Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Windows teilweise ohne Funktion, Rouge.FakeHDD, PUM.Hijack.StartMenu (https://www.trojaner-board.de/111880-windows-teilweise-ohne-funktion-rouge-fakehdd-pum-hijack-startmenu.html)

lowi 19.03.2012 19:03
Windows teilweise ohne Funktion, Rouge.FakeHDD, PUM.Hijack.StartMenu
 
Guten Tag,
Habe heute beim Hochfahren meines Win7 Pro 32Bit einige Fehlermeldungen bekommen (So Meldungen wie Windows Delayed no access).
Zu guter letzt ging ein Fester auf das mich darauf hinwies das mein rechner (Disk, Ram, BootSector uvm.) Critical sei und ich die RepairPC Software kaufen solle.
Habe meherer male mit Malwarebytes (freie Version) das Systemüberprüft und bin nun dieses Programm(anscheinend) losgeworden. Hochfahren funktioniert und Internetzugriff ist auch OK.
Hatte den Avira drauf... Habe jetzt MSE
Im System sind ziemlich alle Dateien plötzlich ausgeblendet und es existiert plötzlich ein Ordner kees.SOEST im Users Ordner von Windows.
Im Startmenu sind zwar Ordner von Programmen zu sehen, jedoch sonst ist
alles weg (Dokumente, SysSteuerung, Drucker) nurnoch der Computer und die zwei drei Windows Progs, auch der Ordner zubehör ist weg, bei einem Rechtsklick auf Computer und dann Verwalten kommt die Fehlermeldung dass dieser link weg ist.

Habe mir die Rules durchgelesen und mal die Scans/Logs angehängt.
Hoffe ihr könnt mir helfen mein Windows zu reparieren...

[EDIT] Habe dieses Thema im Forum gefunden klingt wie mein Problem:
http://www.trojaner-board.de/111646-...k-problem.html
[/EDIT]

Erster Scan
Code:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8289

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

19.03.2012 10:38:14
mbam-log-2012-03-19 (10-38-14).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 173066
Laufzeit: 6 Minute(n), 58 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
2ter Scan
Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.19.02

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
KFZ-Hummel :: KFZ-HUMMEL-PC [Administrator]

19.03.2012 13:01:43
mbam-log-2012-03-19 (13-01-43).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 194046
Laufzeit: 9 Minute(n), 9 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\ProgramData\ldmtqETJLYi.exe (Rogue.FakeHDD) -> 3112 -> Löschen bei Neustart.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ldmtqETJLYi.exe (Rogue.FakeHDD) -> Daten: C:\ProgramData\ldmtqETJLYi.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\ProgramData\ldmtqETJLYi.exe (Rogue.FakeHDD) -> Löschen bei Neustart.
C:\Users\KFZ-Hummel\AppData\Local\Temp\MoloEMcYWxtYwj.exe.tmp (Rogue.FakeHDD) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
3ter Scan
Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.19.02

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
KFZ-Hummel :: KFZ-HUMMEL-PC [Administrator]

19.03.2012 15:02:57
mbam-log-2012-03-19 (15-02-57).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 194036
Laufzeit: 5 Minute(n), 39 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
DDS Log

Code:
.DDS Logfile:
DDS Logfile:

       
Code:

       
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.7601.17514  BrowserJavaVersion: 1.6.0_23
Run by KFZ-Hummel at 17:24:51 on 2012-03-19
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.2815.1911 [GMT 1:00]
.
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\Windows\system32\crypserv.exe
c:\ElsaWin\bin\LcSvrAdm.exe
c:\ElsaWin\bin\LcSvrDba.exe
c:\ElsaWin\bin\LcSvrHis.exe
c:\ElsaWin\bin\LcSvrPas.exe
c:\ElsaWin\bin\LcSvrSaz.exe
C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
C:\Program Files\PTBSync\PTBSync.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
D:\Program Files\SelectDoc\TBDBMS\tbmux32.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
c:\ElsaWin\bin\VSgate.exe
C:\PROGRA~1\ATRIS_~1\WORKSH~1.EXE
C:\Program Files\ATRis_Technik\jre\bin\java.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\system32\conhost.exe
C:\Program Files\ATRis_Technik\sed.exe
C:\Windows\system32\SearchIndexer.exe
c:\ElsaWin\bin\LcSvrAuf.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [AshSnap] c:\program files\ashampoo snap 3\ashsnap.exe
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [Firefox] c:\program files\mozilla firefox\firefox.exe
mRun: [PTBSync] c:\program files\ptbsync\PTBSync.exe /Start
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes anti-malware\mbam.exe" /runcleanupscript
mRun: [SedServer] "c:\program files\atris_technik\Sed.exe" server
StartupFolder: c:\users\kfz-hu~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\atriss~1.lnk - c:\atris_st\katcd\atris_st.exe
StartupFolder: c:\users\kfz-hu~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\netzma~1.lnk - c:\program files\netzmanager\netzmanager.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\micros~2\office14\EXCEL.EXE/3000
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{5D2DFF26-E8B0-43F6-9665-F5401428B568} : DhcpNameServer = 192.168.2.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - c:\elsawin\bin\wiprot.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\kfz-hummel\appdata\roaming\mozilla\firefox\profiles\p35xhquj.default\
FF - plugin: c:\progra~1\micros~2\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\micros~2\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
============= SERVICES / DRIVERS ===============
.
R2 LcSvrAdm;ELSA Administration Service;c:\elsawin\bin\LcSvrAdm.exe [2010-6-6 147456]
R2 LcSvrDba;ELSA DBA Server;c:\elsawin\bin\LcSvrDba.exe [2010-6-6 241664]
R2 LcSvrHis;ELSA Historie Server;c:\elsawin\bin\LcSvrHis.exe [2010-6-6 217088]
R2 LcSvrPAS;ELSA PASS Server;c:\elsawin\bin\LcSvrPas.exe [2010-6-6 368640]
R2 LcSvrSaz;ELSA APOSpro Server;c:\elsawin\bin\LcSvrSaz.exe [2010-6-6 258048]
R2 Netzmanager Service;Netzmanager Infrastruktur Informationssystem Dienst;c:\program files\netzmanager\nminfrais2\Netzmanager_Service.exe [2011-10-24 2565632]
R2 NSHE;Guardant Emulator Driver;c:\windows\system32\drivers\NSHE.SYS [2010-6-5 97792]
R2 SelectDoc DB;SelectDoc DB;d:\program files\selectdoc\tbdbms\tbmux32.exe [2011-11-25 401408]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2010\TuneUpUtilitiesService32.exe [2009-10-30 1021256]
R2 VSGate;ELSA Vaudis Service;c:\elsawin\bin\VSGate.exe [2010-6-6 81920]
R2 WinRing0_1_2_0;WinRing0 driver;c:\windows\system32\drivers\ptbring0.sys [2010-6-5 14416]
R2 WorkshopDBService;WorkshopDBService;c:\progra~1\atris_~1\worksh~1.exe -zglaxservice workshopdbservice --> c:\progra~1\atris_~1\WORKSH~1.EXE -zglaxservice WorkshopDBService [?]
R3 AVMCOWAN;AVM ISDN CoNDIS WAN CAPI Driver;c:\windows\system32\drivers\avmcowan.sys [2009-7-13 64000]
R3 FPCIBASE;AVM FRITZ!Card PCI;c:\windows\system32\drivers\fpcibase.sys [2009-7-13 559104]
R3 LcSvrAuf;ELSA Auftragsverwaltungs Service;c:\elsawin\bin\LcSvrAuf.exe [2010-6-6 1306624]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-6-6 136176]
S2 KMService;KMService;c:\windows\system32\srvany.exe [2010-11-11 8192]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-6-6 136176]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
S3 RTLWUSB;802.11g USB2.0 WLAN Dongle;c:\windows\system32\drivers\RTL8187.sys [2010-6-5 169472]
S3 StorSvc;Speicherdienst;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]
S3 TelekomNM3;Telekom Netzmanager Packet Filter Driver;c:\program files\netzmanager\nminfrais2\driver\TelekomNM3.sys [2010-9-16 35040]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2012-1-9 52224]
.
=============== Created Last 30 ================
.
2012-03-19 13:52:26        --------        d-sh--w-        c:\windows\system32\%APPDATA%
2012-03-19 08:20:37        352256        ---ha-w-        c:\programdata\z1dYe2Bc1FTAcm.exe
2012-03-16 08:03:54        6552120        ----a-w-        c:\programdata\microsoft\windows defender\definition updates\{ba1efb29-13c2-4a82-bf6f-088ff9978827}\mpengine.dll
2012-03-15 08:07:15        2343424        ----a-w-        c:\windows\system32\win32k.sys
2012-03-15 08:07:14        1077248        ----a-w-        c:\windows\system32\DWrite.dll
2012-03-14 08:06:12        8192        ----a-w-        c:\windows\system32\rdrmemptylst.exe
2012-03-14 08:06:12        58880        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-03-14 08:06:12        129536        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-03-14 08:06:11        826880        ----a-w-        c:\windows\system32\rdpcore.dll
2012-03-14 08:06:11        24576        ----a-w-        c:\windows\system32\drivers\tdtcp.sys
2012-03-14 08:06:11        183808        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
.
==================== Find3M  ====================
.
2012-02-23 08:18:36        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-01-22 16:49:03        152576        ----a-w-        c:\windows\system32\msclmd.dll
2012-01-21 12:31:50        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
.
============= FINISH: 17:25:04,90 ===============

--- --- ---
--- --- ---


DDS Attach
Code:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 05.06.2010 14:25:05
System Uptime: 19.03.2012 17:20:03 (0 hours ago)
.
Motherboard: ASUSTeK Computer INC. |  | M2N68-AM Plus
Processor: AMD Athlon(tm) 7750 Dual-Core Processor | AM2 | 2712/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 100 GiB total, 33,836 GiB free.
D: is FIXED (NTFS) - 366 GiB total, 351,481 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP279: 15.03.2012 18:03:50 - Windows Update
RP280: 19.03.2012 13:17:18 - Wiederherstellungsvorgang
RP282: 19.03.2012 16:53:55 - Revo Uninstaller's restore point - Avira AntiVir Personal - Free Antivirus
.
==== Installed Programs ======================
.
.NET Framework Machine Code Access Security Policy
Adobe Flash Player 11 Plugin
Adobe Reader 9.4.5 - Deutsch
Adobe Shockwave Player 11.5
Adobe SVG Viewer 3.0
Ashampoo Snap 3.40
ATRis STAHLGRUBER DVD Setup (01/2012)
ATRis_Technik
COPARTS Online
Crystal Reports for .NET Framework 2.0 (x86)
DHTML Editing Component
DVSE Updater
ElsaWin
Google Earth Plug-in
Google Update Helper
Hardlock Gerätetreiber
Java Auto Updater
Java(TM) 6 Update 23
Malwarebytes Anti-Malware Version 1.60.1.1000
Microsoft Office Access MUI (German) 2010
Microsoft Office Excel MUI (German) 2010
Microsoft Office Groove MUI (German) 2010
Microsoft Office InfoPath MUI (German) 2010
Microsoft Office OneNote MUI (German) 2010
Microsoft Office Outlook MUI (German) 2010
Microsoft Office PowerPoint MUI (German) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (German) 2010
Microsoft Office Proof (Italian) 2010
Microsoft Office Proofing (German) 2010
Microsoft Office Publisher MUI (German) 2010
Microsoft Office Shared MUI (German) 2010
Microsoft Office Word MUI (German) 2010
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft WSE 3.0 Runtime
MiniTool Power Data Recovery
Mozilla Firefox 10.0.2 (x86 de)
Mozilla Thunderbird 10.0.2 (x86 de)
Netzmanager
NVIDIA Display Control Panel
NVIDIA Drivers
PTBSync (Atomuhr Synchronisation & Terminkalender)
PVSonyDll
Realtek High Definition Audio Driver
Revo Uninstaller 1.93
SelectDoc
Skype Click to Call
Skype™ 5.5
STAkis-S
TuneUp Utilities
TuneUp Utilities Language Pack (de-DE)
Turbo Lister 2
VLC media player 1.0.5
Webasto Arbeitsplatz
WinRAR
Zattoo4 4.0.5
.
==== End Of File ===========================
Gmer Log
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-03-19 18:50:14
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\000000af WDC_WD50 rev.05.0
Running: mo9rgnhs.exe; Driver: C:\Users\KFZ-HU~1\AppData\Local\Temp\afrcyuoc.sys


---- Kernel code sections - GMER 1.0.15 ----

.text                                                                                                                                ntkrnlpa.exe!ZwSaveKey + 13D1                                                                                      82E93369 1 Byte  [06]
.text                                                                                                                                ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                              82ECCD52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text                                                                                                                                C:\Windows\system32\drivers\hardlock.sys                                                                            section is writeable [0x82335400, 0x87EE2, 0xE8000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0x823D9620]  C:\Windows\system32\drivers\hardlock.sys                                                                            entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0x823D9620]
.protectÿÿÿÿhardlockunknown last code section [0x823D9400, 0x5126, 0xE0000020]                                                        C:\Windows\system32\drivers\hardlock.sys                                                                            unknown last code section [0x823D9400, 0x5126, 0xE0000020]
PAGE                                                                                                                                  peauth.sys                                                                                                          9B02BB9C 71 Bytes  CALL F4D05804
?                                                                                                                                    C:\Users\KFZ-HU~1\AppData\Local\Temp\mbr.sys                                                                        Das System kann die angegebene Datei nicht finden. !

---- Devices - GMER 1.0.15 ----

AttachedDevice                                                                                                                        \Driver\volmgr \Device\HarddiskVolume1                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice                                                                                                                        \Driver\volmgr \Device\HarddiskVolume1                                                                              rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice                                                                                                                        \Driver\volmgr \Device\HarddiskVolume2                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice                                                                                                                        \Driver\volmgr \Device\HarddiskVolume2                                                                              rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice                                                                                                                        \Driver\volmgr \Device\HarddiskVolume3                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice                                                                                                                        \Driver\volmgr \Device\HarddiskVolume3                                                                              rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

Device                                                                                                                                \Driver\ACPI_HAL \Device\00000099                                                                                  halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice                                                                                                                        \FileSystem\fastfat \Fat                                                                                            fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- Threads - GMER 1.0.15 ----

Thread                                                                                                                                System [4:2184]                                                                                                    ADC38F2E

---- Registry - GMER 1.0.15 ----

Reg                                                                                                                                  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                   
Reg                                                                                                                                  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                C:\Program Files\DAEMON Tools Lite\
Reg                                                                                                                                  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                0x00 0x00 0x00 0x00 ...
Reg                                                                                                                                  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                0
Reg                                                                                                                                  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x72 0xFA 0x65 0x84 ...
Reg                                                                                                                                  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                         
Reg                                                                                                                                  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...
Reg                                                                                                                                  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                    0x42 0xAD 0x93 0x15 ...
Reg                                                                                                                                  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                     
Reg                                                                                                                                  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0xC3 0x14 0xEE 0x3C ...
Reg                                                                                                                                  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)               
Reg                                                                                                                                  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                    C:\Program Files\DAEMON Tools Lite\
Reg                                                                                                                                  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                    0x00 0x00 0x00 0x00 ...
Reg                                                                                                                                  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                    0
Reg                                                                                                                                  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x72 0xFA 0x65 0x84 ...
Reg                                                                                                                                  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)     
Reg                                                                                                                                  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg                                                                                                                                  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                        0x42 0xAD 0x93 0x15 ...
Reg                                                                                                                                  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) 
Reg                                                                                                                                  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0xC3 0x14 0xEE 0x3C ...

---- EOF - GMER 1.0.15 ----
--- --- ---

cosinus 20.03.2012 17:13
Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

lowi 25.03.2012 12:54
Sorry für die Ausszeit... (kurzfristig auf Montage) hab es gestern laufen lassen.
Sieht gut aus? 0 found :) stand da. (mit vorherigem manuellem Update von MWB-Free)

Also ich habe immer noch das Problem dass immer wieder alles Versteckt wird und ich im Programmmenu (Win Symbol) nur Ordner sehe, jedoch keine Verknüpfungen. Dasselbe mit dem Desktop und Explorer(hier sind ebenfalls bestimmte Ordner Betroffen)

Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.23.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
KFZ-Hummel :: KFZ-HUMMEL-PC [Administrator]

24.03.2012 09:42:08
mbam-log-2012-03-24 (09-42-08).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 648632
Laufzeit: 1 Stunde(n), 53 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=c65059799474d44e9f9735b8a372513e
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-03-24 12:51:28
# local_time=2012-03-24 01:51:28 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 425937 84216712 0 0
# compatibility_mode=8192 67108863 100 0 10561 10561 0 0
# scanned=484455
# found=0
# cleaned=0
# scan_time=7967
EDIT: Ach ja, ansonsten läuft Windows und die Software (wenn ich die Versteckten Dateien anzeigen lasse) wie gewohnt.
Die Frage, ist der Virus weg? Muss ich nochwas machen? Wieso werden immer noch Symbole wieder versteckt und keine Ordneroptionen
(wie Sortierungen etc.) gespeichert? :( :(

cosinus 25.03.2012 15:41
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

lowi 26.03.2012 18:23
OTL Logfile:
Code:
OTL logfile created on: 26.03.2012 19:07:27 - Run 1
OTL by OldTimer - Version 3.2.39.2    Folder = D:\Downloads
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,75 Gb Total Physical Memory | 1,71 Gb Available Physical Memory | 62,06% Memory free
5,50 Gb Paging File | 4,43 Gb Available in Paging File | 80,51% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100,00 Gb Total Space | 32,78 Gb Free Space | 32,78% Space Free | Partition Type: NTFS
Drive D: | 365,65 Gb Total Space | 292,75 Gb Free Space | 80,06% Space Free | Partition Type: NTFS
 
Computer Name: KFZ-HUMMEL-PC | User Name: KFZ-Hummel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.26 19:04:55 | 000,593,920 | ---- | M] (OldTimer Tools) -- D:\Downloads\OTL.exe
PRC - [2012.01.03 17:55:00 | 000,114,688 | ---- | M] (Acresso) -- C:\Programme\ATRis_Technik\WorkshopDBServer.exe
PRC - [2012.01.03 17:50:12 | 000,135,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\ATRis_Technik\jre\bin\java.exe
PRC - [2011.10.24 09:53:38 | 002,565,632 | ---- | M] (Deutsche Telekom AG) -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.06.15 16:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe
PRC - [2011.04.27 16:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.06.06 17:29:05 | 000,072,704 | ---- | M] (Autodata Limited) -- C:\Programme\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
PRC - [2010.06.05 16:46:26 | 001,577,984 | ---- | M] (ElmüSoft) -- C:\Programme\PTBSync\PTBSync.exe
PRC - [2010.03.18 22:25:55 | 000,126,976 | ---- | M] (CrypKey (Canada) Ltd.) -- C:\Windows\System32\Crypserv.exe
PRC - [2009.10.30 14:33:46 | 000,486,216 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
PRC - [2009.10.30 14:31:24 | 001,021,256 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
PRC - [2009.07.14 03:14:46 | 000,115,200 | ---- | M] () -- \\?\C:\Windows\System32\wbem\WMIADAP.EXE
PRC - [2009.07.06 22:30:52 | 000,081,920 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\VSGate.exe
PRC - [2009.07.06 22:27:14 | 000,147,456 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\LcSvrAdm.exe
PRC - [2009.07.06 22:26:50 | 000,217,088 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\LcSvrHis.exe
PRC - [2009.07.06 22:25:52 | 000,258,048 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\LcSvrSaz.exe
PRC - [2009.07.06 22:23:52 | 001,306,624 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\LcSvrAuf.exe
PRC - [2009.07.06 22:21:28 | 000,368,640 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\LcSvrPas.exe
PRC - [2009.07.06 22:20:30 | 000,241,664 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\LcSvrDba.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.01.18 16:50:02 | 000,417,792 | ---- | M] () -- C:\Programme\Adobe\Reader 9.0\Reader\AdobeXMP.dll
MOD - [2007.11.16 17:02:18 | 000,479,232 | R--- | M] () -- C:\Programme\Adobe\Reader 9.0\Reader\ccme_base.dll
MOD - [2007.11.16 17:02:18 | 000,401,408 | R--- | M] () -- C:\Programme\Adobe\Reader 9.0\Reader\cryptocme2.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- D:\Program Files\SelectDoc\TBDBMS\tbmux32.exe -- (SelectDoc DB)
SRV - [2012.01.03 17:55:00 | 000,114,688 | ---- | M] (Acresso) [Auto | Running] -- C:\Programme\ATRis_Technik\WorkshopDBServer.exe -- (WorkshopDBService)
SRV - [2011.10.24 09:53:38 | 002,565,632 | ---- | M] (Deutsche Telekom AG) [Auto | Running] -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe -- (Netzmanager Service)
SRV - [2011.04.27 16:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2011.04.27 16:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.11.11 17:49:48 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\srvany.exe -- (KMService)
SRV - [2010.06.06 17:29:05 | 000,072,704 | ---- | M] (Autodata Limited) [Auto | Running] -- C:\Programme\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe -- (Autodata Limited License Service)
SRV - [2010.06.06 10:56:28 | 000,435,016 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2010.06.05 16:46:26 | 001,577,984 | ---- | M] (ElmüSoft) [Auto | Running] -- C:\Program Files\PTBSync\PTBSync.exe -- (PTBSync)
SRV - [2010.03.18 22:25:55 | 000,126,976 | ---- | M] (CrypKey (Canada) Ltd.) [Auto | Running] -- C:\Windows\System32\Crypserv.exe -- (Crypkey License)
SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009.10.30 14:31:24 | 001,021,256 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2009.10.30 14:27:34 | 000,030,024 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.07.06 22:30:52 | 000,081,920 | -H-- | M] (Volkswagen AG) [Auto | Running] -- c:\ElsaWin\bin\VSGate.exe -- (VSGate)
SRV - [2009.07.06 22:27:14 | 000,147,456 | -H-- | M] (Volkswagen AG) [Auto | Running] -- c:\ElsaWin\bin\LcSvrAdm.exe -- (LcSvrAdm)
SRV - [2009.07.06 22:26:50 | 000,217,088 | -H-- | M] (Volkswagen AG) [Auto | Running] -- c:\ElsaWin\bin\LcSvrHis.exe -- (LcSvrHis)
SRV - [2009.07.06 22:25:52 | 000,258,048 | -H-- | M] (Volkswagen AG) [Auto | Running] -- c:\ElsaWin\bin\LcSvrSaz.exe -- (LcSvrSaz)
SRV - [2009.07.06 22:23:52 | 001,306,624 | -H-- | M] (Volkswagen AG) [On_Demand | Running] -- c:\ElsaWin\bin\LcSvrAuf.exe -- (LcSvrAuf)
SRV - [2009.07.06 22:21:28 | 000,368,640 | -H-- | M] (Volkswagen AG) [Auto | Running] -- c:\ElsaWin\bin\LcSvrPas.exe -- (LcSvrPAS)
SRV - [2009.07.06 22:20:30 | 000,241,664 | -H-- | M] (Volkswagen AG) [Auto | Running] -- c:\ElsaWin\bin\LcSvrDba.exe -- (LcSvrDba)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | Auto | Stopped] -- C:\Windows\system32\drivers\hardlock.sys -- (Hardlock)
DRV - [2011.04.27 16:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011.04.18 14:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.09.16 17:02:33 | 000,035,040 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys -- (TelekomNM3)
DRV - [2010.08.12 12:07:48 | 000,298,216 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2010.07.10 06:37:00 | 011,008,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010.06.05 16:46:26 | 000,014,416 | ---- | M] (OpenLibSys.org) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\ptbring0.sys -- (WinRing0_1_2_0)
DRV - [2010.06.05 15:02:52 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010.03.19 01:11:11 | 000,023,360 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\Ckldrv.sys -- (NetworkX)
DRV - [2009.10.14 07:24:44 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2009.08.04 17:43:40 | 000,213,024 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2009.07.14 01:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2009.07.14 00:02:54 | 000,559,104 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fpcibase.sys -- (FPCIBASE)
DRV - [2009.07.14 00:02:54 | 000,064,000 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avmcowan.sys -- (AVMCOWAN)
DRV - [2009.07.14 00:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2008.11.23 11:23:06 | 000,097,792 | ---- | M] (T0r0 2008) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\NSHE.SYS -- (NSHE)
DRV - [2006.04.12 08:43:50 | 000,169,472 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8187.sys -- (RTLWUSB)
DRV - [2005.01.13 09:28:02 | 000,039,040 | ---- | M] (ADMtek Incorporated.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\an983.sys -- (AN983)
DRV - [2004.08.13 09:56:20 | 000,005,810 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 20 09 6D 3A AE 04 CB 01  [binary data]
IE - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:2.0.2
FF - prefs.js..extensions.enabledItems: easygtranslate@wrlf.com.br:2.1
FF - prefs.js..extensions.enabledItems: {aff87fa2-a58e-4edd-b852-0a20203c1e17}:0.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.8
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.20 10:01:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.24 09:58:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 11.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.09.10 10:13:06 | 000,000,000 | ---D | M]
 
[2010.09.04 09:41:45 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\KFZ-Hummel\AppData\Roaming\mozilla\Extensions
[2010.09.04 09:41:45 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\KFZ-Hummel\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.03.20 15:27:57 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\KFZ-Hummel\AppData\Roaming\mozilla\Firefox\Profiles\p35xhquj.default\extensions
[2011.01.17 11:00:06 | 000,000,000 | -H-D | M] (German Dictionary) -- C:\Users\KFZ-Hummel\AppData\Roaming\mozilla\Firefox\Profiles\p35xhquj.default\extensions\de-DE@dictionaries.addons.mozilla.org
[2011.01.20 12:21:43 | 000,001,334 | -H-- | M] () -- C:\Users\KFZ-Hummel\AppData\Roaming\Mozilla\Firefox\Profiles\p35xhquj.default\searchplugins\iloadto.xml
[2012.03.23 13:24:05 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.10.29 09:02:55 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.03.23 13:24:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\KFZ-HUMMEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P35XHQUJ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\KFZ-HUMMEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P35XHQUJ.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
[2012.03.20 10:01:51 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.03.23 13:23:49 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.02.03 10:00:17 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.03 10:00:17 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.03 10:00:17 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.03 10:00:17 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.03 10:00:17 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.03 10:00:17 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PTBSync] C:\Program Files\PTBSync\PTBSync.exe (ElmüSoft)
O4 - HKLM..\Run: [SedServer] C:\Program Files\ATRis_Technik\Sed.exe ()
O4 - HKU\S-1-5-21-1878925396-3002024494-660468303-1000..\Run: [AshSnap] C:\Programme\Ashampoo Snap 3\ashsnap.exe (ashampoo GmbH & Co. KG)
O4 - HKU\S-1-5-21-1878925396-3002024494-660468303-1000..\Run: [Firefox] C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\KFZ-Hummel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ATRis STAHLGRUBER DVD.lnk = C:\ATRIS_ST\KatCd\atris_st.exe (DVSE GmbH\nCarl-Benz-Weg 1\nD-22941 Bargteheide\nTel.: +49 (0) 4532 201401\nFax.: +49 (0) 4532 501052\nEMail: info@dvse.de)
O4 - Startup: C:\Users\KFZ-Hummel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk = C:\Programme\Netzmanager\netzmanager.exe (Deutsche Telekom AG)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5D2DFF26-E8B0-43F6-9665-F5401428B568}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\vw-wi {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - c:\ElsaWin\bin\wiprot.dll (TODO: <Company name>)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{d3b6d63b-70a2-11df-8416-404e57434401}\Shell - "" = AutoRun
O33 - MountPoints2\{d3b6d63b-70a2-11df-8416-404e57434401}\Shell\AutoRun\command - "" = I:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - State: "services" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: MsMpSvc - C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: MsMpSvc - C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.24 12:27:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MERTEN SCHALTER-MANAGER
[2012.03.24 12:27:00 | 000,000,000 | ---D | C] -- C:\Program Files\MERTEN SCHALTER-MANAGER
[2012.03.24 10:42:40 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.03.23 13:24:05 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2012.03.23 13:24:05 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2012.03.23 13:24:05 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2012.03.23 13:23:45 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.03.20 13:19:23 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2012.03.20 13:19:23 | 000,000,000 | ---D | C] -- C:\Users\KFZ-Hummel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2012.03.19 19:52:53 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2012.03.19 17:52:19 | 000,607,260 | -H-- | C] (Swearware) -- C:\Users\KFZ-Hummel\Desktop\dds.scr
[2012.03.19 17:52:13 | 000,607,260 | RH-- | C] (Swearware) -- C:\Users\KFZ-Hummel\Desktop\dds.com
[2012.03.19 15:52:26 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%
[2012.03.15 10:07:15 | 002,343,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.03.15 10:07:14 | 001,077,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012.03.14 10:06:12 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2012.03.14 10:06:12 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012.03.14 10:06:12 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2012.03.14 10:06:11 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.26 19:08:32 | 000,645,728 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.26 19:08:32 | 000,609,092 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.26 19:08:32 | 000,127,188 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.26 19:08:32 | 000,104,370 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.26 19:03:29 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.26 19:03:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.26 17:35:01 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.26 09:06:45 | 000,013,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.26 09:06:45 | 000,013,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.23 13:23:48 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2012.03.23 13:23:48 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2012.03.23 13:23:48 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2012.03.23 13:23:47 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2012.03.21 10:33:05 | 000,000,772 | ---- | M] () -- C:\Users\KFZ-Hummel\Desktop\Wuetschner Verkaufskladde.lnk
[2012.03.20 13:19:23 | 000,001,222 | ---- | M] () -- C:\Users\KFZ-Hummel\Desktop\Revo Uninstaller.lnk
[2012.03.20 10:02:08 | 000,000,456 | -H-- | M] () -- C:\ProgramData\daXg9vo6fXsgpX
[2012.03.20 10:00:27 | 000,000,264 | -H-- | M] () -- C:\ProgramData\~daXg9vo6fXsgpX
[2012.03.20 10:00:27 | 000,000,176 | -H-- | M] () -- C:\ProgramData\~daXg9vo6fXsgpXr
[2012.03.19 19:53:16 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012.03.19 19:50:35 | 000,000,442 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2012.03.19 18:19:24 | 000,000,020 | -H-- | M] () -- C:\Users\KFZ-Hummel\defogger_reenable
[2012.03.19 17:52:35 | 000,302,592 | -H-- | M] () -- C:\Users\KFZ-Hummel\Desktop\mo9rgnhs.exe
[2012.03.19 17:52:21 | 000,607,260 | -H-- | M] (Swearware) -- C:\Users\KFZ-Hummel\Desktop\dds.scr
[2012.03.19 17:52:15 | 000,607,260 | RH-- | M] (Swearware) -- C:\Users\KFZ-Hummel\Desktop\dds.com
[2012.03.19 17:49:53 | 000,050,477 | -H-- | M] () -- C:\Users\KFZ-Hummel\Desktop\Defogger.exe
[2012.03.19 11:03:01 | 000,007,604 | -H-- | M] () -- C:\Users\KFZ-Hummel\AppData\Local\Resmon.ResmonCfg
[2012.03.19 10:30:45 | 000,000,440 | -H-- | M] () -- C:\ProgramData\z1dYe2Bc1FTAcm
[2012.03.19 10:27:27 | 000,000,264 | -H-- | M] () -- C:\ProgramData\~z1dYe2Bc1FTAcm
[2012.03.19 10:27:27 | 000,000,176 | -H-- | M] () -- C:\ProgramData\~z1dYe2Bc1FTAcmr
[2012.03.16 16:26:49 | 000,023,552 | -H-- | M] () -- C:\Users\KFZ-Hummel\AppData\Local\WebpageIcons.db
[2012.03.16 09:59:39 | 000,330,304 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2012.03.21 10:32:54 | 000,000,772 | ---- | C] () -- C:\Users\KFZ-Hummel\Desktop\Wuetschner Verkaufskladde.lnk
[2012.03.20 13:19:23 | 000,001,222 | ---- | C] () -- C:\Users\KFZ-Hummel\Desktop\Revo Uninstaller.lnk
[2012.03.20 10:00:27 | 000,000,264 | -H-- | C] () -- C:\ProgramData\~daXg9vo6fXsgpX
[2012.03.20 10:00:27 | 000,000,176 | -H-- | C] () -- C:\ProgramData\~daXg9vo6fXsgpXr
[2012.03.20 10:00:22 | 000,000,456 | -H-- | C] () -- C:\ProgramData\daXg9vo6fXsgpX
[2012.03.19 19:53:16 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif
[2012.03.19 18:19:09 | 000,000,020 | -H-- | C] () -- C:\Users\KFZ-Hummel\defogger_reenable
[2012.03.19 17:52:34 | 000,302,592 | -H-- | C] () -- C:\Users\KFZ-Hummel\Desktop\mo9rgnhs.exe
[2012.03.19 17:49:51 | 000,050,477 | -H-- | C] () -- C:\Users\KFZ-Hummel\Desktop\Defogger.exe
[2012.03.19 10:20:45 | 000,000,264 | -H-- | C] () -- C:\ProgramData\~z1dYe2Bc1FTAcm
[2012.03.19 10:20:45 | 000,000,176 | -H-- | C] () -- C:\ProgramData\~z1dYe2Bc1FTAcmr
[2012.03.19 10:20:43 | 000,000,440 | -H-- | C] () -- C:\ProgramData\z1dYe2Bc1FTAcm
[2012.01.09 10:19:07 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.01.03 18:00:07 | 000,000,000 | -H-- | C] () -- C:\Users\KFZ-Hummel\AppData\Local\max.ini
[2012.01.03 17:20:04 | 000,000,295 | ---- | C] () -- C:\Windows\Atris_STG.INI
[2011.11.25 11:48:32 | 000,001,024 | ---- | C] () -- C:\Windows\System32\winprod.dll
[2011.01.17 17:15:07 | 000,011,164 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2010.11.11 17:50:37 | 000,008,192 | ---- | C] () -- C:\Windows\System32\srvany.exe
[2010.11.09 17:15:57 | 000,007,604 | -H-- | C] () -- C:\Users\KFZ-Hummel\AppData\Local\Resmon.ResmonCfg
[2010.09.29 13:36:30 | 000,000,064 | ---- | C] () -- C:\Windows\Sys.ini
[2010.09.29 13:30:39 | 000,165,376 | ---- | C] () -- C:\Windows\UNWISE.EXE
[2010.06.07 09:38:43 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.06.06 17:15:06 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2010.06.06 16:29:00 | 000,000,056 | ---- | C] () -- C:\Windows\Acroread.ini
[2010.06.06 12:39:49 | 000,023,552 | -H-- | C] () -- C:\Users\KFZ-Hummel\AppData\Local\WebpageIcons.db
[2010.06.05 17:24:49 | 000,000,148 | ---- | C] () -- C:\Windows\Crypkey.ini
[2010.06.05 17:24:35 | 000,027,648 | R--- | C] () -- C:\Windows\Setup_ck.exe
[2010.06.05 17:24:35 | 000,023,360 | ---- | C] () -- C:\Windows\System32\Ckldrv.sys
[2010.06.05 17:24:35 | 000,018,432 | ---- | C] () -- C:\Windows\Setup_ck.dll
[2010.06.05 17:24:35 | 000,011,776 | ---- | C] () -- C:\Windows\Ckrfresh.exe
[2010.06.05 16:59:04 | 000,001,692 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.06.05 16:59:04 | 000,000,374 | ---- | C] () -- C:\Windows\Atris_St.INI
[2010.06.05 16:59:04 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2010.06.05 15:14:54 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNWISE.EXE
[2010.06.05 15:14:54 | 000,006,836 | ---- | C] () -- C:\Windows\System32\UNWISE.INI
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.11.04 11:21:03 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Adobe
[2011.07.02 09:55:26 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Brembo Desktop Calendar
[2010.06.05 15:19:34 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\DAEMON Tools Lite
[2010.08.06 14:20:03 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\dvdcss
[2010.09.03 14:50:28 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\DVSE GmbH
[2011.08.29 11:44:54 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\FRITZ!
[2011.07.26 08:58:16 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\go
[2010.06.05 14:25:18 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Identities
[2010.06.06 12:43:08 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Macromedia
[2011.07.01 17:06:14 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Malwarebytes
[2009.07.14 10:56:56 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Media Center Programs
[2012.03.19 17:31:09 | 000,000,000 | --SD | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Microsoft
[2010.06.05 14:57:50 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Mozilla
[2011.01.14 17:44:10 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Opera
[2012.03.26 19:07:09 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Skype
[2011.06.16 08:59:59 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\skypePM
[2012.03.19 17:31:09 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Thunderbird
[2010.06.06 10:56:23 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\TuneUp Software
[2012.03.19 17:31:09 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\vlc
[2010.06.05 16:19:32 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2012.01.22 18:21:08 | 000,010,134 | RH-- | M] () -- C:\Users\KFZ-Hummel\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
[2011.05.02 09:02:01 | 000,188,152 | -H-- | M] () -- C:\Users\KFZ-Hummel\AppData\Roaming\Mozilla\Firefox\Profiles\p35xhquj.default\FlashGot.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2009.08.04 18:44:14 | 000,213,024 | -H-- | M] (NVIDIA Corporation) MD5=269DE658DEAF032564E8B6430B5BD170 -- C:\NVIDIA\nForceWinVista\15.49\English\IDE\Win7\sataraid\nvstor32.sys
[2009.08.04 18:44:14 | 000,213,024 | -H-- | M] (NVIDIA Corporation) MD5=269DE658DEAF032564E8B6430B5BD170 -- C:\NVIDIA\nForceWinVista\15.49\English\IDE\WinVista\sataraid\nvstor32.sys
[2009.08.04 18:43:40 | 000,213,024 | -H-- | M] (NVIDIA Corporation) MD5=3FF57A9A657C9690ECBC8B1E3B6E3979 -- C:\NVIDIA\nForceWinVista\15.49\English\IDE\Win7\sata_ide\nvstor32.sys
[2009.08.04 18:43:40 | 000,213,024 | -H-- | M] (NVIDIA Corporation) MD5=3FF57A9A657C9690ECBC8B1E3B6E3979 -- C:\NVIDIA\nForceWinVista\15.49\English\IDE\WinVista\sata_ide\nvstor32.sys
[2009.08.04 17:43:40 | 000,213,024 | ---- | M] (NVIDIA Corporation) MD5=3FF57A9A657C9690ECBC8B1E3B6E3979 -- C:\Windows\System32\drivers\nvstor32.sys
[2009.08.04 17:43:40 | 000,213,024 | ---- | M] (NVIDIA Corporation) MD5=3FF57A9A657C9690ECBC8B1E3B6E3979 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_x86_neutral_40ee9c3d357e7b66\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2012.01.13 15:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2011.04.18 14:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\drivers\MpNWMon.sys
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >
--- --- ---

lowi 26.03.2012 18:41
Sorry War Scan nich Quick Scan -_-
Hier QuickScanOTL Logfile:
Code:
OTL logfile created on: 26.03.2012 19:32:00 - Run 1
OTL by OldTimer - Version 3.2.39.2    Folder = D:\Downloads
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,75 Gb Total Physical Memory | 1,52 Gb Available Physical Memory | 55,13% Memory free
5,50 Gb Paging File | 4,33 Gb Available in Paging File | 78,83% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100,00 Gb Total Space | 32,86 Gb Free Space | 32,86% Space Free | Partition Type: NTFS
Drive D: | 365,65 Gb Total Space | 292,75 Gb Free Space | 80,06% Space Free | Partition Type: NTFS
 
Computer Name: KFZ-HUMMEL-PC | User Name: KFZ-Hummel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.26 19:04:55 | 000,593,920 | ---- | M] (OldTimer Tools) -- D:\Downloads\OTL.exe
PRC - [2012.03.20 10:01:51 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2012.01.03 17:55:00 | 000,114,688 | ---- | M] (Acresso) -- C:\Programme\ATRis_Technik\WorkshopDBServer.exe
PRC - [2012.01.03 17:50:12 | 000,135,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\ATRis_Technik\jre\bin\java.exe
PRC - [2011.10.24 09:53:38 | 002,565,632 | ---- | M] (Deutsche Telekom AG) -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.06.15 16:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe
PRC - [2011.04.27 16:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.06.06 17:29:05 | 000,072,704 | ---- | M] (Autodata Limited) -- C:\Programme\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
PRC - [2010.06.05 16:46:26 | 001,577,984 | ---- | M] (ElmüSoft) -- C:\Programme\PTBSync\PTBSync.exe
PRC - [2010.03.18 22:25:55 | 000,126,976 | ---- | M] (CrypKey (Canada) Ltd.) -- C:\Windows\System32\Crypserv.exe
PRC - [2009.10.30 14:33:46 | 000,486,216 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
PRC - [2009.10.30 14:31:24 | 001,021,256 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
PRC - [2009.07.06 22:30:52 | 000,081,920 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\VSGate.exe
PRC - [2009.07.06 22:27:14 | 000,147,456 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\LcSvrAdm.exe
PRC - [2009.07.06 22:26:50 | 000,217,088 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\LcSvrHis.exe
PRC - [2009.07.06 22:25:52 | 000,258,048 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\LcSvrSaz.exe
PRC - [2009.07.06 22:23:52 | 001,306,624 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\LcSvrAuf.exe
PRC - [2009.07.06 22:21:28 | 000,368,640 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\LcSvrPas.exe
PRC - [2009.07.06 22:20:30 | 000,241,664 | -H-- | M] (Volkswagen AG) -- c:\ElsaWin\bin\LcSvrDba.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.03.20 10:01:50 | 001,969,080 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- D:\Program Files\SelectDoc\TBDBMS\tbmux32.exe -- (SelectDoc DB)
SRV - [2012.01.03 17:55:00 | 000,114,688 | ---- | M] (Acresso) [Auto | Running] -- C:\Programme\ATRis_Technik\WorkshopDBServer.exe -- (WorkshopDBService)
SRV - [2011.10.24 09:53:38 | 002,565,632 | ---- | M] (Deutsche Telekom AG) [Auto | Running] -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe -- (Netzmanager Service)
SRV - [2011.04.27 16:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2011.04.27 16:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.06.06 17:29:05 | 000,072,704 | ---- | M] (Autodata Limited) [Auto | Running] -- C:\Programme\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe -- (Autodata Limited License Service)
SRV - [2010.06.06 10:56:28 | 000,435,016 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2010.06.05 16:46:26 | 001,577,984 | ---- | M] (ElmüSoft) [Auto | Running] -- C:\Program Files\PTBSync\PTBSync.exe -- (PTBSync)
SRV - [2010.03.18 22:25:55 | 000,126,976 | ---- | M] (CrypKey (Canada) Ltd.) [Auto | Running] -- C:\Windows\System32\Crypserv.exe -- (Crypkey License)
SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009.10.30 14:31:24 | 001,021,256 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2009.10.30 14:27:34 | 000,030,024 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.07.06 22:30:52 | 000,081,920 | -H-- | M] (Volkswagen AG) [Auto | Running] -- c:\ElsaWin\bin\VSGate.exe -- (VSGate)
SRV - [2009.07.06 22:27:14 | 000,147,456 | -H-- | M] (Volkswagen AG) [Auto | Running] -- c:\ElsaWin\bin\LcSvrAdm.exe -- (LcSvrAdm)
SRV - [2009.07.06 22:26:50 | 000,217,088 | -H-- | M] (Volkswagen AG) [Auto | Running] -- c:\ElsaWin\bin\LcSvrHis.exe -- (LcSvrHis)
SRV - [2009.07.06 22:25:52 | 000,258,048 | -H-- | M] (Volkswagen AG) [Auto | Running] -- c:\ElsaWin\bin\LcSvrSaz.exe -- (LcSvrSaz)
SRV - [2009.07.06 22:23:52 | 001,306,624 | -H-- | M] (Volkswagen AG) [On_Demand | Running] -- c:\ElsaWin\bin\LcSvrAuf.exe -- (LcSvrAuf)
SRV - [2009.07.06 22:21:28 | 000,368,640 | -H-- | M] (Volkswagen AG) [Auto | Running] -- c:\ElsaWin\bin\LcSvrPas.exe -- (LcSvrPAS)
SRV - [2009.07.06 22:20:30 | 000,241,664 | -H-- | M] (Volkswagen AG) [Auto | Running] -- c:\ElsaWin\bin\LcSvrDba.exe -- (LcSvrDba)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | Auto | Stopped] -- C:\Windows\system32\drivers\hardlock.sys -- (Hardlock)
DRV - [2011.04.27 16:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011.04.18 14:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.09.16 17:02:33 | 000,035,040 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys -- (TelekomNM3)
DRV - [2010.08.12 12:07:48 | 000,298,216 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2010.07.10 06:37:00 | 011,008,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010.06.05 16:46:26 | 000,014,416 | ---- | M] (OpenLibSys.org) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\ptbring0.sys -- (WinRing0_1_2_0)
DRV - [2010.06.05 15:02:52 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010.03.19 01:11:11 | 000,023,360 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\Ckldrv.sys -- (NetworkX)
DRV - [2009.10.14 07:24:44 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2009.08.04 17:43:40 | 000,213,024 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2009.07.14 01:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2009.07.14 00:02:54 | 000,559,104 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fpcibase.sys -- (FPCIBASE)
DRV - [2009.07.14 00:02:54 | 000,064,000 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avmcowan.sys -- (AVMCOWAN)
DRV - [2009.07.14 00:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2008.11.23 11:23:06 | 000,097,792 | ---- | M] (T0r0 2008) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\NSHE.SYS -- (NSHE)
DRV - [2006.04.12 08:43:50 | 000,169,472 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8187.sys -- (RTLWUSB)
DRV - [2005.01.13 09:28:02 | 000,039,040 | ---- | M] (ADMtek Incorporated.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\an983.sys -- (AN983)
DRV - [2004.08.13 09:56:20 | 000,005,810 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 20 09 6D 3A AE 04 CB 01  [binary data]
IE - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:2.0.2
FF - prefs.js..extensions.enabledItems: easygtranslate@wrlf.com.br:2.1
FF - prefs.js..extensions.enabledItems: {aff87fa2-a58e-4edd-b852-0a20203c1e17}:0.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.8
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.20 10:01:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.24 09:58:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 11.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.09.10 10:13:06 | 000,000,000 | ---D | M]
 
[2010.09.04 09:41:45 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\KFZ-Hummel\AppData\Roaming\mozilla\Extensions
[2010.09.04 09:41:45 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\KFZ-Hummel\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.03.20 15:27:57 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\KFZ-Hummel\AppData\Roaming\mozilla\Firefox\Profiles\p35xhquj.default\extensions
[2011.01.17 11:00:06 | 000,000,000 | -H-D | M] (German Dictionary) -- C:\Users\KFZ-Hummel\AppData\Roaming\mozilla\Firefox\Profiles\p35xhquj.default\extensions\de-DE@dictionaries.addons.mozilla.org
[2011.01.20 12:21:43 | 000,001,334 | -H-- | M] () -- C:\Users\KFZ-Hummel\AppData\Roaming\Mozilla\Firefox\Profiles\p35xhquj.default\searchplugins\iloadto.xml
[2012.03.23 13:24:05 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.10.29 09:02:55 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.03.23 13:24:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\KFZ-HUMMEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P35XHQUJ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\KFZ-HUMMEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P35XHQUJ.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
[2012.03.20 10:01:51 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.03.23 13:23:49 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.02.03 10:00:17 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.03 10:00:17 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.03 10:00:17 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.03 10:00:17 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.03 10:00:17 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.03 10:00:17 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PTBSync] C:\Program Files\PTBSync\PTBSync.exe (ElmüSoft)
O4 - HKLM..\Run: [SedServer] C:\Program Files\ATRis_Technik\Sed.exe ()
O4 - HKU\S-1-5-21-1878925396-3002024494-660468303-1000..\Run: [AshSnap] C:\Programme\Ashampoo Snap 3\ashsnap.exe (ashampoo GmbH & Co. KG)
O4 - HKU\S-1-5-21-1878925396-3002024494-660468303-1000..\Run: [Firefox] C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\KFZ-Hummel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ATRis STAHLGRUBER DVD.lnk = C:\ATRIS_ST\KatCd\atris_st.exe (DVSE GmbH\nCarl-Benz-Weg 1\nD-22941 Bargteheide\nTel.: +49 (0) 4532 201401\nFax.: +49 (0) 4532 501052\nEMail: info@dvse.de)
O4 - Startup: C:\Users\KFZ-Hummel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk = C:\Programme\Netzmanager\netzmanager.exe (Deutsche Telekom AG)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-1878925396-3002024494-660468303-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5D2DFF26-E8B0-43F6-9665-F5401428B568}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\vw-wi {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - c:\ElsaWin\bin\wiprot.dll (TODO: <Company name>)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{d3b6d63b-70a2-11df-8416-404e57434401}\Shell - "" = AutoRun
O33 - MountPoints2\{d3b6d63b-70a2-11df-8416-404e57434401}\Shell\AutoRun\command - "" = I:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.24 12:27:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MERTEN SCHALTER-MANAGER
[2012.03.24 12:27:00 | 000,000,000 | ---D | C] -- C:\Program Files\MERTEN SCHALTER-MANAGER
[2012.03.24 10:42:40 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.03.23 13:23:45 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.03.20 13:19:23 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2012.03.20 13:19:23 | 000,000,000 | ---D | C] -- C:\Users\KFZ-Hummel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2012.03.19 19:52:53 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2012.03.19 17:52:19 | 000,607,260 | -H-- | C] (Swearware) -- C:\Users\KFZ-Hummel\Desktop\dds.scr
[2012.03.19 17:52:13 | 000,607,260 | RH-- | C] (Swearware) -- C:\Users\KFZ-Hummel\Desktop\dds.com
[2012.03.19 15:52:26 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.26 19:10:29 | 000,013,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.26 19:10:29 | 000,013,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.26 19:08:32 | 000,645,728 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.26 19:08:32 | 000,609,092 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.26 19:08:32 | 000,127,188 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.26 19:08:32 | 000,104,370 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.26 19:03:29 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.26 19:03:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.26 17:35:01 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.21 10:33:05 | 000,000,772 | ---- | M] () -- C:\Users\KFZ-Hummel\Desktop\Wuetschner Verkaufskladde.lnk
[2012.03.20 13:19:23 | 000,001,222 | ---- | M] () -- C:\Users\KFZ-Hummel\Desktop\Revo Uninstaller.lnk
[2012.03.20 10:02:08 | 000,000,456 | -H-- | M] () -- C:\ProgramData\daXg9vo6fXsgpX
[2012.03.20 10:00:27 | 000,000,264 | -H-- | M] () -- C:\ProgramData\~daXg9vo6fXsgpX
[2012.03.20 10:00:27 | 000,000,176 | -H-- | M] () -- C:\ProgramData\~daXg9vo6fXsgpXr
[2012.03.19 19:53:16 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012.03.19 19:50:35 | 000,000,442 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2012.03.19 18:19:24 | 000,000,020 | -H-- | M] () -- C:\Users\KFZ-Hummel\defogger_reenable
[2012.03.19 17:52:35 | 000,302,592 | -H-- | M] () -- C:\Users\KFZ-Hummel\Desktop\mo9rgnhs.exe
[2012.03.19 17:52:21 | 000,607,260 | -H-- | M] (Swearware) -- C:\Users\KFZ-Hummel\Desktop\dds.scr
[2012.03.19 17:52:15 | 000,607,260 | RH-- | M] (Swearware) -- C:\Users\KFZ-Hummel\Desktop\dds.com
[2012.03.19 17:49:53 | 000,050,477 | -H-- | M] () -- C:\Users\KFZ-Hummel\Desktop\Defogger.exe
[2012.03.19 11:03:01 | 000,007,604 | -H-- | M] () -- C:\Users\KFZ-Hummel\AppData\Local\Resmon.ResmonCfg
[2012.03.19 10:30:45 | 000,000,440 | -H-- | M] () -- C:\ProgramData\z1dYe2Bc1FTAcm
[2012.03.19 10:27:27 | 000,000,264 | -H-- | M] () -- C:\ProgramData\~z1dYe2Bc1FTAcm
[2012.03.19 10:27:27 | 000,000,176 | -H-- | M] () -- C:\ProgramData\~z1dYe2Bc1FTAcmr
[2012.03.16 16:26:49 | 000,023,552 | -H-- | M] () -- C:\Users\KFZ-Hummel\AppData\Local\WebpageIcons.db
[2012.03.16 09:59:39 | 000,330,304 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2012.03.21 10:32:54 | 000,000,772 | ---- | C] () -- C:\Users\KFZ-Hummel\Desktop\Wuetschner Verkaufskladde.lnk
[2012.03.20 13:19:23 | 000,001,222 | ---- | C] () -- C:\Users\KFZ-Hummel\Desktop\Revo Uninstaller.lnk
[2012.03.20 10:00:27 | 000,000,264 | -H-- | C] () -- C:\ProgramData\~daXg9vo6fXsgpX
[2012.03.20 10:00:27 | 000,000,176 | -H-- | C] () -- C:\ProgramData\~daXg9vo6fXsgpXr
[2012.03.20 10:00:22 | 000,000,456 | -H-- | C] () -- C:\ProgramData\daXg9vo6fXsgpX
[2012.03.19 19:53:16 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif
[2012.03.19 18:19:09 | 000,000,020 | -H-- | C] () -- C:\Users\KFZ-Hummel\defogger_reenable
[2012.03.19 17:52:34 | 000,302,592 | -H-- | C] () -- C:\Users\KFZ-Hummel\Desktop\mo9rgnhs.exe
[2012.03.19 17:49:51 | 000,050,477 | -H-- | C] () -- C:\Users\KFZ-Hummel\Desktop\Defogger.exe
[2012.03.19 10:20:45 | 000,000,264 | -H-- | C] () -- C:\ProgramData\~z1dYe2Bc1FTAcm
[2012.03.19 10:20:45 | 000,000,176 | -H-- | C] () -- C:\ProgramData\~z1dYe2Bc1FTAcmr
[2012.03.19 10:20:43 | 000,000,440 | -H-- | C] () -- C:\ProgramData\z1dYe2Bc1FTAcm
[2012.01.09 10:19:07 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.01.03 18:00:07 | 000,000,000 | -H-- | C] () -- C:\Users\KFZ-Hummel\AppData\Local\max.ini
[2012.01.03 17:20:04 | 000,000,295 | ---- | C] () -- C:\Windows\Atris_STG.INI
[2011.11.25 11:48:32 | 000,001,024 | ---- | C] () -- C:\Windows\System32\winprod.dll
[2011.01.17 17:15:07 | 000,011,164 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2010.11.11 17:50:37 | 000,008,192 | ---- | C] () -- C:\Windows\System32\srvany.exe
[2010.11.09 17:15:57 | 000,007,604 | -H-- | C] () -- C:\Users\KFZ-Hummel\AppData\Local\Resmon.ResmonCfg
[2010.09.29 13:36:30 | 000,000,064 | ---- | C] () -- C:\Windows\Sys.ini
[2010.09.29 13:30:39 | 000,165,376 | ---- | C] () -- C:\Windows\UNWISE.EXE
[2010.06.07 09:38:43 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.06.06 17:15:06 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2010.06.06 16:29:00 | 000,000,056 | ---- | C] () -- C:\Windows\Acroread.ini
[2010.06.06 12:39:49 | 000,023,552 | -H-- | C] () -- C:\Users\KFZ-Hummel\AppData\Local\WebpageIcons.db
[2010.06.05 17:24:49 | 000,000,148 | ---- | C] () -- C:\Windows\Crypkey.ini
[2010.06.05 17:24:35 | 000,027,648 | R--- | C] () -- C:\Windows\Setup_ck.exe
[2010.06.05 17:24:35 | 000,023,360 | ---- | C] () -- C:\Windows\System32\Ckldrv.sys
[2010.06.05 17:24:35 | 000,018,432 | ---- | C] () -- C:\Windows\Setup_ck.dll
[2010.06.05 17:24:35 | 000,011,776 | ---- | C] () -- C:\Windows\Ckrfresh.exe
[2010.06.05 16:59:04 | 000,001,692 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.06.05 16:59:04 | 000,000,374 | ---- | C] () -- C:\Windows\Atris_St.INI
[2010.06.05 16:59:04 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2010.06.05 15:14:54 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNWISE.EXE
[2010.06.05 15:14:54 | 000,006,836 | ---- | C] () -- C:\Windows\System32\UNWISE.INI
 
========== LOP Check ==========
 
[2011.07.02 09:55:26 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Brembo Desktop Calendar
[2010.06.05 15:19:34 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\DAEMON Tools Lite
[2010.09.03 14:50:28 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\DVSE GmbH
[2011.08.29 11:44:54 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\FRITZ!
[2011.07.26 08:58:16 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\go
[2011.01.14 17:44:10 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Opera
[2012.03.19 17:31:09 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Thunderbird
[2010.06.06 10:56:23 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\TuneUp Software
[2010.12.07 12:00:38 | 000,000,520 | ---- | M] () -- C:\Windows\Tasks\Automatische Wartung.job
[2011.12.19 09:59:18 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.11.04 11:21:03 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Adobe
[2011.07.02 09:55:26 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Brembo Desktop Calendar
[2010.06.05 15:19:34 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\DAEMON Tools Lite
[2010.08.06 14:20:03 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\dvdcss
[2010.09.03 14:50:28 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\DVSE GmbH
[2011.08.29 11:44:54 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\FRITZ!
[2011.07.26 08:58:16 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\go
[2010.06.05 14:25:18 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Identities
[2010.06.06 12:43:08 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Macromedia
[2011.07.01 17:06:14 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Malwarebytes
[2009.07.14 10:56:56 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Media Center Programs
[2012.03.19 17:31:09 | 000,000,000 | --SD | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Microsoft
[2010.06.05 14:57:50 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Mozilla
[2011.01.14 17:44:10 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Opera
[2012.03.26 19:07:09 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Skype
[2011.06.16 08:59:59 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\skypePM
[2012.03.19 17:31:09 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\Thunderbird
[2010.06.06 10:56:23 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\TuneUp Software
[2012.03.19 17:31:09 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\vlc
[2010.06.05 16:19:32 | 000,000,000 | -H-D | M] -- C:\Users\KFZ-Hummel\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2012.01.22 18:21:08 | 000,010,134 | RH-- | M] () -- C:\Users\KFZ-Hummel\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
[2011.05.02 09:02:01 | 000,188,152 | -H-- | M] () -- C:\Users\KFZ-Hummel\AppData\Roaming\Mozilla\Firefox\Profiles\p35xhquj.default\FlashGot.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2009.08.04 18:44:14 | 000,213,024 | -H-- | M] (NVIDIA Corporation) MD5=269DE658DEAF032564E8B6430B5BD170 -- C:\NVIDIA\nForceWinVista\15.49\English\IDE\Win7\sataraid\nvstor32.sys
[2009.08.04 18:44:14 | 000,213,024 | -H-- | M] (NVIDIA Corporation) MD5=269DE658DEAF032564E8B6430B5BD170 -- C:\NVIDIA\nForceWinVista\15.49\English\IDE\WinVista\sataraid\nvstor32.sys
[2009.08.04 18:43:40 | 000,213,024 | -H-- | M] (NVIDIA Corporation) MD5=3FF57A9A657C9690ECBC8B1E3B6E3979 -- C:\NVIDIA\nForceWinVista\15.49\English\IDE\Win7\sata_ide\nvstor32.sys
[2009.08.04 18:43:40 | 000,213,024 | -H-- | M] (NVIDIA Corporation) MD5=3FF57A9A657C9690ECBC8B1E3B6E3979 -- C:\NVIDIA\nForceWinVista\15.49\English\IDE\WinVista\sata_ide\nvstor32.sys
[2009.08.04 17:43:40 | 000,213,024 | ---- | M] (NVIDIA Corporation) MD5=3FF57A9A657C9690ECBC8B1E3B6E3979 -- C:\Windows\System32\drivers\nvstor32.sys
[2009.08.04 17:43:40 | 000,213,024 | ---- | M] (NVIDIA Corporation) MD5=3FF57A9A657C9690ECBC8B1E3B6E3979 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_x86_neutral_40ee9c3d357e7b66\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2012.01.13 15:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2011.04.18 14:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\drivers\MpNWMon.sys
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >
--- --- ---

cosinus 26.03.2012 18:42
Zitat:
O4 - HKU\S-1-5-21-1878925396-3002024494-660468303-1000..\Run: [Firefox] C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
Wieso ist der FF im Autostart, muss das sein?
Ist das rein zufällig ein gewerblich genutzter Rechner? Ich hab da einige Programme gesehen, die man nun nicht gerade privat verwendet :wtf:

Zitat:
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Win7 Pro im privaten Umfeld ist auch eher eine Nummer zu groß :pfeiff:

lowi 26.03.2012 18:42
Ist der "Firmen"Rechner meiner Eltern, die haben ein KFZ-Teile Handel
Das Win7 hab ich über die Uni gekauft :) die haben welche verschenkt und welche verkauft, lieber der Uni geld geben als dem Finanzamt ;)

cosinus 26.03.2012 18:49
Na klasse, deine Eltern wissen Bescheid was mit diesem Rechner ist? :confused:
Wenn dieser Rechner ein wichtiger Rechner in der Firma ist, dann sollte es ja auch sowas wie ein Backupkonzept bzw. Wiederherstellung im Notfall geben oder?

lowi 26.03.2012 18:55
Mmh... also die IT Beratung bin ich... sozusagen... wir haben auch keine Große Firma mit rechnernetz etc. hier gibts diesen Rechner und einen Zweiten auf dem ein DOS Fakturierungssoftware läuft.
Jedesmal wenn ein Backup fällig gewesen wäre kam ein neues Betriebssystem und somit neu aufsetzen... bis jetzt glück gehabt :)
Naja ich weiß nicht, wenn ihr mir sagt ich soll den Rechner neu machen weil es keinen Zweck hat, dann mache ich das, mit der Software hier habe ich kein Problem. Die ist vollständig vorhanden.
Ich hätte das evtl. jetzt gemacht. Wir haben leider sowas wie eine externe HDD oder so nicht.

EDIT:
Also ist dieser rechner deiner Meinung nach Sauber? Dann hole ich die wichtigen Daten runter und mache ihn neu, danach(oder davor) besorg ich mir ein anständigen Datenträger und mache eine Sicherung pro Woche. Weiß noch nicht wie genau, aber wohl mit manuellem auslösen.
Danke dir erstmal für deine geduld und das viele durchsuchen der Log's.

Mir ist noch etwas aufgefallen...
manchmal wenn man bei google etwas sucht, dann wird mann vorher auf eine URL geleitet:hxxp://brown.mydomxd.org.
da mein Vater Java deinstalliert hat, passiert danach nichts weiter.

cosinus 26.03.2012 19:58
Nein wo hab ich behauptet der Rechner wäre sauber? Ich hab nur meine Meinung gepostet und die etwas lasche Haltung kritisiert bei so einem doch wichtigen Rechner. Was wollt ihr denn ohne Backups mal machen wenn versehentlich Dateien gelöscht oder gar die Festplattte kaputtgegangen ist? :confused:

Ich würde solche "wichtigen" Rechner nach Möglichkeit lieber neu aufsetzen.

lowi 26.03.2012 20:53
Gut, Danke.
So etwas wollte ich hören.

EDIT: BTW, nicht jeder hat schon das Papierlose Büro ;)
EDIT²: Was wäre wenn der Rechner nicht so Wichtig wäre? Ich meine den Aufwand den wir hier betrieben haben war schon, relativ groß:(

cosinus 27.03.2012 10:11
Zitat:
(TuneUp Software) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
(TuneUp Software) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
Wieso muss man das System mit TuneUp belasten? Das Teil ist schon fast als Snakeoil einzustufen :balla:
Und erst recht sollte man unbedingt die Finger von der Registrycleaning-Funktion lassen!

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{d3b6d63b-70a2-11df-8416-404e57434401}\Shell - "" = AutoRun
O33 - MountPoints2\{d3b6d63b-70a2-11df-8416-404e57434401}\Shell\AutoRun\command - "" = I:\autorun.exe
[2012.03.20 10:02:08 | 000,000,456 | -H-- | M] () -- C:\ProgramData\daXg9vo6fXsgpX
[2012.03.20 10:00:27 | 000,000,264 | -H-- | M] () -- C:\ProgramData\~daXg9vo6fXsgpX
[2012.03.20 10:00:27 | 000,000,176 | -H-- | M] () -- C:\ProgramData\~daXg9vo6fXsgpXr
[2012.03.19 10:30:45 | 000,000,440 | -H-- | M] () -- C:\ProgramData\z1dYe2Bc1FTAcm
[2012.03.19 10:27:27 | 000,000,264 | -H-- | M] () -- C:\ProgramData\~z1dYe2Bc1FTAcm
[2012.03.19 10:27:27 | 000,000,176 | -H-- | M] () -- C:\ProgramData\~z1dYe2Bc1FTAcmr
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

lowi 07.04.2012 09:06
Morgen... Sorry für die Untreue zu euch...

Also ich habe das OTL laufen lassen,
Log:
Code:
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d3b6d63b-70a2-11df-8416-404e57434401}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3b6d63b-70a2-11df-8416-404e57434401}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d3b6d63b-70a2-11df-8416-404e57434401}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3b6d63b-70a2-11df-8416-404e57434401}\ not found.
File I:\autorun.exe not found.
C:\ProgramData\daXg9vo6fXsgpX moved successfully.
C:\ProgramData\~daXg9vo6fXsgpX moved successfully.
C:\ProgramData\~daXg9vo6fXsgpXr moved successfully.
C:\ProgramData\z1dYe2Bc1FTAcm moved successfully.
C:\ProgramData\~z1dYe2Bc1FTAcm moved successfully.
C:\ProgramData\~z1dYe2Bc1FTAcmr moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 134 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: KFZ-Hummel
->Temp folder emptied: 1046458119 bytes
->Temporary Internet Files folder emptied: 62380696 bytes
->FireFox cache emptied: 197805723 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 8054 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 477970 bytes
RecycleBin emptied: 26005486 bytes
 
Total Files Cleaned = 1.271,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.39.2 log created on 04072012_095623

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\hsperfdata_KFZ-HUMMEL-PC$\2156 not found!

Registry entries deleted on Reboot...
Beim Autostart vom Fuchs hat er mir einen Fehler gebracht dass die Tabs nicht geöffnet werden können. Es wird Versucht sie in einem neuen Fenster
zu öffnen. Weiter ist nichts passiert.
Fuchs von Hand gestartet, ging ohne Probleme.

So, was stellt Ihr jetzt fest :)

EDIT: Wenn ich über Google weiterleite (Also über die Suchergebnisse) dann läd er vorher häufig eine andere URL :O
Bsp.: Ich suche Telekom ISDN Universal werde auf hilfe.telekom.de geleitet, vorher jedoch über lycris.de (manchmal direkt, manchmal
nur unten in der Lade leiste und dann als Anzeige auf Telekom.de)

BTW: TuneUp == SnakeOil??? Was ?? Bis jetzt hat diese ganze Aufräum-Geschichte eigentlich immer schön funktioniert, merkbar an der Geschwindigkeit :O

cosinus 07.04.2012 17:57
TuneUp ist schrott, erst lesen => TuneUp: Wundermittel oder Placebo Reloaded | DerFisch.de
Ich würde kein Geld für sowas ausgeben


Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

lowi 21.04.2012 08:17
TDSS Killer Log mit allen Optionen Aktiv und allem auf skip
Code:
09:10:59.0864 3768        TDSS rootkit removing tool 2.7.31.0 Apr 20 2012 19:49:47
09:11:00.0222 3768        ============================================================
09:11:00.0222 3768        Current date / time: 2012/04/21 09:11:00.0222
09:11:00.0222 3768        SystemInfo:
09:11:00.0222 3768       
09:11:00.0222 3768        OS Version: 6.1.7601 ServicePack: 1.0
09:11:00.0222 3768        Product type: Workstation
09:11:00.0222 3768        ComputerName: KFZ-HUMMEL-PC
09:11:00.0222 3768        UserName: KFZ-Hummel
09:11:00.0222 3768        Windows directory: C:\Windows
09:11:00.0222 3768        System windows directory: C:\Windows
09:11:00.0222 3768        Processor architecture: Intel x86
09:11:00.0222 3768        Number of processors: 2
09:11:00.0222 3768        Page size: 0x1000
09:11:00.0222 3768        Boot type: Normal boot
09:11:00.0222 3768        ============================================================
09:11:01.0283 3768        Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0x38080, SectorsPerTrack: 0x13, TracksPerCylinder: 0xE0, Type 'K0', Flags 0x00000050
09:11:01.0283 3768        \Device\Harddisk0\DR0:
09:11:01.0283 3768        MBR partitions:
09:11:01.0283 3768        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
09:11:01.0283 3768        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xC800000
09:11:01.0283 3768        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xC832800, BlocksNum 0x2DB4E830
09:11:01.0299 3768        C: <-> \Device\Harddisk0\DR0\Partition1
09:11:01.0330 3768        D: <-> \Device\Harddisk0\DR0\Partition2
09:11:01.0330 3768        Initialize success
09:11:01.0330 3768        ============================================================
09:11:34.0663 3248        ============================================================
09:11:34.0663 3248        Scan started
09:11:34.0663 3248        Mode: Manual; SigCheck; TDLFS;
09:11:34.0663 3248        ============================================================
09:11:35.0662 3248        1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys
09:11:35.0724 3248        1394ohci - ok
09:11:35.0755 3248        ACPI            (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys
09:11:35.0771 3248        ACPI - ok
09:11:35.0787 3248        AcpiPmi        (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys
09:11:35.0833 3248        AcpiPmi - ok
09:11:35.0943 3248        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
09:11:35.0958 3248        AdobeARMservice - ok
09:11:35.0989 3248        adp94xx        (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
09:11:36.0005 3248        adp94xx - ok
09:11:36.0036 3248        adpahci        (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
09:11:36.0052 3248        adpahci - ok
09:11:36.0067 3248        adpu320        (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
09:11:36.0083 3248        adpu320 - ok
09:11:36.0099 3248        AeLookupSvc    (8b5eefeec1e6d1a72a06c526628ad161) C:\Windows\System32\aelupsvc.dll
09:11:36.0145 3248        AeLookupSvc - ok
09:11:36.0177 3248        AFD            (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys
09:11:36.0192 3248        AFD - ok
09:11:36.0208 3248        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys
09:11:36.0223 3248        agp440 - ok
09:11:36.0239 3248        aic78xx        (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
09:11:36.0255 3248        aic78xx - ok
09:11:36.0270 3248        ALG            (18a54e132947cd98fea9accc57f98f13) C:\Windows\System32\alg.exe
09:11:36.0301 3248        ALG - ok
09:11:36.0317 3248        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys
09:11:36.0333 3248        aliide - ok
09:11:36.0348 3248        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys
09:11:36.0348 3248        amdagp - ok
09:11:36.0395 3248        amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys
09:11:36.0411 3248        amdide - ok
09:11:36.0426 3248        AmdK8          (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
09:11:36.0473 3248        AmdK8 - ok
09:11:36.0489 3248        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
09:11:36.0520 3248        AmdPPM - ok
09:11:36.0551 3248        amdsata        (d320bf87125326f996d4904fe24300fc) C:\Windows\system32\drivers\amdsata.sys
09:11:36.0567 3248        amdsata - ok
09:11:36.0598 3248        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
09:11:36.0598 3248        amdsbs - ok
09:11:36.0613 3248        amdxata        (46387fb17b086d16dea267d5be23a2f2) C:\Windows\system32\drivers\amdxata.sys
09:11:36.0629 3248        amdxata - ok
09:11:36.0645 3248        AN983          (5dc7357b101aef8f5cc292bb8539f5d6) C:\Windows\system32\DRIVERS\AN983.sys
09:11:36.0691 3248        AN983 - ok
09:11:36.0707 3248        AppID          (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys
09:11:36.0738 3248        AppID - ok
09:11:36.0754 3248        AppIDSvc        (62a9c86cb6085e20db4823e4e97826f5) C:\Windows\System32\appidsvc.dll
09:11:36.0801 3248        AppIDSvc - ok
09:11:36.0832 3248        Appinfo        (fb1959012294d6ad43e5304df65e3c26) C:\Windows\System32\appinfo.dll
09:11:36.0863 3248        Appinfo - ok
09:11:36.0894 3248        AppMgmt        (a45d184df6a8803da13a0b329517a64a) C:\Windows\System32\appmgmts.dll
09:11:36.0925 3248        AppMgmt - ok
09:11:36.0941 3248        arc            (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
09:11:36.0941 3248        arc - ok
09:11:36.0972 3248        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
09:11:36.0972 3248        arcsas - ok
09:11:37.0003 3248        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
09:11:37.0097 3248        AsyncMac - ok
09:11:37.0113 3248        atapi          (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys
09:11:37.0113 3248        atapi - ok
09:11:37.0144 3248        AudioEndpointBuilder (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll
09:11:37.0175 3248        AudioEndpointBuilder - ok
09:11:37.0191 3248        Audiosrv        (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll
09:11:37.0222 3248        Audiosrv - ok
09:11:37.0284 3248        Autodata Limited License Service (0d52aa08491a827fba10de8de0e2885f) C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
09:11:37.0284 3248        Autodata Limited License Service ( UnsignedFile.Multi.Generic ) - warning
09:11:37.0284 3248        Autodata Limited License Service - detected UnsignedFile.Multi.Generic (1)
09:11:37.0331 3248        AVMCOWAN        (d730aa8494ec4c8c6c976f5eb04d3ac2) C:\Windows\system32\DRIVERS\AVMCOWAN.sys
09:11:37.0378 3248        AVMCOWAN - ok
09:11:37.0409 3248        AxInstSV        (6e30d02aac9cac84f421622e3a2f6178) C:\Windows\System32\AxInstSV.dll
09:11:37.0456 3248        AxInstSV - ok
09:11:37.0487 3248        b06bdrv        (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
09:11:37.0518 3248        b06bdrv - ok
09:11:37.0534 3248        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
09:11:37.0549 3248        b57nd60x - ok
09:11:37.0581 3248        BDESVC          (ee1e9c3bb8228ae423dd38db69128e71) C:\Windows\System32\bdesvc.dll
09:11:37.0612 3248        BDESVC - ok
09:11:37.0627 3248        Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
09:11:37.0674 3248        Beep - ok
09:11:37.0705 3248        BFE            (1e2bac209d184bb851e1a187d8a29136) C:\Windows\System32\bfe.dll
09:11:37.0752 3248        BFE - ok
09:11:37.0815 3248        BITS            (e585445d5021971fae10393f0f1c3961) C:\Windows\System32\qmgr.dll
09:11:37.0861 3248        BITS - ok
09:11:37.0877 3248        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
09:11:37.0908 3248        blbdrive - ok
09:11:37.0939 3248        bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys
09:11:37.0971 3248        bowser - ok
09:11:37.0986 3248        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
09:11:38.0017 3248        BrFiltLo - ok
09:11:38.0033 3248        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
09:11:38.0049 3248        BrFiltUp - ok
09:11:38.0080 3248        Browser        (6e11f33d14d020f58d5e02e4d67dfa19) C:\Windows\System32\browser.dll
09:11:38.0111 3248        Browser - ok
09:11:38.0142 3248        Brserid        (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
09:11:38.0173 3248        Brserid - ok
09:11:38.0205 3248        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
09:11:38.0236 3248        BrSerWdm - ok
09:11:38.0251 3248        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
09:11:38.0283 3248        BrUsbMdm - ok
09:11:38.0298 3248        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
09:11:38.0314 3248        BrUsbSer - ok
09:11:38.0329 3248        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
09:11:38.0361 3248        BTHMODEM - ok
09:11:38.0392 3248        bthserv        (1df19c96eef6c29d1c3e1a8678e07190) C:\Windows\system32\bthserv.dll
09:11:38.0407 3248        bthserv - ok
09:11:38.0423 3248        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
09:11:38.0454 3248        cdfs - ok
09:11:38.0485 3248        cdrom          (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\drivers\cdrom.sys
09:11:38.0501 3248        cdrom - ok
09:11:38.0532 3248        CertPropSvc    (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll
09:11:38.0563 3248        CertPropSvc - ok
09:11:38.0579 3248        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
09:11:38.0595 3248        circlass - ok
09:11:38.0610 3248        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
09:11:38.0626 3248        CLFS - ok
09:11:38.0688 3248        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
09:11:38.0704 3248        clr_optimization_v2.0.50727_32 - ok
09:11:38.0766 3248        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
09:11:38.0782 3248        clr_optimization_v4.0.30319_32 - ok
09:11:38.0797 3248        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
09:11:38.0797 3248        CmBatt - ok
09:11:38.0829 3248        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys
09:11:38.0829 3248        cmdide - ok
09:11:38.0875 3248        CNG            (6427525d76f61d0c519b008d3680e8e7) C:\Windows\system32\Drivers\cng.sys
09:11:38.0891 3248        CNG - ok
09:11:38.0907 3248        Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
09:11:38.0922 3248        Compbatt - ok
09:11:38.0938 3248        CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys
09:11:38.0969 3248        CompositeBus - ok
09:11:38.0969 3248        COMSysApp - ok
09:11:38.0985 3248        crcdisk        (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
09:11:39.0000 3248        crcdisk - ok
09:11:39.0000 3248        Crypkey License - ok
09:11:39.0031 3248        CryptSvc        (a585bebf7d054bd9618eda0922d5484a) C:\Windows\system32\cryptsvc.dll
09:11:39.0078 3248        CryptSvc - ok
09:11:39.0109 3248        CSC            (3c2177a897b4ca2788c6fb0c3fd81d4b) C:\Windows\system32\drivers\csc.sys
09:11:39.0156 3248        CSC - ok
09:11:39.0172 3248        CscService      (15f93b37f6801943360d9eb42485d5d3) C:\Windows\System32\cscsvc.dll
09:11:39.0187 3248        CscService - ok
09:11:39.0203 3248        DcomLaunch      (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll
09:11:39.0250 3248        DcomLaunch - ok
09:11:39.0281 3248        defragsvc      (8d6e10a2d9a5eed59562d9b82cf804e1) C:\Windows\System32\defragsvc.dll
09:11:39.0312 3248        defragsvc - ok
09:11:39.0343 3248        DfsC            (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys
09:11:39.0375 3248        DfsC - ok
09:11:39.0406 3248        Dhcp            (e9e01eb683c132f7fa27cd607b8a2b63) C:\Windows\system32\dhcpcore.dll
09:11:39.0453 3248        Dhcp - ok
09:11:39.0468 3248        discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
09:11:39.0499 3248        discache - ok
09:11:39.0515 3248        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
09:11:39.0531 3248        Disk - ok
09:11:39.0562 3248        Dnscache        (33ef4861f19a0736b11314aad9ae28d0) C:\Windows\System32\dnsrslvr.dll
09:11:39.0577 3248        Dnscache - ok
09:11:39.0609 3248        dot3svc        (366ba8fb4b7bb7435e3b9eacb3843f67) C:\Windows\System32\dot3svc.dll
09:11:39.0655 3248        dot3svc - ok
09:11:39.0671 3248        DPS            (8ec04ca86f1d68da9e11952eb85973d6) C:\Windows\system32\dps.dll
09:11:39.0702 3248        DPS - ok
09:11:39.0733 3248        drmkaud        (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
09:11:39.0749 3248        drmkaud - ok
09:11:39.0780 3248        DXGKrnl        (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys
09:11:39.0811 3248        DXGKrnl - ok
09:11:39.0843 3248        EapHost        (8600142fa91c1b96367d3300ad0f3f3a) C:\Windows\System32\eapsvc.dll
09:11:39.0874 3248        EapHost - ok
09:11:39.0936 3248        ebdrv          (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
09:11:40.0030 3248        ebdrv - ok
09:11:40.0061 3248        EFS            (81951f51e318aecc2d68559e47485cc4) C:\Windows\System32\lsass.exe
09:11:40.0108 3248        EFS - ok
09:11:40.0123 3248        elxstor        (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
09:11:40.0155 3248        elxstor - ok
09:11:40.0170 3248        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys
09:11:40.0201 3248        ErrDev - ok
09:11:40.0233 3248        EventSystem    (f6916efc29d9953d5d0df06882ae8e16) C:\Windows\system32\es.dll
09:11:40.0279 3248        EventSystem - ok
09:11:40.0295 3248        exfat          (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
09:11:40.0342 3248        exfat - ok
09:11:40.0357 3248        fastfat        (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
09:11:40.0389 3248        fastfat - ok
09:11:40.0435 3248        Fax            (967ea5b213e9984cbe270205df37755b) C:\Windows\system32\fxssvc.exe
09:11:40.0467 3248        Fax - ok
09:11:40.0482 3248        fdc            (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
09:11:40.0513 3248        fdc - ok
09:11:40.0529 3248        fdPHost        (f3222c893bd2f5821a0179e5c71e88fb) C:\Windows\system32\fdPHost.dll
09:11:40.0560 3248        fdPHost - ok
09:11:40.0576 3248        FDResPub        (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\Windows\system32\fdrespub.dll
09:11:40.0607 3248        FDResPub - ok
09:11:40.0623 3248        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
09:11:40.0623 3248        FileInfo - ok
09:11:40.0654 3248        Filetrace      (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
09:11:40.0685 3248        Filetrace - ok
09:11:40.0716 3248        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
09:11:40.0732 3248        flpydisk - ok
09:11:40.0747 3248        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
09:11:40.0763 3248        FltMgr - ok
09:11:40.0810 3248        FontCache      (b3a5ec6b6b6673db7e87c2bcdbddc074) C:\Windows\system32\FntCache.dll
09:11:40.0857 3248        FontCache - ok
09:11:40.0919 3248        FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
09:11:40.0919 3248        FontCache3.0.0.0 - ok
09:11:40.0966 3248        FPCIBASE        (58992bb216d65a3165be62b21b0b4196) C:\Windows\system32\DRIVERS\fpcibase.sys
09:11:40.0997 3248        FPCIBASE - ok
09:11:41.0028 3248        FsDepends      (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
09:11:41.0028 3248        FsDepends - ok
09:11:41.0059 3248        Fs_Rec          (7dae5ebcc80e45d3253f4923dc424d05) C:\Windows\system32\drivers\Fs_Rec.sys
09:11:41.0075 3248        Fs_Rec - ok
09:11:41.0106 3248        fvevol          (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys
09:11:41.0122 3248        fvevol - ok
09:11:41.0137 3248        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
09:11:41.0137 3248        gagp30kx - ok
09:11:41.0169 3248        gpsvc          (e897eaf5ed6ba41e081060c9b447a673) C:\Windows\System32\gpsvc.dll
09:11:41.0215 3248        gpsvc - ok
09:11:41.0262 3248        gupdate        (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
09:11:41.0262 3248        gupdate - ok
09:11:41.0278 3248        gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
09:11:41.0293 3248        gupdatem - ok
09:11:41.0293 3248        Hardlock - ok
09:11:41.0309 3248        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
09:11:41.0340 3248        hcw85cir - ok
09:11:41.0371 3248        HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\Windows\system32\drivers\HdAudio.sys
09:11:41.0403 3248        HdAudAddService - ok
09:11:41.0434 3248        HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys
09:11:41.0465 3248        HDAudBus - ok
09:11:41.0481 3248        HidBatt        (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
09:11:41.0496 3248        HidBatt - ok
09:11:41.0512 3248        HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
09:11:41.0543 3248        HidBth - ok
09:11:41.0543 3248        HidIr          (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
09:11:41.0559 3248        HidIr - ok
09:11:41.0590 3248        hidserv        (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\Windows\system32\hidserv.dll
09:11:41.0621 3248        hidserv - ok
09:11:41.0637 3248        HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\drivers\hidusb.sys
09:11:41.0652 3248        HidUsb - ok
09:11:41.0683 3248        hkmsvc          (196b4e3f4cccc24af836ce58facbb699) C:\Windows\system32\kmsvc.dll
09:11:41.0715 3248        hkmsvc - ok
09:11:41.0746 3248        HomeGroupListener (6658f4404de03d75fe3ba09f7aba6a30) C:\Windows\system32\ListSvc.dll
09:11:41.0777 3248        HomeGroupListener - ok
09:11:41.0808 3248        HomeGroupProvider (dbc02d918fff1cad628acbe0c0eaa8e8) C:\Windows\system32\provsvc.dll
09:11:41.0839 3248        HomeGroupProvider - ok
09:11:41.0871 3248        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys
09:11:41.0871 3248        HpSAMD - ok
09:11:41.0917 3248        HTTP            (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys
09:11:41.0933 3248        HTTP - ok
09:11:41.0964 3248        hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys
09:11:41.0964 3248        hwpolicy - ok
09:11:41.0995 3248        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys
09:11:42.0027 3248        i8042prt - ok
09:11:42.0058 3248        iaStorV        (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\Windows\system32\drivers\iaStorV.sys
09:11:42.0073 3248        iaStorV - ok
09:11:42.0151 3248        idsvc          (c521d7eb6497bb1af6afa89e322fb43c) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
09:11:42.0183 3248        idsvc - ok
09:11:42.0214 3248        iirsp          (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
09:11:42.0214 3248        iirsp - ok
09:11:42.0245 3248        IKEEXT          (f95622f161474511b8d80d6b093aa610) C:\Windows\System32\ikeext.dll
09:11:42.0292 3248        IKEEXT - ok
09:11:42.0385 3248        IntcAzAudAddService (b38852f597f0e0d1cffe11a19a08a9d9) C:\Windows\system32\drivers\RTKVHDA.sys
09:11:42.0744 3248        IntcAzAudAddService - ok
09:11:42.0760 3248        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys
09:11:42.0775 3248        intelide - ok
09:11:42.0791 3248        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
09:11:42.0807 3248        intelppm - ok
09:11:42.0838 3248        IPBusEnum      (acb364b9075a45c0736e5c47be5cae19) C:\Windows\system32\ipbusenum.dll
09:11:42.0869 3248        IPBusEnum - ok
09:11:42.0885 3248        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
09:11:42.0931 3248        IpFilterDriver - ok
09:11:42.0963 3248        iphlpsvc        (4d65a07b795d6674312f879d09aa7663) C:\Windows\System32\iphlpsvc.dll
09:11:42.0994 3248        iphlpsvc - ok
09:11:43.0025 3248        IPMIDRV        (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys
09:11:43.0056 3248        IPMIDRV - ok
09:11:43.0072 3248        IPNAT          (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
09:11:43.0119 3248        IPNAT - ok
09:11:43.0134 3248        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
09:11:43.0165 3248        IRENUM - ok
09:11:43.0197 3248        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys
09:11:43.0197 3248        isapnp - ok
09:11:43.0228 3248        iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys
09:11:43.0243 3248        iScsiPrt - ok
09:11:43.0275 3248        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\drivers\kbdclass.sys
09:11:43.0290 3248        kbdclass - ok
09:11:43.0321 3248        kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\drivers\kbdhid.sys
09:11:43.0353 3248        kbdhid - ok
09:11:43.0384 3248        KeyIso          (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
09:11:43.0399 3248        KeyIso - ok
09:11:43.0415 3248        KMService      (4635935fc972c582632bf45c26bfcb0e) C:\Windows\system32\srvany.exe
09:11:43.0446 3248        KMService ( UnsignedFile.Multi.Generic ) - warning
09:11:43.0446 3248        KMService - detected UnsignedFile.Multi.Generic (1)
09:11:43.0462 3248        KSecDD          (f4647bb23db9038a7536cf6b68f4207f) C:\Windows\system32\Drivers\ksecdd.sys
09:11:43.0462 3248        KSecDD - ok
09:11:43.0477 3248        KSecPkg        (e73cae53bbb72ba26918492c6b4c229d) C:\Windows\system32\Drivers\ksecpkg.sys
09:11:43.0493 3248        KSecPkg - ok
09:11:43.0509 3248        KtmRm          (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\Windows\system32\msdtckrm.dll
09:11:43.0555 3248        KtmRm - ok
09:11:43.0602 3248        LanmanServer    (d64af876d53eca3668bb97b51b4e70ab) C:\Windows\system32\srvsvc.dll
09:11:43.0649 3248        LanmanServer - ok
09:11:43.0665 3248        LanmanWorkstation (58405e4f68ba8e4057c6e914f326aba2) C:\Windows\System32\wkssvc.dll
09:11:43.0711 3248        LanmanWorkstation - ok
09:11:43.0774 3248        LcSvrAdm        (0133518cc3624d173f997d21e9e9d2a2) c:\ElsaWin\bin\LcSvrAdm.exe
09:11:43.0805 3248        LcSvrAdm ( UnsignedFile.Multi.Generic ) - warning
09:11:43.0805 3248        LcSvrAdm - detected UnsignedFile.Multi.Generic (1)
09:11:43.0836 3248        LcSvrAuf        (904704ffb404b8a1d27023230a14ef12) c:\ElsaWin\bin\LcSvrAuf.exe
09:11:43.0867 3248        LcSvrAuf ( UnsignedFile.Multi.Generic ) - warning
09:11:43.0867 3248        LcSvrAuf - detected UnsignedFile.Multi.Generic (1)
09:11:43.0883 3248        LcSvrDba        (78d2af7ea8c7668aacc78082cfba1894) c:\ElsaWin\bin\LcSvrDba.exe
09:11:43.0899 3248        LcSvrDba ( UnsignedFile.Multi.Generic ) - warning
09:11:43.0899 3248        LcSvrDba - detected UnsignedFile.Multi.Generic (1)
09:11:43.0914 3248        LcSvrHis        (59dc1ac0cce60325b35d724094043544) c:\ElsaWin\bin\LcSvrHis.exe
09:11:43.0930 3248        LcSvrHis ( UnsignedFile.Multi.Generic ) - warning
09:11:43.0930 3248        LcSvrHis - detected UnsignedFile.Multi.Generic (1)
09:11:43.0945 3248        LcSvrPAS        (da76d1c6bd8f439c827917102c4371ca) c:\ElsaWin\bin\LcSvrPas.exe
09:11:43.0977 3248        LcSvrPAS ( UnsignedFile.Multi.Generic ) - warning
09:11:43.0977 3248        LcSvrPAS - detected UnsignedFile.Multi.Generic (1)
09:11:43.0992 3248        LcSvrSaz        (8e5bb98631d87975ac1fe0453f34b449) c:\ElsaWin\bin\LcSvrSaz.exe
09:11:44.0008 3248        LcSvrSaz ( UnsignedFile.Multi.Generic ) - warning
09:11:44.0008 3248        LcSvrSaz - detected UnsignedFile.Multi.Generic (1)
09:11:44.0055 3248        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
09:11:44.0086 3248        lltdio - ok
09:11:44.0117 3248        lltdsvc        (5700673e13a2117fa3b9020c852c01e2) C:\Windows\System32\lltdsvc.dll
09:11:44.0148 3248        lltdsvc - ok
09:11:44.0148 3248        lmhosts        (55ca01ba19d0006c8f2639b6c045e08b) C:\Windows\System32\lmhsvc.dll
09:11:44.0195 3248        lmhosts - ok
09:11:44.0211 3248        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
09:11:44.0226 3248        LSI_FC - ok
09:11:44.0226 3248        LSI_SAS        (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
09:11:44.0242 3248        LSI_SAS - ok
09:11:44.0257 3248        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
09:11:44.0273 3248        LSI_SAS2 - ok
09:11:44.0289 3248        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
09:11:44.0304 3248        LSI_SCSI - ok
09:11:44.0320 3248        luafv          (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
09:11:44.0335 3248        luafv - ok
09:11:44.0351 3248        megasas        (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
09:11:44.0367 3248        megasas - ok
09:11:44.0382 3248        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
09:11:44.0398 3248        MegaSR - ok
09:11:44.0413 3248        MMCSS          (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
09:11:44.0460 3248        MMCSS - ok
09:11:44.0476 3248        Modem          (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
09:11:44.0507 3248        Modem - ok
09:11:44.0523 3248        monitor        (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
09:11:44.0554 3248        monitor - ok
09:11:44.0569 3248        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\drivers\mouclass.sys
09:11:44.0585 3248        mouclass - ok
09:11:44.0585 3248        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
09:11:44.0601 3248        mouhid - ok
09:11:44.0647 3248        mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys
09:11:44.0647 3248        mountmgr - ok
09:11:44.0679 3248        MpFilter        (fee0baded54222e9f1dae9541212aab1) C:\Windows\system32\DRIVERS\MpFilter.sys
09:11:44.0694 3248        MpFilter - ok
09:11:44.0725 3248        mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys
09:11:44.0741 3248        mpio - ok
09:11:44.0757 3248        MpNWMon        (2c3489660d4a8d514c123c3f0d67df46) C:\Windows\system32\DRIVERS\MpNWMon.sys
09:11:44.0757 3248        MpNWMon - ok
09:11:44.0772 3248        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
09:11:44.0819 3248        mpsdrv - ok
09:11:44.0850 3248        MpsSvc          (9835584e999d25004e1ee8e5f3e3b881) C:\Windows\system32\mpssvc.dll
09:11:44.0897 3248        MpsSvc - ok
09:11:44.0928 3248        MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys
09:11:44.0928 3248        MRxDAV - ok
09:11:44.0975 3248        mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys
09:11:45.0006 3248        mrxsmb - ok
09:11:45.0037 3248        mrxsmb10        (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys
09:11:45.0069 3248        mrxsmb10 - ok
09:11:45.0100 3248        mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys
09:11:45.0115 3248        mrxsmb20 - ok
09:11:45.0162 3248        msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys
09:11:45.0162 3248        msahci - ok
09:11:45.0178 3248        msdsm          (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys
09:11:45.0193 3248        msdsm - ok
09:11:45.0225 3248        MSDTC          (e1bce74a3bd9902b72599c0192a07e27) C:\Windows\System32\msdtc.exe
09:11:45.0240 3248        MSDTC - ok
09:11:45.0271 3248        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
09:11:45.0303 3248        Msfs - ok
09:11:45.0318 3248        mshidkmdf      (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
09:11:45.0349 3248        mshidkmdf - ok
09:11:45.0381 3248        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys
09:11:45.0396 3248        msisadrv - ok
09:11:45.0427 3248        MSiSCSI        (90f7d9e6b6f27e1a707d4a297f077828) C:\Windows\system32\iscsiexe.dll
09:11:45.0459 3248        MSiSCSI - ok
09:11:45.0459 3248        msiserver - ok
09:11:45.0490 3248        MSKSSRV        (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
09:11:45.0505 3248        MSKSSRV - ok
09:11:45.0583 3248        MsMpSvc        (cfce43b70ca0cc4dcc8adb62b792b173) C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
09:11:45.0599 3248        MsMpSvc - ok
09:11:45.0615 3248        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
09:11:45.0646 3248        MSPCLOCK - ok
09:11:45.0661 3248        MSPQM          (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
09:11:45.0693 3248        MSPQM - ok
09:11:45.0724 3248        MsRPC          (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
09:11:45.0739 3248        MsRPC - ok
09:11:45.0755 3248        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys
09:11:45.0771 3248        mssmbios - ok
09:11:45.0786 3248        MSTEE          (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
09:11:45.0802 3248        MSTEE - ok
09:11:45.0833 3248        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
09:11:45.0833 3248        MTConfig - ok
09:11:45.0864 3248        MTsensor        (d48659bb24c48345d926ecb45c1ebdf5) C:\Windows\system32\DRIVERS\ASACPI.sys
09:11:45.0880 3248        MTsensor - ok
09:11:45.0895 3248        Mup            (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
09:11:45.0911 3248        Mup - ok
09:11:45.0942 3248        napagent        (61d57a5d7c6d9afe10e77dae6e1b445e) C:\Windows\system32\qagentRT.dll
09:11:45.0973 3248        napagent - ok
09:11:46.0020 3248        NativeWifiP    (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
09:11:46.0036 3248        NativeWifiP - ok
09:11:46.0067 3248        NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\Windows\system32\drivers\ndis.sys
09:11:46.0114 3248        NDIS - ok
09:11:46.0114 3248        NdisCap        (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
09:11:46.0145 3248        NdisCap - ok
09:11:46.0176 3248        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
09:11:46.0207 3248        NdisTapi - ok
09:11:46.0239 3248        Ndisuio        (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys
09:11:46.0270 3248        Ndisuio - ok
09:11:46.0285 3248        NdisWan        (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys
09:11:46.0317 3248        NdisWan - ok
09:11:46.0348 3248        NDProxy        (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys
09:11:46.0379 3248        NDProxy - ok
09:11:46.0395 3248        NetBIOS        (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
09:11:46.0441 3248        NetBIOS - ok
09:11:46.0473 3248        NetBT          (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys
09:11:46.0519 3248        NetBT - ok
09:11:46.0551 3248        Netlogon        (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
09:11:46.0551 3248        Netlogon - ok
09:11:46.0582 3248        Netman          (7cccfca7510684768da22092d1fa4db2) C:\Windows\System32\netman.dll
09:11:46.0629 3248        Netman - ok
09:11:46.0660 3248        netprofm        (8c338238c16777a802d6a9211eb2ba50) C:\Windows\System32\netprofm.dll
09:11:46.0707 3248        netprofm - ok
09:11:46.0769 3248        NetTcpPortSharing (f476ec40033cdb91efbe73eb99b8362d) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
09:11:46.0769 3248        NetTcpPortSharing - ok
09:11:46.0800 3248        NetworkX        (9446d03271baf3496bbd2957d2732fd2) C:\Windows\system32\ckldrv.sys
09:11:46.0816 3248        NetworkX - ok
09:11:46.0925 3248        Netzmanager Service (70b5b4e69a07895df30291cab6abda54) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
09:11:46.0987 3248        Netzmanager Service ( UnsignedFile.Multi.Generic ) - warning
09:11:46.0987 3248        Netzmanager Service - detected UnsignedFile.Multi.Generic (1)
09:11:47.0034 3248        nfrd960        (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
09:11:47.0050 3248        nfrd960 - ok
09:11:47.0081 3248        NisDrv          (7b01c6172cfd0b10116175e09200d4b4) C:\Windows\system32\DRIVERS\NisDrvWFP.sys
09:11:47.0081 3248        NisDrv - ok
09:11:47.0112 3248        NisSrv          (a5cb074f34bbd89948e34a630d459c0c) C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
09:11:47.0128 3248        NisSrv - ok
09:11:47.0143 3248        NlaSvc          (912084381d30d8b89ec4e293053f4710) C:\Windows\System32\nlasvc.dll
09:11:47.0175 3248        NlaSvc - ok
09:11:47.0206 3248        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
09:11:47.0237 3248        Npfs - ok
09:11:47.0268 3248        NSHE            (f8e396f5e703d7a8f37d90f59c776268) C:\Windows\system32\Drivers\NSHE.SYS
09:11:47.0284 3248        NSHE ( UnsignedFile.Multi.Generic ) - warning
09:11:47.0284 3248        NSHE - detected UnsignedFile.Multi.Generic (1)
09:11:47.0315 3248        nsi            (ba387e955e890c8a88306d9b8d06bf17) C:\Windows\system32\nsisvc.dll
09:11:47.0346 3248        nsi - ok
09:11:47.0362 3248        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
09:11:47.0393 3248        nsiproxy - ok
09:11:47.0455 3248        Ntfs            (81189c3d7763838e55c397759d49007a) C:\Windows\system32\drivers\Ntfs.sys
09:11:47.0487 3248        Ntfs - ok
09:11:47.0518 3248        Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
09:11:47.0549 3248        Null - ok
09:11:47.0580 3248        NVENETFD        (b5e37e31c053bc9950455a257526514b) C:\Windows\system32\DRIVERS\nvm62x32.sys
09:11:47.0596 3248        NVENETFD - ok
09:11:47.0814 3248        nvlddmkm        (377140a534d013bd661c69f1741de43c) C:\Windows\system32\DRIVERS\nvlddmkm.sys
09:11:47.0955 3248        nvlddmkm - ok
09:11:47.0970 3248        NVNET          (1de923088878b495cd4219e47ba34eb8) C:\Windows\system32\DRIVERS\nvmf6232.sys
09:11:47.0986 3248        NVNET - ok
09:11:48.0017 3248        nvraid          (b3e25ee28883877076e0e1ff877d02e0) C:\Windows\system32\drivers\nvraid.sys
09:11:48.0033 3248        nvraid - ok
09:11:48.0064 3248        nvstor          (4380e59a170d88c4f1022eff6719a8a4) C:\Windows\system32\drivers\nvstor.sys
09:11:48.0064 3248        nvstor - ok
09:11:48.0095 3248        nvstor32        (3ff57a9a657c9690ecbc8b1e3b6e3979) C:\Windows\system32\DRIVERS\nvstor32.sys
09:11:48.0111 3248        nvstor32 - ok
09:11:48.0126 3248        nvsvc          (4ed813efd77a9b7e57e341cdc1c5cbc4) C:\Windows\system32\nvvsvc.exe
09:11:48.0126 3248        nvsvc - ok
09:11:48.0173 3248        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys
09:11:48.0173 3248        nv_agp - ok
09:11:48.0204 3248        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys
09:11:48.0220 3248        ohci1394 - ok
09:11:48.0282 3248        ose            (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
09:11:48.0282 3248        ose - ok
09:11:48.0407 3248        osppsvc        (358a9cca612c68eb2f07ddad4ce1d8d7) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
09:11:48.0547 3248        osppsvc - ok
09:11:48.0579 3248        p2pimsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
09:11:48.0625 3248        p2pimsvc - ok
09:11:48.0657 3248        p2psvc          (59c3ddd501e39e006dac31bf55150d91) C:\Windows\system32\p2psvc.dll
09:11:48.0672 3248        p2psvc - ok
09:11:48.0703 3248        Parport        (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
09:11:48.0719 3248        Parport - ok
09:11:48.0750 3248        partmgr        (bf8f6af06da75b336f07e23aef97d93b) C:\Windows\system32\drivers\partmgr.sys
09:11:48.0750 3248        partmgr - ok
09:11:48.0781 3248        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
09:11:48.0797 3248        Parvdm - ok
09:11:48.0828 3248        PcaSvc          (358ab7956d3160000726574083dfc8a6) C:\Windows\System32\pcasvc.dll
09:11:48.0844 3248        PcaSvc - ok
09:11:48.0875 3248        pci            (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys
09:11:48.0891 3248        pci - ok
09:11:48.0891 3248        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys
09:11:48.0906 3248        pciide - ok
09:11:48.0922 3248        pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
09:11:48.0937 3248        pcmcia - ok
09:11:48.0953 3248        pcw            (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
09:11:48.0969 3248        pcw - ok
09:11:48.0984 3248        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
09:11:49.0031 3248        PEAUTH - ok
09:11:49.0078 3248        PeerDistSvc    (af4d64d2a57b9772cf3801950b8058a6) C:\Windows\system32\peerdistsvc.dll
09:11:49.0125 3248        PeerDistSvc - ok
09:11:49.0171 3248        pla            (414bba67a3ded1d28437eb66aeb8a720) C:\Windows\system32\pla.dll
09:11:49.0249 3248        pla - ok
09:11:49.0281 3248        PlugPlay        (ec7bc28d207da09e79b3e9faf8b232ca) C:\Windows\system32\umpnpmgr.dll
09:11:49.0312 3248        PlugPlay - ok
09:11:49.0343 3248        PNRPAutoReg    (63ff8572611249931eb16bb8eed6afc8) C:\Windows\system32\pnrpauto.dll
09:11:49.0374 3248        PNRPAutoReg - ok
09:11:49.0390 3248        PNRPsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
09:11:49.0405 3248        PNRPsvc - ok
09:11:49.0437 3248        PolicyAgent    (53946b69ba0836bd95b03759530c81ec) C:\Windows\System32\ipsecsvc.dll
09:11:49.0468 3248        PolicyAgent - ok
09:11:49.0515 3248        Power          (f87d30e72e03d579a5199ccb3831d6ea) C:\Windows\system32\umpo.dll
09:11:49.0530 3248        Power - ok
09:11:49.0577 3248        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
09:11:49.0593 3248        PptpMiniport - ok
09:11:49.0624 3248        Processor      (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
09:11:49.0639 3248        Processor - ok
09:11:49.0671 3248        ProfSvc        (43ca4ccc22d52fb58e8988f0198851d0) C:\Windows\system32\profsvc.dll
09:11:49.0702 3248        ProfSvc - ok
09:11:49.0733 3248        ProtectedStorage (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
09:11:49.0749 3248        ProtectedStorage - ok
09:11:49.0780 3248        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
09:11:49.0811 3248        Psched - ok
09:11:49.0842 3248        PTBSync - ok
09:11:49.0889 3248        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
09:11:49.0936 3248        ql2300 - ok
09:11:49.0967 3248        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
09:11:49.0967 3248        ql40xx - ok
09:11:49.0998 3248        QWAVE          (31ac809e7707eb580b2bdb760390765a) C:\Windows\system32\qwave.dll
09:11:50.0014 3248        QWAVE - ok
09:11:50.0045 3248        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
09:11:50.0061 3248        QWAVEdrv - ok
09:11:50.0076 3248        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
09:11:50.0107 3248        RasAcd - ok
09:11:50.0123 3248        RasAgileVpn    (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
09:11:50.0154 3248        RasAgileVpn - ok
09:11:50.0170 3248        RasAuto        (a60f1839849c0c00739787fd5ec03f13) C:\Windows\System32\rasauto.dll
09:11:50.0201 3248        RasAuto - ok
09:11:50.0201 3248        Rasl2tp        (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
09:11:50.0232 3248        Rasl2tp - ok
09:11:50.0279 3248        RasMan          (cb9e04dc05eacf5b9a36ca276d475006) C:\Windows\System32\rasmans.dll
09:11:50.0310 3248        RasMan - ok
09:11:50.0326 3248        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
09:11:50.0341 3248        RasPppoe - ok
09:11:50.0341 3248        RasSstp        (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
09:11:50.0373 3248        RasSstp - ok
09:11:50.0404 3248        rdbss          (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys
09:11:50.0451 3248        rdbss - ok
09:11:50.0451 3248        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
09:11:50.0482 3248        rdpbus - ok
09:11:50.0513 3248        RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys
09:11:50.0544 3248        RDPCDD - ok
09:11:50.0560 3248        RDPDR          (b973fcfc50dc1434e1970a146f7e3885) C:\Windows\system32\drivers\rdpdr.sys
09:11:50.0591 3248        RDPDR - ok
09:11:50.0607 3248        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
09:11:50.0622 3248        RDPENCDD - ok
09:11:50.0638 3248        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
09:11:50.0653 3248        RDPREFMP - ok
09:11:50.0685 3248        RDPWD          (244c83332f44589ae98fc347f11b2693) C:\Windows\system32\drivers\RDPWD.sys
09:11:50.0716 3248        RDPWD - ok
09:11:50.0747 3248        rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys
09:11:50.0763 3248        rdyboost - ok
09:11:50.0809 3248        RemoteAccess    (7b5e1419717fac363a31cc302895217a) C:\Windows\System32\mprdim.dll
09:11:50.0841 3248        RemoteAccess - ok
09:11:50.0872 3248        RemoteRegistry  (cb9a8683f4ef2bf99e123d79950d7935) C:\Windows\system32\regsvc.dll
09:11:50.0887 3248        RemoteRegistry - ok
09:11:50.0919 3248        RpcEptMapper    (78d072f35bc45d9e4e1b61895c152234) C:\Windows\System32\RpcEpMap.dll
09:11:50.0934 3248        RpcEptMapper - ok
09:11:50.0950 3248        RpcLocator      (94d36c0e44677dd26981d2bfeef2a29d) C:\Windows\system32\locator.exe
09:11:50.0965 3248        RpcLocator - ok
09:11:50.0981 3248        RpcSs          (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll
09:11:51.0012 3248        RpcSs - ok
09:11:51.0012 3248        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
09:11:51.0043 3248        rspndr - ok
09:11:51.0075 3248        RTLWUSB        (26b8b7b8afd1bc7a447144fa3a2a21a5) C:\Windows\system32\DRIVERS\RTL8187.sys
09:11:51.0090 3248        RTLWUSB ( UnsignedFile.Multi.Generic ) - warning
09:11:51.0090 3248        RTLWUSB - detected UnsignedFile.Multi.Generic (1)
09:11:51.0121 3248        s3cap          (7fa7f2e249a5dcbb7970630e15e1f482) C:\Windows\system32\drivers\vms3cap.sys
09:11:51.0168 3248        s3cap - ok
09:11:51.0184 3248        SamSs          (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
09:11:51.0199 3248        SamSs - ok
09:11:51.0231 3248        sbp2port        (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys
09:11:51.0246 3248        sbp2port - ok
09:11:51.0277 3248        SCardSvr        (8fc518ffe9519c2631d37515a68009c4) C:\Windows\System32\SCardSvr.dll
09:11:51.0293 3248        SCardSvr - ok
09:11:51.0324 3248        scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys
09:11:51.0355 3248        scfilter - ok
09:11:51.0402 3248        Schedule        (a04bb13f8a72f8b6e8b4071723e4e336) C:\Windows\system32\schedsvc.dll
09:11:51.0449 3248        Schedule - ok
09:11:51.0480 3248        SCPolicySvc    (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll
09:11:51.0496 3248        SCPolicySvc - ok
09:11:51.0543 3248        SDRSVC          (08236c4bce5edd0a0318a438af28e0f7) C:\Windows\System32\SDRSVC.dll
09:11:51.0558 3248        SDRSVC - ok
09:11:51.0589 3248        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
09:11:51.0636 3248        secdrv - ok
09:11:51.0652 3248        seclogon        (a59b3a4442c52060cc7a85293aa3546f) C:\Windows\system32\seclogon.dll
09:11:51.0699 3248        seclogon - ok
09:11:51.0714 3248        SelectDoc DB - ok
09:11:51.0730 3248        SENS            (dcb7fcdcc97f87360f75d77425b81737) C:\Windows\System32\sens.dll
09:11:51.0777 3248        SENS - ok
09:11:51.0792 3248        SensrSvc        (50087fe1ee447009c9cc2997b90de53f) C:\Windows\system32\sensrsvc.dll
09:11:51.0808 3248        SensrSvc - ok
09:11:51.0823 3248        Serenum        (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
09:11:51.0839 3248        Serenum - ok
09:11:51.0870 3248        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
09:11:51.0901 3248        Serial - ok
09:11:51.0917 3248        sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
09:11:51.0948 3248        sermouse - ok
09:11:51.0995 3248        SessionEnv      (4ae380f39a0032eab7dd953030b26d28) C:\Windows\system32\sessenv.dll
09:11:52.0026 3248        SessionEnv - ok
09:11:52.0057 3248        sffdisk        (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys
09:11:52.0073 3248        sffdisk - ok
09:11:52.0104 3248        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys
09:11:52.0120 3248        sffp_mmc - ok
09:11:52.0135 3248        sffp_sd        (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys
09:11:52.0151 3248        sffp_sd - ok
09:11:52.0167 3248        sfloppy        (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
09:11:52.0182 3248        sfloppy - ok
09:11:52.0245 3248        SharedAccess    (d1a079a0de2ea524513b6930c24527a2) C:\Windows\System32\ipnathlp.dll
09:11:52.0276 3248        SharedAccess - ok
09:11:52.0307 3248        ShellHWDetection (414da952a35bf5d50192e28263b40577) C:\Windows\System32\shsvcs.dll
09:11:52.0338 3248        ShellHWDetection - ok
09:11:52.0385 3248        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys
09:11:52.0385 3248        sisagp - ok
09:11:52.0416 3248        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
09:11:52.0416 3248        SiSRaid2 - ok
09:11:52.0432 3248        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
09:11:52.0447 3248        SiSRaid4 - ok
09:11:52.0525 3248        SkypeUpdate    (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files\Skype\Updater\Updater.exe
09:11:52.0541 3248        SkypeUpdate - ok
09:11:52.0557 3248        Smb            (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
09:11:52.0588 3248        Smb - ok
09:11:52.0619 3248        SNMPTRAP        (6a984831644eca1a33ffeae4126f4f37) C:\Windows\System32\snmptrap.exe
09:11:52.0635 3248        SNMPTRAP - ok
09:11:52.0650 3248        spldr          (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
09:11:52.0650 3248        spldr - ok
09:11:52.0681 3248        Spooler        (866a43013535dc8587c258e43579c764) C:\Windows\System32\spoolsv.exe
09:11:52.0697 3248        Spooler - ok
09:11:52.0775 3248        sppsvc          (cf87a1de791347e75b98885214ced2b8) C:\Windows\system32\sppsvc.exe
09:11:52.0869 3248        sppsvc - ok
09:11:52.0900 3248        sppuinotify    (b0180b20b065d89232a78a40fe56eaa6) C:\Windows\system32\sppuinotify.dll
09:11:52.0931 3248        sppuinotify - ok
09:11:52.0978 3248        sptd            (cdddec541bc3c96f91ecb48759673505) C:\Windows\System32\Drivers\sptd.sys
09:11:53.0009 3248        sptd - ok
09:11:53.0040 3248        srv            (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys
09:11:53.0071 3248        srv - ok
09:11:53.0087 3248        srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys
09:11:53.0118 3248        srv2 - ok
09:11:53.0134 3248        srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys
09:11:53.0149 3248        srvnet - ok
09:11:53.0181 3248        SSDPSRV        (d887c9fd02ac9fa880f6e5027a43e118) C:\Windows\System32\ssdpsrv.dll
09:11:53.0212 3248        SSDPSRV - ok
09:11:53.0227 3248        SstpSvc        (d318f23be45d5e3a107469eb64815b50) C:\Windows\system32\sstpsvc.dll
09:11:53.0259 3248        SstpSvc - ok
09:11:53.0290 3248        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
09:11:53.0290 3248        stexstor - ok
09:11:53.0321 3248        StiSvc          (e1fb3706030fb4578a0d72c2fc3689e4) C:\Windows\System32\wiaservc.dll
09:11:53.0352 3248        StiSvc - ok
09:11:53.0399 3248        storflt        (472af0311073dceceaa8fa18ba2bdf89) C:\Windows\system32\drivers\vmstorfl.sys
09:11:53.0399 3248        storflt - ok
09:11:53.0415 3248        StorSvc        (0bf669f0a910beda4a32258d363af2a5) C:\Windows\system32\storsvc.dll
09:11:53.0446 3248        StorSvc - ok
09:11:53.0461 3248        storvsc        (dcaffd62259e0bdb433dd67b5bb37619) C:\Windows\system32\drivers\storvsc.sys
09:11:53.0461 3248        storvsc - ok
09:11:53.0493 3248        swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys
09:11:53.0493 3248        swenum - ok
09:11:53.0508 3248        swprv          (a28bd92df340e57b024ba433165d34d7) C:\Windows\System32\swprv.dll
09:11:53.0539 3248        swprv - ok
09:11:53.0586 3248        SysMain        (36650d618ca34c9d357dfd3d89b2c56f) C:\Windows\system32\sysmain.dll
09:11:53.0617 3248        SysMain - ok
09:11:53.0633 3248        TabletInputService (763fecdc3d30c815fe72dd57936c6cd1) C:\Windows\System32\TabSvc.dll
09:11:53.0664 3248        TabletInputService - ok
09:11:53.0695 3248        TapiSrv        (613bf4820361543956909043a265c6ac) C:\Windows\System32\tapisrv.dll
09:11:53.0727 3248        TapiSrv - ok
09:11:53.0742 3248        TBS            (b799d9fdb26111737f58288d8dc172d9) C:\Windows\System32\tbssvc.dll
09:11:53.0789 3248        TBS - ok
09:11:53.0851 3248        Tcpip          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\drivers\tcpip.sys
09:11:53.0883 3248        Tcpip - ok
09:11:53.0914 3248        TCPIP6          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\DRIVERS\tcpip.sys
09:11:53.0945 3248        TCPIP6 - ok
09:11:53.0976 3248        tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys
09:11:54.0007 3248        tcpipreg - ok
09:11:54.0054 3248        TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys
09:11:54.0070 3248        TDPIPE - ok
09:11:54.0085 3248        TDTCP          (2c2c5afe7ee4f620d69c23c0617651a8) C:\Windows\system32\drivers\tdtcp.sys
09:11:54.0101 3248        TDTCP - ok
09:11:54.0117 3248        tdx            (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys
09:11:54.0163 3248        tdx - ok
09:11:54.0241 3248        TelekomNM3      (5d528200679c3b4595b4237e02c077d5) C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys
09:11:54.0257 3248        TelekomNM3 - ok
09:11:54.0288 3248        TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys
09:11:54.0288 3248        TermDD - ok
09:11:54.0319 3248        TermService    (382c804c92811be57829d8e550a900e2) C:\Windows\System32\termsrv.dll
09:11:54.0351 3248        TermService - ok
09:11:54.0382 3248        Themes          (42fb6afd6b79d9fe07381609172e7ca4) C:\Windows\system32\themeservice.dll
09:11:54.0397 3248        Themes - ok
09:11:54.0429 3248        THREADORDER    (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
09:11:54.0444 3248        THREADORDER - ok
09:11:54.0460 3248        TrkWks          (4792c0378db99a9bc2ae2de6cfff0c3a) C:\Windows\System32\trkwks.dll
09:11:54.0507 3248        TrkWks - ok
09:11:54.0538 3248        TrustedInstaller (2c49b175aee1d4364b91b531417fe583) C:\Windows\servicing\TrustedInstaller.exe
09:11:54.0569 3248        TrustedInstaller - ok
09:11:54.0600 3248        tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys
09:11:54.0631 3248        tssecsrv - ok
09:11:54.0647 3248        TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys
09:11:54.0678 3248        TsUsbFlt - ok
09:11:54.0709 3248        tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys
09:11:54.0741 3248        tunnel - ok
09:11:54.0772 3248        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
09:11:54.0772 3248        uagp35 - ok
09:11:54.0803 3248        udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys
09:11:54.0834 3248        udfs - ok
09:11:54.0850 3248        UI0Detect      (8344fd4fce927880aa1aa7681d4927e5) C:\Windows\system32\UI0Detect.exe
09:11:54.0881 3248        UI0Detect - ok
09:11:54.0897 3248        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys
09:11:54.0912 3248        uliagpkx - ok
09:11:54.0928 3248        umbus          (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\drivers\umbus.sys
09:11:54.0943 3248        umbus - ok
09:11:54.0959 3248        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
09:11:54.0975 3248        UmPass - ok
09:11:54.0990 3248        UmRdpService    (409994a8eaceee4e328749c0353527a0) C:\Windows\System32\umrdp.dll
09:11:55.0021 3248        UmRdpService - ok
09:11:55.0037 3248        upnphost        (833fbb672460efce8011d262175fad33) C:\Windows\System32\upnphost.dll
09:11:55.0068 3248        upnphost - ok
09:11:55.0084 3248        usbccgp        (bd9c55d7023c5de374507acc7a14e2ac) C:\Windows\system32\drivers\usbccgp.sys
09:11:55.0099 3248        usbccgp - ok
09:11:55.0146 3248        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys
09:11:55.0162 3248        usbcir - ok
09:11:55.0177 3248        usbehci        (f92de757e4b7ce9c07c5e65423f3ae3b) C:\Windows\system32\DRIVERS\usbehci.sys
09:11:55.0193 3248        usbehci - ok
09:11:55.0209 3248        usbhub          (8dc94aec6a7e644a06135ae7506dc2e9) C:\Windows\system32\DRIVERS\usbhub.sys
09:11:55.0240 3248        usbhub - ok
09:11:55.0255 3248        usbohci        (e185d44fac515a18d9deddc23c2cdf44) C:\Windows\system32\DRIVERS\usbohci.sys
09:11:55.0271 3248        usbohci - ok
09:11:55.0287 3248        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
09:11:55.0302 3248        usbprint - ok
09:11:55.0318 3248        USBSTOR        (f991ab9cc6b908db552166768176896a) C:\Windows\system32\DRIVERS\USBSTOR.SYS
09:11:55.0365 3248        USBSTOR - ok
09:11:55.0380 3248        usbuhci        (68df884cf41cdada664beb01daf67e3d) C:\Windows\system32\drivers\usbuhci.sys
09:11:55.0380 3248        usbuhci - ok
09:11:55.0396 3248        UxSms          (081e6e1c91aec36758902a9f727cd23c) C:\Windows\System32\uxsms.dll
09:11:55.0443 3248        UxSms - ok
09:11:55.0474 3248        VaultSvc        (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
09:11:55.0489 3248        VaultSvc - ok
09:11:55.0521 3248        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys
09:11:55.0536 3248        vdrvroot - ok
09:11:55.0567 3248        vds            (c3cd30495687c2a2f66a65ca6fd89be9) C:\Windows\System32\vds.exe
09:11:55.0599 3248        vds - ok
09:11:55.0630 3248        vga            (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
09:11:55.0645 3248        vga - ok
09:11:55.0661 3248        VgaSave        (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
09:11:55.0692 3248        VgaSave - ok
09:11:55.0723 3248        vhdmp          (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys
09:11:55.0739 3248        vhdmp - ok
09:11:55.0755 3248        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys
09:11:55.0770 3248        viaagp - ok
09:11:55.0786 3248        ViaC7          (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
09:11:55.0801 3248        ViaC7 - ok
09:11:55.0817 3248        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys
09:11:55.0833 3248        viaide - ok
09:11:55.0848 3248        vmbus          (c2f2911156fdc7817c52829c86da494e) C:\Windows\system32\drivers\vmbus.sys
09:11:55.0848 3248        vmbus - ok
09:11:55.0879 3248        VMBusHID        (d4d77455211e204f370d08f4963063ce) C:\Windows\system32\drivers\VMBusHID.sys
09:11:55.0879 3248        VMBusHID - ok
09:11:55.0911 3248        volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys
09:11:55.0911 3248        volmgr - ok
09:11:55.0926 3248        volmgrx        (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
09:11:55.0942 3248        volmgrx - ok
09:11:55.0957 3248        volsnap        (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys
09:11:55.0973 3248        volsnap - ok
09:11:56.0020 3248        VSGate          (e92536e95fbd518f56b5cf932a987349) c:\ElsaWin\bin\VSgate.exe
09:11:56.0035 3248        VSGate ( UnsignedFile.Multi.Generic ) - warning
09:11:56.0035 3248        VSGate - detected UnsignedFile.Multi.Generic (1)
09:11:56.0067 3248        vsmraid        (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
09:11:56.0067 3248        vsmraid - ok
09:11:56.0113 3248        VSS            (209a3b1901b83aeb8527ed211cce9e4c) C:\Windows\system32\vssvc.exe
09:11:56.0176 3248        VSS - ok
09:11:56.0223 3248        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys
09:11:56.0238 3248        vwifibus - ok
09:11:56.0285 3248        W32Time        (55187fd710e27d5095d10a472c8baf1c) C:\Windows\system32\w32time.dll
09:11:56.0332 3248        W32Time - ok
09:11:56.0347 3248        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
09:11:56.0363 3248        WacomPen - ok
09:11:56.0394 3248        WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
09:11:56.0425 3248        WANARP - ok
09:11:56.0425 3248        Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
09:11:56.0441 3248        Wanarpv6 - ok
09:11:56.0488 3248        wbengine        (691e3285e53dca558e1a84667f13e15a) C:\Windows\system32\wbengine.exe
09:11:56.0550 3248        wbengine - ok
09:11:56.0566 3248        WbioSrvc        (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\Windows\System32\wbiosrvc.dll
09:11:56.0581 3248        WbioSrvc - ok
09:11:56.0613 3248        wcncsvc        (34eee0dfaadb4f691d6d5308a51315dc) C:\Windows\System32\wcncsvc.dll
09:11:56.0644 3248        wcncsvc - ok
09:11:56.0675 3248        WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\Windows\System32\WcsPlugInService.dll
09:11:56.0706 3248        WcsPlugInService - ok
09:11:56.0722 3248        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
09:11:56.0737 3248        Wd - ok
09:11:56.0753 3248        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
09:11:56.0769 3248        Wdf01000 - ok
09:11:56.0784 3248        WdiServiceHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
09:11:56.0815 3248        WdiServiceHost - ok
09:11:56.0831 3248        WdiSystemHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
09:11:56.0831 3248        WdiSystemHost - ok
09:11:56.0878 3248        WebClient      (a9d880f97530d5b8fee278923349929d) C:\Windows\System32\webclnt.dll
09:11:56.0893 3248        WebClient - ok
09:11:56.0909 3248        Wecsvc          (760f0afe937a77cff27153206534f275) C:\Windows\system32\wecsvc.dll
09:11:56.0940 3248        Wecsvc - ok
09:11:56.0940 3248        wercplsupport  (ac804569bb2364fb6017370258a4091b) C:\Windows\System32\wercplsupport.dll
09:11:56.0987 3248        wercplsupport - ok
09:11:57.0003 3248        WerSvc          (08e420d873e4fd85241ee2421b02c4a4) C:\Windows\System32\WerSvc.dll
09:11:57.0034 3248        WerSvc - ok
09:11:57.0049 3248        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
09:11:57.0081 3248        WfpLwf - ok
09:11:57.0096 3248        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
09:11:57.0112 3248        WIMMount - ok
09:11:57.0174 3248        WinDefend      (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll
09:11:57.0237 3248        WinDefend - ok
09:11:57.0237 3248        WinHttpAutoProxySvc - ok
09:11:57.0315 3248        Winmgmt        (f62e510b6ad4c21eb9fe8668ed251826) C:\Windows\system32\wbem\WMIsvc.dll
09:11:57.0346 3248        Winmgmt - ok
09:11:57.0377 3248        WinRing0_1_2_0  (845af1ba23c8d5e64def61bcc441604c) C:\Windows\system32\Drivers\ptbring0.sys
09:11:57.0377 3248        WinRing0_1_2_0 - ok
09:11:57.0424 3248        WinRM          (1b91cd34ea3a90ab6a4ef0550174f4cc) C:\Windows\system32\WsmSvc.dll
09:11:57.0486 3248        WinRM - ok
09:11:57.0564 3248        Wlansvc        (16935c98ff639d185086a3529b1f2067) C:\Windows\System32\wlansvc.dll
09:11:57.0595 3248        Wlansvc - ok
09:11:57.0611 3248        WmiAcpi        (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys
09:11:57.0627 3248        WmiAcpi - ok
09:11:57.0658 3248        wmiApSrv        (6eb6b66517b048d87dc1856ddf1f4c3f) C:\Windows\system32\wbem\WmiApSrv.exe
09:11:57.0673 3248        wmiApSrv - ok
09:11:57.0736 3248        WMPNetworkSvc  (3b40d3a61aa8c21b88ae57c58ab3122e) C:\Program Files\Windows Media Player\wmpnetwk.exe
09:11:57.0814 3248        WMPNetworkSvc - ok
09:11:57.0829 3248        WorkshopDBService - ok
09:11:57.0845 3248        WPCSvc          (a2f0ec770a92f2b3f9de6d518e11409c) C:\Windows\System32\wpcsvc.dll
09:11:57.0892 3248        WPCSvc - ok
09:11:57.0907 3248        WPDBusEnum      (aa53356d60af47eacc85bc617a4f3f66) C:\Windows\system32\wpdbusenum.dll
09:11:57.0954 3248        WPDBusEnum - ok
09:11:57.0985 3248        ws2ifsl        (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
09:11:58.0017 3248        ws2ifsl - ok
09:11:58.0048 3248        wscsvc          (6f5d49efe0e7164e03ae773a3fe25340) C:\Windows\System32\wscsvc.dll
09:11:58.0063 3248        wscsvc - ok
09:11:58.0063 3248        WSearch - ok
09:11:58.0110 3248        wuauserv        (3026418a50c5b4761befa632cedb7406) C:\Windows\system32\wuaueng.dll
09:11:58.0173 3248        wuauserv - ok
09:11:58.0204 3248        WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys
09:11:58.0235 3248        WudfPf - ok
09:11:58.0251 3248        WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\DRIVERS\WUDFRd.sys
09:11:58.0266 3248        WUDFRd - ok
09:11:58.0297 3248        wudfsvc        (8d1e1e529a2c9e9b6a85b55a345f7629) C:\Windows\System32\WUDFSvc.dll
09:11:58.0329 3248        wudfsvc - ok
09:11:58.0344 3248        WwanSvc        (ff2d745b560f7c71b31f30f4d49f73d2) C:\Windows\System32\wwansvc.dll
09:11:58.0360 3248        WwanSvc - ok
09:11:58.0375 3248        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
09:11:58.0407 3248        \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - infected
09:11:58.0407 3248        \Device\Harddisk0\DR0 - detected Rootkit.Boot.SST.b (0)
09:11:58.0438 3248        \Device\Harddisk0\DR0 ( TDSS File System ) - warning
09:11:58.0438 3248        \Device\Harddisk0\DR0 - detected TDSS File System (1)
09:11:58.0469 3248        Boot (0x1200)  (c8d27e7e1df4dd3e66b926fe0b686909) \Device\Harddisk0\DR0\Partition0
09:11:58.0469 3248        \Device\Harddisk0\DR0\Partition0 - ok
09:11:58.0485 3248        Boot (0x1200)  (c993edd476c8cf37496e1b9cad03c751) \Device\Harddisk0\DR0\Partition1
09:11:58.0485 3248        \Device\Harddisk0\DR0\Partition1 - ok
09:11:58.0500 3248        Boot (0x1200)  (579eddc3611210dc2a44b6e33ef0124d) \Device\Harddisk0\DR0\Partition2
09:11:58.0500 3248        \Device\Harddisk0\DR0\Partition2 - ok
09:11:58.0500 3248        ============================================================
09:11:58.0500 3248        Scan finished
09:11:58.0500 3248        ============================================================
09:11:58.0516 3544        Detected object count: 10
09:11:58.0516 3544        Actual detected object count: 10
09:12:23.0725 3544        LcSvrAdm ( UnsignedFile.Multi.Generic ) - skipped by user
09:12:23.0725 3544        LcSvrAdm ( UnsignedFile.Multi.Generic ) - User select action: Skip
09:12:23.0725 3544        LcSvrAuf ( UnsignedFile.Multi.Generic ) - skipped by user
09:12:23.0725 3544        LcSvrAuf ( UnsignedFile.Multi.Generic ) - User select action: Skip
09:12:23.0725 3544        LcSvrDba ( UnsignedFile.Multi.Generic ) - skipped by user
09:12:23.0725 3544        LcSvrDba ( UnsignedFile.Multi.Generic ) - User select action: Skip
09:12:23.0725 3544        LcSvrHis ( UnsignedFile.Multi.Generic ) - skipped by user
09:12:23.0725 3544        LcSvrHis ( UnsignedFile.Multi.Generic ) - User select action: Skip
09:12:23.0725 3544        LcSvrPAS ( UnsignedFile.Multi.Generic ) - skipped by user
09:12:23.0725 3544        LcSvrPAS ( UnsignedFile.Multi.Generic ) - User select action: Skip
09:12:23.0725 3544        LcSvrSaz ( UnsignedFile.Multi.Generic ) - skipped by user
09:12:23.0725 3544        LcSvrSaz ( UnsignedFile.Multi.Generic ) - User select action: Skip
09:12:23.0725 3544        Netzmanager Service ( UnsignedFile.Multi.Generic ) - skipped by user
09:12:23.0725 3544        Netzmanager Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
09:12:23.0741 3544        NSHE ( UnsignedFile.Multi.Generic ) - skipped by user
09:12:23.0741 3544        NSHE ( UnsignedFile.Multi.Generic ) - User select action: Skip
09:12:23.0741 3544        RTLWUSB ( UnsignedFile.Multi.Generic ) - skipped by user
09:12:23.0741 3544        RTLWUSB ( UnsignedFile.Multi.Generic ) - User select action: Skip
09:12:23.0741 3544        VSGate ( UnsignedFile.Multi.Generic ) - skipped by user
09:12:23.0741 3544        VSGate ( UnsignedFile.Multi.Generic ) - User select action: Skip
09:12:23.0741 3544        \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - skipped by user
09:12:23.0741 3544        \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - User select action: Skip
09:12:23.0741 3544        \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
09:12:23.0741 3544        \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

cosinus 21.04.2012 14:53
Zitat:
09:12:23.0741 3544 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - skipped by user
09:12:23.0741 3544 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - User select action: Skip
09:12:23.0741 3544 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
09:12:23.0741 3544 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

Diese beiden Fieslinge (TDSS File System & Rootkit.Boot.SST.b) mit dem TDSS-Killer löschen lassen, starte Windows danach neu und mach ein neues Log mit diesem Tool. Poste es wieder mit CODE-Tags umschlossen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:41 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131