atdmt.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        de.sitestat.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.googleadservices.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .imrworldwide.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .imrworldwide.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad2.adfarm1.adition.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tracking.quisma.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tracking.quisma.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.zanox.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tracking.quisma.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\GAST\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        C:\USERS\GAST\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GAST@ATDMT[2].TXT [ /ATDMT ]

        C:\USERS\STAPLES\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\STAPLES@ZANOX-AFFILIATE[1].TXT [ /ZANOX-AFFILIATE ]

        .apmebf.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .statse.webtrendslive.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .vodafonegroup.122.2o7.net [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .msnportal.112.2o7.net [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .specificclick.net [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .lucidmedia.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        imagesrv.adition.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\STAPLES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RK7OPIWW.DEFAULT\COOKIES.SQLITE ]
 

Trojan.Agent/Gen-Autoit

        C:\PROGRAM FILES\SONY ERICSSON\SONY ERICSSON PC SUITE\PC SUITE LOG.EXE

ESET kommt noch? SASW hat nur Cookies und einen Fehlalarm

jaa ESET kommt noch! :) es läuft schon seit 5 stunden! U__U okaay da bin ich ja beruhigt! :) soll und kann man diese cookies eig iwo abstellen?

Code:

 ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

esets_scanner_update returned -1 esets_gle=53251

ESETSmartInstaller@High as downloader log:

all ok

esets_scanner_update returned -1 esets_gle=53251

ESETSmartInstaller@High as downloader log:

all okWelche Vorteile bietet ein Antiblockiersystem (ABS)?

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=dea761c9f506bf48aca4e33ae9a137a3

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-01-11 01:31:33

# local_time=2012-01-11 02:31:33 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6001 NT Service Pack 1

# compatibility_mode=1797 16775165 100 94 750694 62794342 1317347 0

# compatibility_mode=5892 16776637 100 100 4172 163793849 0 0

# compatibility_mode=8192 67108863 100 0 63401 63401 0 0

# scanned=219840

# found=3

# cleaned=0

# scan_time=27624

C:\Program Files\VideoConverter\VideoConverter.exe        a variant of Win32/InstallCore.A application (unable to clean)        00000000000000000000000000000000        I

C:\Users\staples\AppData\Local\Temp\is799009782\MyBabylonTB.exe        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Users\staples\Downloads\installer_Microsoft_Excel_Viewer_8_0_.exe        Win32/Toggle application (unable to clean)        00000000000000000000000000000000        I

ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=dea761c9f506bf48aca4e33ae9a137a3

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-01-19 06:52:49

# local_time=2012-01-19 07:52:49 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6001 NT Service Pack 1

# compatibility_mode=1797 16775165 100 94 312408 63508446 348480 0

# compatibility_mode=5892 16776637 100 100 22240 164507953 0 0

# compatibility_mode=8192 67108863 100 0 777505 777505 0 0

# scanned=209006

# found=8

# cleaned=0

# scan_time=23988

C:\Program Files\VideoConverter\VideoConverter.exe        a variant of Win32/InstallCore.A application (unable to clean)        00000000000000000000000000000000        I

C:\Program Files\Windows iLivid Toolbar\Datamngr\BrowserConnection.dll        Win32/Toolbar.SearchSuite application (unable to clean)        00000000000000000000000000000000        I

C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngr.dll        a variant of Win32/Toolbar.SearchSuite application (unable to clean)        00000000000000000000000000000000        I

C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe        a variant of Win32/Toolbar.SearchSuite application (unable to clean)        00000000000000000000000000000000        I

C:\Program Files\Windows iLivid Toolbar\Datamngr\DnsBHO.dll        a variant of Win32/Toolbar.SearchSuite application (unable to clean)        00000000000000000000000000000000        I

C:\Program Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll        a variant of Win32/Toolbar.SearchSuite application (unable to clean)        00000000000000000000000000000000        I

C:\Users\staples\AppData\Local\Temp\SetupDataMngr_Searchqu.exe        a variant of Win32/Toolbar.SearchSuite application (unable to clean)        00000000000000000000000000000000        I

${Memory}        a variant of Win32/Toolbar.SearchSuite application        00000000000000000000000000000000        I

und wie siehts aus? :)

Ein Fehlalarm und schrottige Toolbar Reste. Entfernen wir den Müll auch noch:

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":Files" muss mitkopiert werden!!!)

Code:

:Files

C:\Program Files\Windows iLivid Toolbar

C:\Users\staples\AppData\Local\Temp\SetupDataMngr_Searchqu.exe

:Commands

[emptytemp]

[resethosts]

haha jaa entfernen wir denn müll! :D hoffe es hat funktioniert? :)

Code:

 All processes killed

========== FILES ==========

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\components folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\searchbar folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\options folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton\panels folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton\icons folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\uwa folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\radio\images folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\radio\css folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\radio folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\images folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default\scripts folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default\images folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default\css folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\css folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.PPCBully folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\modules folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\lib folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\data\search folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\data folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\FirefoxExtension\content folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\FirefoxExtension\components folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr\FirefoxExtension folder moved successfully.

C:\Program Files\Windows iLivid Toolbar\Datamngr folder moved successfully.

C:\Program Files\Windows iLivid Toolbar folder moved successfully.

C:\Users\staples\AppData\Local\Temp\SetupDataMngr_Searchqu.exe moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Gast

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Public

->Temp folder emptied: 0 bytes

 

User: staples

->Temp folder emptied: 70379285 bytes

->Temporary Internet Files folder emptied: 152577408 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 44099875 bytes

->Apple Safari cache emptied: 0 bytes

->Flash cache emptied: 689 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 7292 bytes

RecycleBin emptied: 1093632 bytes

 

Total Files Cleaned = 256,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.31.0 log created on 01212012_095237
 

Files\Folders moved on Reboot...

C:\Users\staples\AppData\Local\Temp\ehmsas.txt moved successfully.
 

Registry entries deleted on Reboot...

Ok.
Ist dein System nun wieder in Ordnung oder gibts noch andere Funde oder Probleme?

Also soweit ich das sehe müsste eig alles in Ordnung sein, danke!! :) Muss jetzt noch iwie was gemacht werden?

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.