Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Malwarebytes findet PUP.funmoods in Registry (https://www.trojaner-board.de/114028-malwarebytes-findet-pup-funmoods-registry.html)

flaaghuhn 27.04.2012 16:45
Habe ich gemacht, hat sogar etwas gefunden, ich nehme aber an, dass die HP Netdrivers etc. von meinem alten HP-Drucker stammten...
Code:
17:36:02.0935 5280        TDSS rootkit removing tool 2.7.33.0 Apr 24 2012 18:43:43
17:36:03.0172 5280        ============================================================
17:36:03.0172 5280        Current date / time: 2012/04/27 17:36:03.0172
17:36:03.0172 5280        SystemInfo:
17:36:03.0172 5280       
17:36:03.0172 5280        OS Version: 6.1.7601 ServicePack: 1.0
17:36:03.0172 5280        Product type: Workstation
17:36:03.0172 5280        ComputerName: RH-PC
17:36:03.0172 5280        UserName: Redjep
17:36:03.0172 5280        Windows directory: C:\Windows
17:36:03.0172 5280        System windows directory: C:\Windows
17:36:03.0172 5280        Running under WOW64
17:36:03.0172 5280        Processor architecture: Intel x64
17:36:03.0172 5280        Number of processors: 8
17:36:03.0172 5280        Page size: 0x1000
17:36:03.0172 5280        Boot type: Normal boot
17:36:03.0172 5280        ============================================================
17:36:04.0731 5280        Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
17:36:04.0796 5280        ============================================================
17:36:04.0796 5280        \Device\Harddisk0\DR0:
17:36:04.0796 5280        MBR partitions:
17:36:04.0796 5280        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
17:36:04.0796 5280        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x712D3000
17:36:04.0796 5280        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x71305800, BlocksNum 0x3200000
17:36:04.0796 5280        ============================================================
17:36:04.0850 5280        C: <-> \Device\Harddisk0\DR0\Partition1
17:36:04.0909 5280        D: <-> \Device\Harddisk0\DR0\Partition2
17:36:04.0941 5280        ============================================================
17:36:04.0941 5280        Initialize success
17:36:04.0941 5280        ============================================================
17:36:47.0503 5188        ============================================================
17:36:47.0503 5188        Scan started
17:36:47.0503 5188        Mode: Manual; SigCheck; TDLFS;
17:36:47.0503 5188        ============================================================
17:36:50.0427 5188        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
17:36:50.0677 5188        1394ohci - ok
17:36:50.0732 5188        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
17:36:50.0773 5188        ACPI - ok
17:36:50.0786 5188        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
17:36:50.0874 5188        AcpiPmi - ok
17:36:50.0956 5188        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
17:36:50.0974 5188        AdobeARMservice - ok
17:36:51.0109 5188        AdobeFlashPlayerUpdateSvc (459ac130c6ab892b1cd5d7544626efc5) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
17:36:51.0133 5188        AdobeFlashPlayerUpdateSvc - ok
17:36:51.0207 5188        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
17:36:51.0252 5188        adp94xx - ok
17:36:51.0284 5188        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
17:36:51.0309 5188        adpahci - ok
17:36:51.0337 5188        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
17:36:51.0357 5188        adpu320 - ok
17:36:51.0381 5188        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
17:36:51.0541 5188        AeLookupSvc - ok
17:36:51.0596 5188        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
17:36:51.0716 5188        AFD - ok
17:36:51.0739 5188        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
17:36:51.0762 5188        agp440 - ok
17:36:51.0772 5188        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
17:36:51.0836 5188        ALG - ok
17:36:51.0847 5188        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
17:36:51.0869 5188        aliide - ok
17:36:51.0944 5188        ALSysIO - ok
17:36:52.0004 5188        AMD External Events Utility (b5e2434fc851698c1f119cf1c3935a50) C:\Windows\system32\atiesrxx.exe
17:36:52.0133 5188        AMD External Events Utility - ok
17:36:52.0151 5188        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
17:36:52.0173 5188        amdide - ok
17:36:52.0194 5188        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
17:36:52.0251 5188        AmdK8 - ok
17:36:52.0727 5188        amdkmdag        (9e3b4946f7e1bca0b763e19d81edbf2c) C:\Windows\system32\DRIVERS\atikmdag.sys
17:36:52.0959 5188        amdkmdag - ok
17:36:53.0087 5188        amdkmdap        (b9e1c7b7f1865f99b16ff2e1bb94edb6) C:\Windows\system32\DRIVERS\atikmpag.sys
17:36:53.0158 5188        amdkmdap - ok
17:36:53.0166 5188        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
17:36:53.0192 5188        AmdPPM - ok
17:36:53.0231 5188        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
17:36:53.0256 5188        amdsata - ok
17:36:53.0281 5188        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
17:36:53.0294 5188        amdsbs - ok
17:36:53.0311 5188        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
17:36:53.0322 5188        amdxata - ok
17:36:53.0351 5188        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
17:36:53.0508 5188        AppID - ok
17:36:53.0524 5188        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
17:36:53.0582 5188        AppIDSvc - ok
17:36:53.0614 5188        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
17:36:53.0667 5188        Appinfo - ok
17:36:53.0684 5188        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
17:36:53.0696 5188        arc - ok
17:36:53.0709 5188        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
17:36:53.0727 5188        arcsas - ok
17:36:53.0761 5188        aswFsBlk        (b9da213b5271db5fce962d827e6d620d) C:\Windows\system32\drivers\aswFsBlk.sys
17:36:53.0843 5188        aswFsBlk - ok
17:36:53.0888 5188        aswMonFlt      (21c9835d0e5ad2ff0f16134bcb32cc71) C:\Windows\system32\drivers\aswMonFlt.sys
17:36:53.0908 5188        aswMonFlt - ok
17:36:53.0942 5188        aswRdr          (1b96a5867abd4fa6135d8298fcccf9c6) C:\Windows\System32\Drivers\aswrdr2.sys
17:36:53.0954 5188        aswRdr - ok
17:36:54.0041 5188        aswSnx          (6e98bb288696777a3a8a07a52b0eaee9) C:\Windows\system32\drivers\aswSnx.sys
17:36:54.0077 5188        aswSnx - ok
17:36:54.0126 5188        aswSP          (d9fb49f16e4eb02efecae8cbfe4bcb4c) C:\Windows\system32\drivers\aswSP.sys
17:36:54.0161 5188        aswSP - ok
17:36:54.0194 5188        aswTdi          (7352bb9a564b94bbd7c9cbf165f55006) C:\Windows\system32\drivers\aswTdi.sys
17:36:54.0214 5188        aswTdi - ok
17:36:54.0237 5188        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
17:36:54.0301 5188        AsyncMac - ok
17:36:54.0327 5188        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
17:36:54.0337 5188        atapi - ok
17:36:54.0376 5188        AtiHDAudioService (230cf51113cd4b830b3bfd09b0d4c066) C:\Windows\system32\drivers\AtihdW76.sys
17:36:54.0394 5188        AtiHDAudioService - ok
17:36:54.0456 5188        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
17:36:54.0551 5188        AudioEndpointBuilder - ok
17:36:54.0554 5188        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
17:36:54.0586 5188        AudioSrv - ok
17:36:54.0649 5188        avast! Antivirus (4041d31508a2a084dfb42c595854090f) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
17:36:54.0668 5188        avast! Antivirus - ok
17:36:54.0702 5188        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
17:36:54.0827 5188        AxInstSV - ok
17:36:54.0866 5188        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
17:36:54.0944 5188        b06bdrv - ok
17:36:54.0973 5188        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
17:36:55.0021 5188        b57nd60a - ok
17:36:55.0081 5188        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
17:36:55.0137 5188        BDESVC - ok
17:36:55.0154 5188        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
17:36:55.0191 5188        Beep - ok
17:36:55.0271 5188        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
17:36:55.0377 5188        BFE - ok
17:36:55.0452 5188        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
17:36:55.0564 5188        BITS - ok
17:36:55.0617 5188        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
17:36:55.0653 5188        blbdrive - ok
17:36:55.0679 5188        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
17:36:55.0734 5188        bowser - ok
17:36:55.0747 5188        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
17:36:55.0813 5188        BrFiltLo - ok
17:36:55.0818 5188        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
17:36:55.0842 5188        BrFiltUp - ok
17:36:55.0872 5188        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
17:36:55.0933 5188        Browser - ok
17:36:55.0949 5188        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
17:36:56.0026 5188        Brserid - ok
17:36:56.0032 5188        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
17:36:56.0057 5188        BrSerWdm - ok
17:36:56.0061 5188        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
17:36:56.0088 5188        BrUsbMdm - ok
17:36:56.0092 5188        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
17:36:56.0107 5188        BrUsbSer - ok
17:36:56.0127 5188        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
17:36:56.0162 5188        BTHMODEM - ok
17:36:56.0174 5188        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
17:36:56.0221 5188        bthserv - ok
17:36:56.0274 5188        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
17:36:56.0328 5188        cdfs - ok
17:36:56.0368 5188        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
17:36:56.0399 5188        cdrom - ok
17:36:56.0418 5188        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
17:36:56.0452 5188        CertPropSvc - ok
17:36:56.0471 5188        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
17:36:56.0486 5188        circlass - ok
17:36:56.0508 5188        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
17:36:56.0524 5188        CLFS - ok
17:36:56.0586 5188        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
17:36:56.0607 5188        clr_optimization_v2.0.50727_32 - ok
17:36:56.0646 5188        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
17:36:56.0659 5188        clr_optimization_v2.0.50727_64 - ok
17:36:56.0718 5188        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
17:36:56.0772 5188        clr_optimization_v4.0.30319_32 - ok
17:36:56.0806 5188        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
17:36:56.0827 5188        clr_optimization_v4.0.30319_64 - ok
17:36:56.0832 5188        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
17:36:56.0854 5188        CmBatt - ok
17:36:56.0864 5188        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
17:36:56.0877 5188        cmdide - ok
17:36:56.0928 5188        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
17:36:56.0982 5188        CNG - ok
17:36:56.0991 5188        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
17:36:57.0004 5188        Compbatt - ok
17:36:57.0037 5188        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
17:36:57.0066 5188        CompositeBus - ok
17:36:57.0081 5188        COMSysApp - ok
17:36:57.0084 5188        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
17:36:57.0096 5188        crcdisk - ok
17:36:57.0133 5188        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
17:36:57.0222 5188        CryptSvc - ok
17:36:57.0274 5188        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
17:36:57.0369 5188        DcomLaunch - ok
17:36:57.0409 5188        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
17:36:57.0493 5188        defragsvc - ok
17:36:57.0538 5188        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
17:36:57.0597 5188        DfsC - ok
17:36:57.0638 5188        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
17:36:57.0679 5188        Dhcp - ok
17:36:57.0712 5188        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
17:36:57.0743 5188        discache - ok
17:36:57.0763 5188        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
17:36:57.0776 5188        Disk - ok
17:36:57.0806 5188        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
17:36:57.0867 5188        Dnscache - ok
17:36:57.0901 5188        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
17:36:57.0948 5188        dot3svc - ok
17:36:58.0002 5188        Dot4            (b42ed0320c6e41102fde0005154849bb) C:\Windows\system32\DRIVERS\Dot4.sys
17:36:58.0044 5188        Dot4 - ok
17:36:58.0064 5188        Dot4Print      (e9f5969233c5d89f3c35e3a66a52a361) C:\Windows\system32\DRIVERS\Dot4Prt.sys
17:36:58.0092 5188        Dot4Print - ok
17:36:58.0111 5188        dot4usb        (fd05a02b0370bc3000f402e543ca5814) C:\Windows\system32\DRIVERS\dot4usb.sys
17:36:58.0129 5188        dot4usb - ok
17:36:58.0163 5188        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
17:36:58.0229 5188        DPS - ok
17:36:58.0268 5188        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
17:36:58.0311 5188        drmkaud - ok
17:36:58.0382 5188        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
17:36:58.0424 5188        DXGKrnl - ok
17:36:58.0442 5188        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
17:36:58.0472 5188        EapHost - ok
17:36:58.0657 5188        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
17:36:58.0781 5188        ebdrv - ok
17:36:58.0884 5188        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
17:36:58.0933 5188        EFS - ok
17:36:59.0026 5188        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
17:36:59.0149 5188        ehRecvr - ok
17:36:59.0187 5188        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
17:36:59.0236 5188        ehSched - ok
17:36:59.0314 5188        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
17:36:59.0371 5188        elxstor - ok
17:36:59.0396 5188        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
17:36:59.0429 5188        ErrDev - ok
17:36:59.0478 5188        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
17:36:59.0563 5188        EventSystem - ok
17:36:59.0606 5188        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
17:36:59.0653 5188        exfat - ok
17:36:59.0674 5188        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
17:36:59.0711 5188        fastfat - ok
17:36:59.0784 5188        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
17:36:59.0847 5188        Fax - ok
17:36:59.0853 5188        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
17:36:59.0871 5188        fdc - ok
17:36:59.0887 5188        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
17:36:59.0947 5188        fdPHost - ok
17:36:59.0962 5188        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
17:37:00.0019 5188        FDResPub - ok
17:37:00.0034 5188        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
17:37:00.0044 5188        FileInfo - ok
17:37:00.0062 5188        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
17:37:00.0089 5188        Filetrace - ok
17:37:00.0093 5188        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
17:37:00.0104 5188        flpydisk - ok
17:37:00.0143 5188        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
17:37:00.0156 5188        FltMgr - ok
17:37:00.0238 5188        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
17:37:00.0372 5188        FontCache - ok
17:37:00.0574 5188        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
17:37:00.0592 5188        FontCache3.0.0.0 - ok
17:37:00.0614 5188        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
17:37:00.0637 5188        FsDepends - ok
17:37:00.0646 5188        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
17:37:00.0658 5188        Fs_Rec - ok
17:37:00.0703 5188        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
17:37:00.0736 5188        fvevol - ok
17:37:00.0754 5188        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
17:37:00.0773 5188        gagp30kx - ok
17:37:00.0828 5188        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
17:37:00.0891 5188        gpsvc - ok
17:37:00.0966 5188        gupdate        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
17:37:00.0984 5188        gupdate - ok
17:37:00.0989 5188        gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
17:37:01.0004 5188        gupdatem - ok
17:37:01.0027 5188        hamachi        (1e6438d4ea6e1174a3b3b1edc4de660b) C:\Windows\system32\DRIVERS\hamachi.sys
17:37:01.0037 5188        hamachi - ok
17:37:01.0203 5188        Hamachi2Svc    (ce77bc37bdd36c9dc50c3591ebac3fa3) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
17:37:01.0272 5188        Hamachi2Svc - ok
17:37:01.0344 5188        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
17:37:01.0418 5188        hcw85cir - ok
17:37:01.0477 5188        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
17:37:01.0529 5188        HdAudAddService - ok
17:37:01.0566 5188        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
17:37:01.0612 5188        HDAudBus - ok
17:37:01.0617 5188        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
17:37:01.0643 5188        HidBatt - ok
17:37:01.0652 5188        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
17:37:01.0671 5188        HidBth - ok
17:37:01.0676 5188        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
17:37:01.0698 5188        HidIr - ok
17:37:01.0723 5188        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
17:37:01.0768 5188        hidserv - ok
17:37:01.0794 5188        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
17:37:01.0807 5188        HidUsb - ok
17:37:01.0858 5188        HiPatchService  (5a457c3d00c1c701230a12aa1580114d) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
17:37:01.0872 5188        HiPatchService ( UnsignedFile.Multi.Generic ) - warning
17:37:01.0872 5188        HiPatchService - detected UnsignedFile.Multi.Generic (1)
17:37:01.0907 5188        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
17:37:01.0969 5188        hkmsvc - ok
17:37:02.0008 5188        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
17:37:02.0049 5188        HomeGroupListener - ok
17:37:02.0086 5188        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
17:37:02.0132 5188        HomeGroupProvider - ok
17:37:02.0171 5188        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
17:37:02.0194 5188        HpSAMD - ok
17:37:02.0256 5188        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
17:37:02.0334 5188        HTTP - ok
17:37:02.0362 5188        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
17:37:02.0374 5188        hwpolicy - ok
17:37:02.0394 5188        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
17:37:02.0409 5188        i8042prt - ok
17:37:02.0454 5188        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
17:37:02.0484 5188        iaStorV - ok
17:37:02.0581 5188        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
17:37:02.0619 5188        idsvc - ok
17:37:02.0636 5188        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
17:37:02.0648 5188        iirsp - ok
17:37:02.0712 5188        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
17:37:02.0781 5188        IKEEXT - ok
17:37:03.0042 5188        IntcAzAudAddService (150ac23f21dbdbf8488408ba944b0d65) C:\Windows\system32\drivers\RTKVHD64.sys
17:37:03.0163 5188        IntcAzAudAddService - ok
17:37:03.0263 5188        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
17:37:03.0286 5188        intelide - ok
17:37:03.0312 5188        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
17:37:03.0337 5188        intelppm - ok
17:37:03.0363 5188        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
17:37:03.0412 5188        IPBusEnum - ok
17:37:03.0433 5188        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
17:37:03.0466 5188        IpFilterDriver - ok
17:37:03.0514 5188        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
17:37:03.0578 5188        iphlpsvc - ok
17:37:03.0602 5188        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
17:37:03.0616 5188        IPMIDRV - ok
17:37:03.0633 5188        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
17:37:03.0686 5188        IPNAT - ok
17:37:03.0707 5188        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
17:37:03.0786 5188        IRENUM - ok
17:37:03.0800 5188        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
17:37:03.0821 5188        isapnp - ok
17:37:03.0855 5188        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
17:37:03.0895 5188        iScsiPrt - ok
17:37:03.0926 5188        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
17:37:03.0941 5188        kbdclass - ok
17:37:03.0958 5188        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
17:37:03.0992 5188        kbdhid - ok
17:37:04.0030 5188        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
17:37:04.0050 5188        KeyIso - ok
17:37:04.0072 5188        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
17:37:04.0085 5188        KSecDD - ok
17:37:04.0105 5188        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
17:37:04.0118 5188        KSecPkg - ok
17:37:04.0126 5188        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
17:37:04.0157 5188        ksthunk - ok
17:37:04.0190 5188        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
17:37:04.0233 5188        KtmRm - ok
17:37:04.0276 5188        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
17:37:04.0342 5188        LanmanServer - ok
17:37:04.0371 5188        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
17:37:04.0422 5188        LanmanWorkstation - ok
17:37:04.0433 5188        libusb0 - ok
17:37:04.0456 5188        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
17:37:04.0521 5188        lltdio - ok
17:37:04.0557 5188        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
17:37:04.0633 5188        lltdsvc - ok
17:37:04.0655 5188        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
17:37:04.0682 5188        lmhosts - ok
17:37:04.0708 5188        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
17:37:04.0721 5188        LSI_FC - ok
17:37:04.0737 5188        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
17:37:04.0748 5188        LSI_SAS - ok
17:37:04.0758 5188        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
17:37:04.0770 5188        LSI_SAS2 - ok
17:37:04.0790 5188        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
17:37:04.0801 5188        LSI_SCSI - ok
17:37:04.0822 5188        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
17:37:04.0850 5188        luafv - ok
17:37:04.0878 5188        MBAMProtector  (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys
17:37:04.0890 5188        MBAMProtector - ok
17:37:04.0983 5188        MBAMService    (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
17:37:05.0020 5188        MBAMService - ok
17:37:05.0050 5188        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
17:37:05.0088 5188        Mcx2Svc - ok
17:37:05.0103 5188        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
17:37:05.0120 5188        megasas - ok
17:37:05.0151 5188        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
17:37:05.0173 5188        MegaSR - ok
17:37:05.0180 5188        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
17:37:05.0231 5188        MMCSS - ok
17:37:05.0245 5188        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
17:37:05.0298 5188        Modem - ok
17:37:05.0315 5188        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
17:37:05.0330 5188        monitor - ok
17:37:05.0371 5188        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
17:37:05.0381 5188        mouclass - ok
17:37:05.0398 5188        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
17:37:05.0431 5188        mouhid - ok
17:37:05.0477 5188        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
17:37:05.0501 5188        mountmgr - ok
17:37:05.0560 5188        MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
17:37:05.0580 5188        MozillaMaintenance - ok
17:37:05.0606 5188        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
17:37:05.0621 5188        mpio - ok
17:37:05.0641 5188        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
17:37:05.0687 5188        mpsdrv - ok
17:37:05.0753 5188        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
17:37:05.0807 5188        MpsSvc - ok
17:37:05.0842 5188        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
17:37:05.0863 5188        MRxDAV - ok
17:37:05.0895 5188        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
17:37:05.0928 5188        mrxsmb - ok
17:37:05.0955 5188        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
17:37:06.0003 5188        mrxsmb10 - ok
17:37:06.0038 5188        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
17:37:06.0062 5188        mrxsmb20 - ok
17:37:06.0068 5188        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
17:37:06.0080 5188        msahci - ok
17:37:06.0120 5188        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
17:37:06.0132 5188        msdsm - ok
17:37:06.0171 5188        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
17:37:06.0211 5188        MSDTC - ok
17:37:06.0252 5188        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
17:37:06.0297 5188        Msfs - ok
17:37:06.0322 5188        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
17:37:06.0385 5188        mshidkmdf - ok
17:37:06.0395 5188        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
17:37:06.0406 5188        msisadrv - ok
17:37:06.0426 5188        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
17:37:06.0472 5188        MSiSCSI - ok
17:37:06.0475 5188        msiserver - ok
17:37:06.0500 5188        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
17:37:06.0531 5188        MSKSSRV - ok
17:37:06.0538 5188        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
17:37:06.0566 5188        MSPCLOCK - ok
17:37:06.0570 5188        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
17:37:06.0613 5188        MSPQM - ok
17:37:06.0671 5188        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
17:37:06.0712 5188        MsRPC - ok
17:37:06.0731 5188        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
17:37:06.0750 5188        mssmbios - ok
17:37:06.0755 5188        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
17:37:06.0798 5188        MSTEE - ok
17:37:06.0801 5188        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
17:37:06.0813 5188        MTConfig - ok
17:37:06.0828 5188        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
17:37:06.0838 5188        Mup - ok
17:37:06.0892 5188        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
17:37:06.0953 5188        napagent - ok
17:37:07.0001 5188        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
17:37:07.0061 5188        NativeWifiP - ok
17:37:07.0140 5188        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
17:37:07.0183 5188        NDIS - ok
17:37:07.0192 5188        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
17:37:07.0237 5188        NdisCap - ok
17:37:07.0266 5188        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
17:37:07.0311 5188        NdisTapi - ok
17:37:07.0335 5188        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
17:37:07.0361 5188        Ndisuio - ok
17:37:07.0382 5188        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
17:37:07.0413 5188        NdisWan - ok
17:37:07.0432 5188        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
17:37:07.0458 5188        NDProxy - ok
17:37:07.0526 5188        Net Driver HPZ12 (d5ac41ae382738483faffbd7e373d49a) C:\Windows\system32\HPZinw12.dll
17:37:07.0536 5188        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
17:37:07.0536 5188        Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
17:37:07.0550 5188        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
17:37:07.0596 5188        NetBIOS - ok
17:37:07.0641 5188        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
17:37:07.0717 5188        NetBT - ok
17:37:07.0740 5188        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
17:37:07.0752 5188        Netlogon - ok
17:37:07.0796 5188        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
17:37:07.0851 5188        Netman - ok
17:37:07.0892 5188        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
17:37:07.0941 5188        netprofm - ok
17:37:07.0992 5188        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
17:37:08.0013 5188        NetTcpPortSharing - ok
17:37:08.0042 5188        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
17:37:08.0058 5188        nfrd960 - ok
17:37:08.0098 5188        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
17:37:08.0148 5188        NlaSvc - ok
17:37:08.0163 5188        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
17:37:08.0190 5188        Npfs - ok
17:37:08.0210 5188        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
17:37:08.0238 5188        nsi - ok
17:37:08.0255 5188        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
17:37:08.0296 5188        nsiproxy - ok
17:37:08.0423 5188        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
17:37:08.0478 5188        Ntfs - ok
17:37:08.0580 5188        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
17:37:08.0653 5188        Null - ok
17:37:08.0695 5188        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
17:37:08.0720 5188        nvraid - ok
17:37:08.0753 5188        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
17:37:08.0776 5188        nvstor - ok
17:37:08.0792 5188        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
17:37:08.0807 5188        nv_agp - ok
17:37:08.0830 5188        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
17:37:08.0847 5188        ohci1394 - ok
17:37:08.0878 5188        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
17:37:08.0948 5188        p2pimsvc - ok
17:37:08.0977 5188        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
17:37:09.0002 5188        p2psvc - ok
17:37:09.0026 5188        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
17:37:09.0038 5188        Parport - ok
17:37:09.0058 5188        partmgr        (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
17:37:09.0113 5188        partmgr - ok
17:37:09.0137 5188        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
17:37:09.0192 5188        PcaSvc - ok
17:37:09.0221 5188        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
17:37:09.0247 5188        pci - ok
17:37:09.0265 5188        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
17:37:09.0286 5188        pciide - ok
17:37:09.0301 5188        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
17:37:09.0320 5188        pcmcia - ok
17:37:09.0326 5188        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
17:37:09.0340 5188        pcw - ok
17:37:09.0392 5188        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
17:37:09.0456 5188        PEAUTH - ok
17:37:09.0531 5188        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
17:37:09.0567 5188        PerfHost - ok
17:37:09.0721 5188        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
17:37:09.0830 5188        pla - ok
17:37:09.0900 5188        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
17:37:09.0945 5188        PlugPlay - ok
17:37:10.0016 5188        Pml Driver HPZ12 (37f6046cdc630442d7dc087501ff6fc6) C:\Windows\system32\HPZipm12.dll
17:37:10.0027 5188        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
17:37:10.0027 5188        Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
17:37:10.0045 5188        PnkBstrA - ok
17:37:10.0057 5188        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
17:37:10.0096 5188        PNRPAutoReg - ok
17:37:10.0118 5188        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
17:37:10.0150 5188        PNRPsvc - ok
17:37:10.0203 5188        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
17:37:10.0283 5188        PolicyAgent - ok
17:37:10.0313 5188        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
17:37:10.0362 5188        Power - ok
17:37:10.0415 5188        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
17:37:10.0456 5188        PptpMiniport - ok
17:37:10.0462 5188        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
17:37:10.0490 5188        Processor - ok
17:37:10.0536 5188        ProfSvc        (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
17:37:10.0607 5188        ProfSvc - ok
17:37:10.0640 5188        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
17:37:10.0653 5188        ProtectedStorage - ok
17:37:10.0688 5188        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
17:37:10.0732 5188        Psched - ok
17:37:10.0841 5188        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
17:37:10.0907 5188        ql2300 - ok
17:37:11.0000 5188        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
17:37:11.0023 5188        ql40xx - ok
17:37:11.0065 5188        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
17:37:11.0093 5188        QWAVE - ok
17:37:11.0107 5188        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
17:37:11.0127 5188        QWAVEdrv - ok
17:37:11.0145 5188        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
17:37:11.0172 5188        RasAcd - ok
17:37:11.0212 5188        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
17:37:11.0265 5188        RasAgileVpn - ok
17:37:11.0272 5188        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
17:37:11.0312 5188        RasAuto - ok
17:37:11.0337 5188        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
17:37:11.0397 5188        Rasl2tp - ok
17:37:11.0453 5188        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
17:37:11.0512 5188        RasMan - ok
17:37:11.0533 5188        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
17:37:11.0566 5188        RasPppoe - ok
17:37:11.0572 5188        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
17:37:11.0600 5188        RasSstp - ok
17:37:11.0631 5188        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
17:37:11.0685 5188        rdbss - ok
17:37:11.0688 5188        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
17:37:11.0702 5188        rdpbus - ok
17:37:11.0721 5188        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
17:37:11.0748 5188        RDPCDD - ok
17:37:11.0775 5188        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
17:37:11.0802 5188        RDPENCDD - ok
17:37:11.0808 5188        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
17:37:11.0836 5188        RDPREFMP - ok
17:37:11.0880 5188        RDPWD          (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
17:37:11.0918 5188        RDPWD - ok
17:37:11.0950 5188        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
17:37:11.0977 5188        rdyboost - ok
17:37:12.0006 5188        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
17:37:12.0065 5188        RemoteAccess - ok
17:37:12.0076 5188        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
17:37:12.0128 5188        RemoteRegistry - ok
17:37:12.0135 5188        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
17:37:12.0165 5188        RpcEptMapper - ok
17:37:12.0198 5188        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
17:37:12.0213 5188        RpcLocator - ok
17:37:12.0266 5188        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
17:37:12.0313 5188        RpcSs - ok
17:37:12.0320 5188        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
17:37:12.0347 5188        rspndr - ok
17:37:12.0397 5188        RTL8167        (ee082e06a82ff630351d1e0ebbd3d8d0) C:\Windows\system32\DRIVERS\Rt64win7.sys
17:37:12.0423 5188        RTL8167 - ok
17:37:12.0452 5188        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
17:37:12.0468 5188        SamSs - ok
17:37:12.0493 5188        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
17:37:12.0518 5188        sbp2port - ok
17:37:12.0552 5188        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
17:37:12.0620 5188        SCardSvr - ok
17:37:12.0623 5188        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
17:37:12.0653 5188        scfilter - ok
17:37:12.0735 5188        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
17:37:12.0800 5188        Schedule - ok
17:37:12.0826 5188        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
17:37:12.0850 5188        SCPolicySvc - ok
17:37:12.0876 5188        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
17:37:12.0947 5188        SDRSVC - ok
17:37:12.0977 5188        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
17:37:13.0022 5188        secdrv - ok
17:37:13.0038 5188        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
17:37:13.0077 5188        seclogon - ok
17:37:13.0102 5188        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
17:37:13.0156 5188        SENS - ok
17:37:13.0172 5188        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
17:37:13.0222 5188        SensrSvc - ok
17:37:13.0238 5188        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
17:37:13.0275 5188        Serenum - ok
17:37:13.0310 5188        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
17:37:13.0336 5188        Serial - ok
17:37:13.0362 5188        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
17:37:13.0387 5188        sermouse - ok
17:37:13.0423 5188        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
17:37:13.0486 5188        SessionEnv - ok
17:37:13.0502 5188        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
17:37:13.0526 5188        sffdisk - ok
17:37:13.0541 5188        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
17:37:13.0555 5188        sffp_mmc - ok
17:37:13.0563 5188        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
17:37:13.0578 5188        sffp_sd - ok
17:37:13.0582 5188        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
17:37:13.0595 5188        sfloppy - ok
17:37:13.0640 5188        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
17:37:13.0712 5188        SharedAccess - ok
17:37:13.0762 5188        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
17:37:13.0840 5188        ShellHWDetection - ok
17:37:13.0867 5188        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
17:37:13.0878 5188        SiSRaid2 - ok
17:37:13.0890 5188        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
17:37:13.0901 5188        SiSRaid4 - ok
17:37:13.0956 5188        SkypeUpdate    (db0405d9aad62f0762e0876ac142b7e1) C:\Program Files (x86)\Skype\Updater\Updater.exe
17:37:13.0977 5188        SkypeUpdate - ok
17:37:13.0997 5188        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
17:37:14.0045 5188        Smb - ok
17:37:14.0056 5188        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
17:37:14.0080 5188        SNMPTRAP - ok
17:37:14.0083 5188        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
17:37:14.0093 5188        spldr - ok
17:37:14.0157 5188        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
17:37:14.0233 5188        Spooler - ok
17:37:14.0442 5188        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
17:37:14.0573 5188        sppsvc - ok
17:37:14.0667 5188        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
17:37:14.0721 5188        sppuinotify - ok
17:37:14.0795 5188        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
17:37:14.0862 5188        srv - ok
17:37:14.0903 5188        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
17:37:14.0963 5188        srv2 - ok
17:37:14.0995 5188        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
17:37:15.0027 5188        srvnet - ok
17:37:15.0068 5188        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
17:37:15.0135 5188        SSDPSRV - ok
17:37:15.0165 5188        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
17:37:15.0195 5188        SstpSvc - ok
17:37:15.0216 5188        Steam Client Service - ok
17:37:15.0221 5188        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
17:37:15.0232 5188        stexstor - ok
17:37:15.0301 5188        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
17:37:15.0345 5188        stisvc - ok
17:37:15.0371 5188        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
17:37:15.0382 5188        swenum - ok
17:37:15.0425 5188        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
17:37:15.0470 5188        swprv - ok
17:37:15.0593 5188        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
17:37:15.0655 5188        SysMain - ok
17:37:15.0730 5188        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
17:37:15.0791 5188        TabletInputService - ok
17:37:15.0831 5188        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
17:37:15.0905 5188        TapiSrv - ok
17:37:15.0921 5188        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
17:37:15.0951 5188        TBS - ok
17:37:16.0098 5188        Tcpip          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
17:37:16.0152 5188        Tcpip - ok
17:37:16.0310 5188        TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
17:37:16.0351 5188        TCPIP6 - ok
17:37:16.0408 5188        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
17:37:16.0470 5188        tcpipreg - ok
17:37:16.0498 5188        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
17:37:16.0548 5188        TDPIPE - ok
17:37:16.0568 5188        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
17:37:16.0592 5188        TDTCP - ok
17:37:16.0623 5188        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
17:37:16.0662 5188        tdx - ok
17:37:16.0678 5188        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
17:37:16.0690 5188        TermDD - ok
17:37:16.0755 5188        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
17:37:16.0815 5188        TermService - ok
17:37:16.0826 5188        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
17:37:16.0856 5188        Themes - ok
17:37:16.0893 5188        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
17:37:16.0922 5188        THREADORDER - ok
17:37:16.0940 5188        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
17:37:16.0998 5188        TrkWks - ok
17:37:17.0026 5188        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
17:37:17.0083 5188        TrustedInstaller - ok
17:37:17.0101 5188        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
17:37:17.0130 5188        tssecsrv - ok
17:37:17.0163 5188        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
17:37:17.0193 5188        TsUsbFlt - ok
17:37:17.0228 5188        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
17:37:17.0298 5188        tunnel - ok
17:37:17.0313 5188        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
17:37:17.0325 5188        uagp35 - ok
17:37:17.0353 5188        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
17:37:17.0391 5188        udfs - ok
17:37:17.0408 5188        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
17:37:17.0436 5188        UI0Detect - ok
17:37:17.0456 5188        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
17:37:17.0467 5188        uliagpkx - ok
17:37:17.0487 5188        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
17:37:17.0527 5188        umbus - ok
17:37:17.0542 5188        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
17:37:17.0566 5188        UmPass - ok
17:37:17.0611 5188        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
17:37:17.0668 5188        upnphost - ok
17:37:17.0688 5188        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
17:37:17.0703 5188        usbaudio - ok
17:37:17.0737 5188        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
17:37:17.0772 5188        usbccgp - ok
17:37:17.0787 5188        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
17:37:17.0808 5188        usbcir - ok
17:37:17.0816 5188        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
17:37:17.0833 5188        usbehci - ok
17:37:17.0863 5188        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
17:37:17.0897 5188        usbhub - ok
17:37:18.0025 5188        USBMULCD        (f9b3054339a71f16430f6585ebc8be96) C:\Windows\system32\drivers\CM10664.sys
17:37:18.0138 5188        USBMULCD - ok
17:37:18.0161 5188        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
17:37:18.0195 5188        usbohci - ok
17:37:18.0225 5188        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
17:37:18.0265 5188        usbprint - ok
17:37:18.0328 5188        usbscan        (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
17:37:18.0358 5188        usbscan - ok
17:37:18.0375 5188        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
17:37:18.0423 5188        USBSTOR - ok
17:37:18.0440 5188        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
17:37:18.0478 5188        usbuhci - ok
17:37:18.0501 5188        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
17:37:18.0557 5188        UxSms - ok
17:37:18.0573 5188        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
17:37:18.0586 5188        VaultSvc - ok
17:37:18.0613 5188        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
17:37:18.0623 5188        vdrvroot - ok
17:37:18.0681 5188        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
17:37:18.0762 5188        vds - ok
17:37:18.0780 5188        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
17:37:18.0795 5188        vga - ok
17:37:18.0807 5188        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
17:37:18.0840 5188        VgaSave - ok
17:37:18.0863 5188        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
17:37:18.0876 5188        vhdmp - ok
17:37:18.0885 5188        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
17:37:18.0895 5188        viaide - ok
17:37:18.0902 5188        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
17:37:18.0912 5188        volmgr - ok
17:37:18.0957 5188        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
17:37:18.0988 5188        volmgrx - ok
17:37:19.0018 5188        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
17:37:19.0040 5188        volsnap - ok
17:37:19.0066 5188        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
17:37:19.0085 5188        vsmraid - ok
17:37:19.0198 5188        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
17:37:19.0280 5188        VSS - ok
17:37:19.0385 5188        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
17:37:19.0422 5188        vwifibus - ok
17:37:19.0472 5188        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
17:37:19.0520 5188        W32Time - ok
17:37:19.0537 5188        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
17:37:19.0550 5188        WacomPen - ok
17:37:19.0572 5188        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
17:37:19.0602 5188        WANARP - ok
17:37:19.0605 5188        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
17:37:19.0630 5188        Wanarpv6 - ok
17:37:19.0742 5188        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
17:37:19.0827 5188        wbengine - ok
17:37:19.0892 5188        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
17:37:19.0932 5188        WbioSrvc - ok
17:37:19.0986 5188        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
17:37:20.0015 5188        wcncsvc - ok
17:37:20.0027 5188        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
17:37:20.0075 5188        WcsPlugInService - ok
17:37:20.0095 5188        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
17:37:20.0110 5188        Wd - ok
17:37:20.0159 5188        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
17:37:20.0196 5188        Wdf01000 - ok
17:37:20.0205 5188        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
17:37:20.0302 5188        WdiServiceHost - ok
17:37:20.0307 5188        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
17:37:20.0344 5188        WdiSystemHost - ok
17:37:20.0371 5188        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
17:37:20.0395 5188        WebClient - ok
17:37:20.0412 5188        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
17:37:20.0461 5188        Wecsvc - ok
17:37:20.0485 5188        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
17:37:20.0515 5188        wercplsupport - ok
17:37:20.0546 5188        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
17:37:20.0592 5188        WerSvc - ok
17:37:20.0610 5188        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
17:37:20.0636 5188        WfpLwf - ok
17:37:20.0641 5188        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
17:37:20.0652 5188        WIMMount - ok
17:37:20.0676 5188        WinDefend - ok
17:37:20.0679 5188        WinHttpAutoProxySvc - ok
17:37:20.0739 5188        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
17:37:20.0794 5188        Winmgmt - ok
17:37:20.0924 5188        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
17:37:20.0979 5188        WinRM - ok
17:37:21.0092 5188        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
17:37:21.0145 5188        Wlansvc - ok
17:37:21.0331 5188        wlidsvc        (2bacd71123f42cea603f4e205e1ae337) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
17:37:21.0405 5188        wlidsvc - ok
17:37:21.0464 5188        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
17:37:21.0497 5188        WmiAcpi - ok
17:37:21.0534 5188        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
17:37:21.0557 5188        wmiApSrv - ok
17:37:21.0561 5188        WMPNetworkSvc - ok
17:37:21.0579 5188        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
17:37:21.0634 5188        WPCSvc - ok
17:37:21.0661 5188        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
17:37:21.0709 5188        WPDBusEnum - ok
17:37:21.0722 5188        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
17:37:21.0775 5188        ws2ifsl - ok
17:37:21.0784 5188        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
17:37:21.0804 5188        wscsvc - ok
17:37:21.0806 5188        WSearch - ok
17:37:21.0956 5188        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
17:37:22.0061 5188        wuauserv - ok
17:37:22.0130 5188        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
17:37:22.0176 5188        WudfPf - ok
17:37:22.0201 5188        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
17:37:22.0257 5188        WUDFRd - ok
17:37:22.0277 5188        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
17:37:22.0305 5188        wudfsvc - ok
17:37:22.0337 5188        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
17:37:22.0414 5188        WwanSvc - ok
17:37:22.0471 5188        xusb21          (2ee48cfce7ca8e0db4c44c7476c0943b) C:\Windows\system32\DRIVERS\xusb21.sys
17:37:22.0509 5188        xusb21 - ok
17:37:22.0542 5188        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
17:37:22.0675 5188        \Device\Harddisk0\DR0 - ok
17:37:22.0680 5188        Boot (0x1200)  (ec75946d32d26f3ac578640b588acd3e) \Device\Harddisk0\DR0\Partition0
17:37:22.0681 5188        \Device\Harddisk0\DR0\Partition0 - ok
17:37:22.0711 5188        Boot (0x1200)  (ffa36dfd2d58b8b3fa5e83b41ea63b89) \Device\Harddisk0\DR0\Partition1
17:37:22.0712 5188        \Device\Harddisk0\DR0\Partition1 - ok
17:37:22.0742 5188        Boot (0x1200)  (f3d76b6a3a49adcc04067347b24837bb) \Device\Harddisk0\DR0\Partition2
17:37:22.0745 5188        \Device\Harddisk0\DR0\Partition2 - ok
17:37:22.0745 5188        ============================================================
17:37:22.0745 5188        Scan finished
17:37:22.0745 5188        ============================================================
17:37:22.0761 2552        Detected object count: 3
17:37:22.0761 2552        Actual detected object count: 3
17:39:02.0910 2552        HiPatchService ( UnsignedFile.Multi.Generic ) - skipped by user
17:39:02.0910 2552        HiPatchService ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:39:02.0913 2552        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
17:39:02.0913 2552        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:39:02.0914 2552        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
17:39:02.0914 2552        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 27.04.2012 18:54
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

flaaghuhn 27.04.2012 19:55
Dies habe ich auch gemacht. Und es hat meinem PC irgendwie zu schaffen gemacht^^. Nach dem ersten Restart kam die von dir angesprochene Fehlermeldung, nach dem zweiten gab es einen Freeze (-> hard reset), jetzt geht es aber. Ich hoffe doch, durch Combofix ist nichts Wichtiges kaputt gegangen?

Log:
Combofix Logfile:
Code:
ComboFix 12-04-27.02 - *** 27.04.2012  20:09:43.1.8 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.4087.3051 [GMT 2:00]
ausgeführt von:: c:\users\***\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\users\***\AppData\Local\lame_enc.dll
c:\users\***\AppData\Local\no23xwrapper.dll
c:\users\***\AppData\Local\ogg.dll
c:\users\***\AppData\Local\vorbis.dll
c:\users\***\AppData\Local\vorbisenc.dll
c:\users\***\AppData\Local\vorbisfile.dll
c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\yf79f88y.default\weave\toFetch
c:\windows\SysWow64\urttemp
c:\windows\SysWow64\urttemp\regtlib.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-03-27 bis 2012-04-27  ))))))))))))))))))))))))))))))
.
.
2012-04-27 18:16 . 2012-04-27 18:16        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-04-27 18:15 . 2012-04-27 18:15        69000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F88D5816-404A-4D95-B372-62A5D39BAF7A}\offreg.dll
2012-04-27 10:20 . 2012-04-13 08:46        8917360        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F88D5816-404A-4D95-B372-62A5D39BAF7A}\mpengine.dll
2012-04-26 19:18 . 2012-04-26 19:18        --------        d-----w-        C:\_OTL
2012-04-26 13:16 . 2012-04-26 13:19        --------        d-----w-        C:\Fraps
2012-04-26 11:47 . 2012-04-26 11:47        --------        d-----w-        c:\users\***\AppData\Roaming\LibreOffice
2012-04-26 11:43 . 2012-04-26 11:45        --------        d-----w-        c:\program files (x86)\LibreOffice 3.5
2012-04-25 17:01 . 2012-04-25 17:01        --------        d-----w-        c:\program files (x86)\ESET
2012-04-25 15:48 . 2012-04-25 15:48        --------        d-----w-        c:\program files (x86)\Common Files\Java
2012-04-25 15:48 . 2012-04-25 15:47        637848        ----a-w-        c:\windows\SysWow64\npdeployJava1.dll
2012-04-25 15:47 . 2012-04-25 15:47        --------        d-----w-        c:\program files (x86)\Java
2012-04-25 15:46 . 2012-04-25 15:46        --------        d-----w-        c:\program files\Java
2012-04-21 21:25 . 2012-04-21 21:25        --------        d-----w-        c:\program files (x86)\Mozilla Maintenance Service
2012-04-21 21:25 . 2012-04-21 01:18        97208        ----a-w-        c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll
2012-04-21 21:25 . 2012-04-21 01:16        157352        ----a-w-        c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2012-04-21 21:25 . 2012-04-21 01:16        129976        ----a-w-        c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe
2012-04-20 19:34 . 2012-04-20 19:34        --------        d-----w-        c:\users\***\AppData\Local\Chromium
2012-04-20 17:20 . 2012-04-20 19:34        --------        d-----w-        c:\programdata\Hi-Rez Studios
2012-04-20 17:20 . 2012-04-20 17:20        --------        d-----w-        c:\program files (x86)\Hi-Rez Studios
2012-04-20 16:44 . 2012-04-20 16:44        --------        d--h--r-        c:\users\***\AppData\Roaming\SecuROM
2012-04-20 16:17 . 2012-04-20 16:17        669184        ----a-w-        c:\windows\SysWow64\pbsvc.exe
2012-04-14 00:57 . 2012-04-14 01:15        --------        d-----w-        c:\program files (x86)\Resource Hacker
2012-04-13 01:03 . 2012-04-13 01:03        --------        d-----w-        c:\users\***\AppData\Local\IsolatedStorage
2012-04-12 13:17 . 2012-04-12 13:17        --------        d-----w-        c:\programdata\TrackMania
2012-04-12 01:00 . 2012-03-01 06:46        23408        ----a-w-        c:\windows\system32\drivers\fs_rec.sys
2012-04-12 01:00 . 2012-03-01 06:33        81408        ----a-w-        c:\windows\system32\imagehlp.dll
2012-04-12 01:00 . 2012-03-01 05:33        159232        ----a-w-        c:\windows\SysWow64\imagehlp.dll
2012-04-12 01:00 . 2012-03-01 05:37        172544        ----a-w-        c:\windows\SysWow64\wintrust.dll
2012-04-12 01:00 . 2012-03-01 06:38        220672        ----a-w-        c:\windows\system32\wintrust.dll
2012-04-12 01:00 . 2012-03-01 06:28        5120        ----a-w-        c:\windows\system32\wmi.dll
2012-04-12 01:00 . 2012-03-01 05:29        5120        ----a-w-        c:\windows\SysWow64\wmi.dll
2012-04-11 21:35 . 2012-04-20 18:09        --------        d-----w-        c:\users\***\riotsGamesLogs
2012-04-11 17:48 . 2012-04-11 17:48        --------        d-----w-        c:\users\***H
2012-04-11 16:35 . 2012-04-11 16:52        --------        d-----w-        c:\program files\7-Zip
2012-04-11 13:15 . 2012-04-11 13:16        --------        d-----w-        c:\program files (x86)\TmNationsForever
2012-04-09 00:38 . 2012-04-09 00:38        --------        d-----w-        c:\users\***\AppData\Roaming\LolClient
2012-04-08 20:54 . 2008-07-12 06:18        467984        ----a-w-        c:\windows\SysWow64\d3dx10_39.dll
2012-04-08 20:54 . 2008-07-12 06:18        1493528        ----a-w-        c:\windows\SysWow64\D3DCompiler_39.dll
2012-04-08 20:54 . 2008-07-12 06:18        3851784        ----a-w-        c:\windows\SysWow64\D3DX9_39.dll
2012-04-08 20:40 . 2012-04-08 20:40        --------        d-----w-        C:\Riot Games
2012-04-08 19:10 . 2012-04-08 19:10        --------        d-----w-        c:\program files (x86)\Pando Networks
2012-04-04 17:35 . 2012-04-04 17:50        --------        d-----w-        c:\users\***\AppData\Local\My Games
2012-04-04 17:16 . 2012-04-04 17:16        --------        d-----w-        c:\program files (x86)\2K Games
2012-04-04 17:14 . 2012-04-04 17:14        --------        d-----w-        c:\users\***\AppData\Roaming\InstallShield
2012-04-02 10:32 . 2012-04-13 20:32        8741536        ----a-w-        c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-02 10:24 . 2012-04-13 20:32        418464        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-04-01 16:38 . 2012-04-01 17:00        --------        d-----w-        c:\users\***\AppData\Roaming\codeblocks
2012-04-01 16:09 . 2012-04-01 17:08        --------        d-----w-        c:\users\***\AppData\Roaming\Dev-Cpp
2012-04-01 16:08 . 2012-04-01 17:01        --------        d-----w-        C:\Dev-Cpp
2012-04-01 16:03 . 2012-04-01 16:17        --------        d-----w-        c:\users\***\AppData\Roaming\Notepad++
2012-04-01 16:03 . 2012-04-01 16:03        --------        d-----w-        c:\program files (x86)\Notepad++
2012-03-30 17:45 . 2012-03-30 17:45        --------        d-----w-        c:\program files (x86)\Microsoft Silverlight
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-25 15:47 . 2012-03-21 21:04        567696        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2012-04-25 15:46 . 2012-01-15 12:36        750488        ----a-w-        c:\windows\system32\npdeployJava1.dll
2012-04-25 15:46 . 2012-01-15 12:36        660368        ----a-w-        c:\windows\system32\deployJava1.dll
2012-04-20 16:17 . 2012-01-15 13:04        103736        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe
2012-04-20 16:17 . 2012-01-15 13:04        103736        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0
2012-04-17 13:37 . 2012-01-15 18:01        283304        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr
2012-04-13 20:32 . 2012-01-14 21:35        70304        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-04-04 13:56 . 2012-02-10 18:00        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-03-07 00:15 . 2012-02-14 13:04        41184        ----a-w-        c:\windows\avastSS.scr
2012-03-07 00:15 . 2012-02-14 13:04        201352        ----a-w-        c:\windows\SysWow64\aswBoot.exe
2012-03-07 00:15 . 2012-02-14 13:05        258520        ----a-w-        c:\windows\system32\aswBoot.exe
2012-03-07 00:04 . 2012-02-14 13:05        819032        ----a-w-        c:\windows\system32\drivers\aswSnx.sys
2012-03-07 00:04 . 2012-02-14 13:05        337240        ----a-w-        c:\windows\system32\drivers\aswSP.sys
2012-03-07 00:02 . 2012-02-26 18:38        53080        ----a-w-        c:\windows\system32\drivers\aswRdr2.sys
2012-03-07 00:01 . 2012-02-14 13:05        59224        ----a-w-        c:\windows\system32\drivers\aswTdi.sys
2012-03-07 00:01 . 2012-02-14 13:05        69976        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys
2012-03-07 00:01 . 2012-02-14 13:05        24408        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys
2012-02-23 08:18 . 2012-01-14 22:01        279656        ------w-        c:\windows\system32\MpSigStub.exe
2012-02-17 06:38 . 2012-03-14 15:07        1031680        ----a-w-        c:\windows\system32\rdpcore.dll
2012-02-17 05:34 . 2012-03-14 15:07        826880        ----a-w-        c:\windows\SysWow64\rdpcore.dll
2012-02-17 04:58 . 2012-03-14 15:07        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-02-17 04:57 . 2012-03-14 15:07        23552        ----a-w-        c:\windows\system32\drivers\tdtcp.sys
2012-02-14 21:05 . 2012-02-14 21:05        69632        ----a-w-        c:\windows\system32\OpenVideo64.dll
2012-02-14 21:05 . 2012-02-14 21:05        59904        ----a-w-        c:\windows\SysWow64\OpenVideo.dll
2012-02-14 21:05 . 2012-02-14 21:05        16507904        ----a-w-        c:\windows\system32\amdocl64.dll
2012-02-14 21:04 . 2012-02-14 21:04        13238272        ----a-w-        c:\windows\SysWow64\amdocl.dll
2012-02-14 21:03 . 2012-02-14 21:03        54272        ----a-w-        c:\windows\system32\OpenCL.dll
2012-02-14 21:03 . 2012-02-14 21:03        48128        ----a-w-        c:\windows\SysWow64\OpenCL.dll
2012-02-14 15:37 . 2012-01-15 13:04        76888        ----a-w-        c:\windows\SysWow64\PnkBstrA.exe
2012-02-11 19:00 . 2012-02-11 19:00        18328        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-02-10 06:36 . 2012-03-14 17:47        1544192        ----a-w-        c:\windows\system32\DWrite.dll
2012-02-10 05:38 . 2012-03-14 17:47        1077248        ----a-w-        c:\windows\SysWow64\DWrite.dll
2012-02-03 04:34 . 2012-03-14 17:47        3145728        ----a-w-        c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58        94208        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58        94208        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58        94208        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-29 17148552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-08-15 1955208]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-07 4241512]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-12-05 343168]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-26 136176]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-15 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 253088]
R3 ALSysIO;ALSysIO;c:\users\***\AppData\Local\Temp\ALSysIO64.sys [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-26 136176]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-21 129976]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 2329480]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM10664.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 20:32]
.
2012-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-26 18:41]
.
2012-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-26 18:41]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-07 00:15        135408        ----a-w-        c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58        97792        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58        97792        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58        97792        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58        97792        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-12-13 13374568]
"Cm106Sound"="c:\windows\Syswow64\cm106.dll" [2011-03-31 8151040]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page =
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Free YouTube Download - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: Interfaces\{42847496-B284-445A-B872-6729C5DB2D9E}: NameServer = 82.145.9.8 89.246.64.8
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\yf79f88y.default\
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true);user_pref(extensions.funmoods_i.hmpg, true
FF - user.js: extensions.funmoods_i.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=make
FF - user.js: extensions.funmoods_i.dfltSrch - true
FF - user.js: extensions.funmoods_i.srchPrvdr - Search
FF - user.js: extensions.funmoods_i.dnsErr - true
FF - user.js: extensions.funmoods_i.newTab - true
FF - user.js: extensions.funmoods_i.newTabUrl - hxxp://start.funmoods.com/?f=2&a=make
FF - user.js: extensions.funmoods_i.tlbrSrchUrl - hxxp://start.funmoods.com/results.php?f=3&a=make&q=
FF - user.js: extensions.funmoods_i.id - da79ef66000000000000000000000000
FF - user.js: extensions.funmoods_i.instlDay - 15390
FF - user.js: extensions.funmoods_i.vrsn - 1.5.11.16
FF - user.js: extensions.funmoods_i.vrsni - 1.5.11.16
FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.11.1623:01
FF - user.js: extensions.funmoods_i.prtnrId - funmoods
FF - user.js: extensions.funmoods_i.prdct - funmoods
FF - user.js: extensions.funmoods_i.aflt - make
FF - user.js: extensions.funmoods_i.smplGrp - none
FF - user.js: extensions.funmoods_i.tlbrId - base
FF - user.js: extensions.funmoods_i.instlRef -
FF - user.js: extensions.funmoods_i.dfltLng -
FF - user.js: extensions.funmoods_i.excTlbr - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-04-27  20:41:25 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-04-27 18:41
.
Vor Suchlauf: 12 Verzeichnis(se), 730.638.594.048 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 730.571.755.520 Bytes frei
.
- - End Of File - - A9E6DC71632503CAA494C40A0BE6A7E8
--- --- ---

cosinus 27.04.2012 20:01
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

flaaghuhn 27.04.2012 23:27
Und der nächste Log^^.
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-27 23:50:03
-----------------------------
23:50:03.712    OS Version: Windows x64 6.1.7601 Service Pack 1
23:50:03.712    Number of processors: 8 586 0x1E05
23:50:03.713    ComputerName: ***  UserName:
23:50:05.722    Initialize success
23:50:06.148    AVAST engine defs: 12042701
23:50:47.009    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
23:50:47.014    Disk 0 Vendor: WDC_WD10EARS-00Y5B1 80.00A80 Size: 953869MB BusType: 11
23:50:47.029    Disk 0 MBR read successfully
23:50:47.034    Disk 0 MBR scan
23:50:47.040    Disk 0 Windows 7 default MBR code
23:50:47.047    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
23:50:47.073    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      927142 MB offset 206848
23:50:47.103    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        25600 MB offset 1898993664
23:50:47.125    Disk 0 Partition 4 00    12  Compaq diag NTFS        1025 MB offset 1951422464
23:50:47.170    Disk 0 scanning C:\Windows\system32\drivers
23:50:54.588    Service scanning
23:51:05.837    Modules scanning
23:51:05.852    Disk 0 trace - called modules:
23:51:05.871    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
23:51:05.882    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004d58790]
23:51:05.891    3 CLASSPNP.SYS[fffff8800196243f] -> nt!IofCallDriver -> [0xfffffa8004acb1e0]
23:51:05.899    5 ACPI.sys[fffff88000fb37a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004aeb060]
23:51:07.133    AVAST engine scan C:\Windows
23:51:10.467    AVAST engine scan C:\Windows\system32
23:52:35.258    AVAST engine scan C:\Windows\system32\drivers
23:52:41.681    AVAST engine scan C:\Users\***
23:54:44.174    AVAST engine scan C:\ProgramData
23:56:19.359    Scan finished successfully
00:24:28.199    Disk 0 MBR has been saved successfully to "C:\Users\***\Desktop\MBR.dat"
00:24:28.209    The log file has been saved successfully to "C:\Users\***\Desktop\aswMBRlog.txt"
Grüße,
flaaghuhn

cosinus 28.04.2012 14:08
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

flaaghuhn 28.04.2012 19:13
Malwarebytes findet nichts.
Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.04.24.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** :: *** [Administrator]

24.04.2012 17:12:36
mbam-log-2012-04-24 (18-26-13).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 472548
Laufzeit: 1 Stunde(n), 6 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} (PUP.Funmoods) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki (PUP.Funmoods) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 2
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Daten:  -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Daten: Funmoods Toolbar -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
SUPERAntiSpyware findet eine Menge Tracking-Cookies, sonst aber nichts.
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 04/28/2012 at 07:09 PM

Application Version : 5.0.1148

Core Rules Database Version : 8528
Trace Rules Database Version: 6340

Scan type      : Complete Scan
Total Scan Time : 02:09:44

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 744
Memory threats detected  : 0
Registry items scanned    : 65215
Registry threats detected : 0
File items scanned        : 286753
File threats detected    : 87

Adware.Tracking Cookie
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\MFPEKUSB.txt [ /track.adform.net ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\XOGEDFUL.txt [ /fastclick.net ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\EKS3HILZ.txt [ /doubleclick.net ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\I234PUW1.txt [ /adform.net ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\T9870YS7.txt [ /ad.yieldmanager.com ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\AOAQGPOR.txt [ /serving-sys.com ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\QEZ9R29C.txt [ /atdmt.com ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\41339EK3.txt [ /c.atdmt.com ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\D6T8SQGK.txt [ /bs.serving-sys.com ]
        C:\USERS\***\Cookies\MFPEKUSB.txt [ Cookie:***@track.adform.net/ ]
        C:\USERS\***\Cookies\EKS3HILZ.txt [ Cookie:***@doubleclick.net/ ]
        C:\USERS\***\Cookies\I234PUW1.txt [ Cookie:***@adform.net/ ]
        C:\USERS\***\Cookies\T9870YS7.txt [ Cookie:***@ad.yieldmanager.com/ ]
        C:\USERS\***\Cookies\QEZ9R29C.txt [ Cookie:***@atdmt.com/ ]
        C:\USERS\***\Cookies\41339EK3.txt [ Cookie:***@c.atdmt.com/ ]
        C:\USERS\***\Cookies\D6T8SQGK.txt [ Cookie:***@bs.serving-sys.com/ ]
        C:\USERS\****\AppData\Roaming\Microsoft\Windows\Cookies\0MUFQ0A7.txt [ Cookie:****@c.atdmt.com/ ]
        C:\USERS\****\AppData\Roaming\Microsoft\Windows\Cookies\WM44MKBX.txt [ Cookie:****@atdmt.com/ ]
        C:\USERS\****\Cookies\0MUFQ0A7.txt [ Cookie:****@c.atdmt.com/ ]
        C:\USERS\****\Cookies\WM44MKBX.txt [ Cookie:****@atdmt.com/ ]
        .amazon-adsystem.com [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .amazon-adsystem.com [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .doubleclick.net [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad2.adfarm1.adition.com [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .eaeacom.112.2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        www.multimediaxis.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        www.multimediaxis.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        www.counter-go.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        www.elitepvpers.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        www.elitepvpers.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        www.elitepvpers.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        stats.computecmedia.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .youporn.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .youporn.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .youporn.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .youporn.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .youporn.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .countomat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        stats.computecmedia.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        uk.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        uk.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YF79F88Y.DEFAULT\COOKIES.SQLITE ]
Habe/hatte ich eigentlich Trojaner/Viren auf dem PC gehabt oder hat irgendein Programm diese "funmoods" installiert?

cosinus 30.04.2012 11:32
Zitat:
Keine Aktion durchgeführt.
-> No action taken.
Die Funde müssen mit Malwarebytes entfernt waren! Bitte nachholen falls noch nicht getan!

flaaghuhn 30.04.2012 11:58
Öhm, ich merke grad, das Log von Malwarebytes, das ich gepostet habe, ist das Log, welches ich im ersten Beitrag drangehängt habe *peinlich*^^. Habe wohl irgendwo verklickt.
Das richtige Log:
Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.04.28.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** :: *** [Administrator]

28.04.2012 15:22:15
mbam-log-2012-04-28 (15-22-15).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 470344
Laufzeit: 1 Stunde(n), 6 Minute(n), 51 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Es ändert aber nichts daran, dass die Funde beim ersten Scan nicht gelöscht wurden (warum auch immer). Habe sie jetzt aus der Quarantäne gelöscht.

cosinus 30.04.2012 12:52
Zitat:
Es ändert aber nichts daran, dass die Funde beim ersten Scan nicht gelöscht wurden (warum auch immer)
Weil du die nicht entfernt hast :pfeiff:

Sieht ok aus, da wurden ansonsten nur Cookies gefunden. Kannst du mit SASW löschen.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

flaaghuhn 30.04.2012 14:59
Mit meinem System habe ich keine Probleme und andere Funde habe ich (noch^^) nicht.

Ist denn alles wieder "clean"?

cosinus 30.04.2012 17:33
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

flaaghuhn 30.04.2012 20:38
Die benutzen Tools habe ich erfolgreich von der Platte geschmissen.
Aber eine kleine Frage hätte ich noch: Was für Malware war den auf meinem Rechner?

Jedenfalls ein sehr großes Dankeschön an dich für deine Hilfe, und auch großes Lob an dieses Forum :).

Grüße,

flaaghuhn

Öhm, entschuldige wieder das Doppelposting, aber so normal verhält sich mein PC doch nicht.

Beim Booten, bevor Windows geladen wird, kommt normalerweise eine Sequenz, in der der Bildschirm schwarz ist und ein weißer "Unterstrich" kurz blinkt (dauert normalerweiser weniger als eine Sekunde). Seit kurzem dauert diese Sequenz aber ewig lange (ca 10s). Und auch den Willkommensbildschirm darf ich nach dem Einloggen ziemlich lange sehen...

Ist da irgendetwas "faul"?

cosinus 01.05.2012 14:44
Zitat:
Aber eine kleine Frage hätte ich noch: Was für Malware war den auf meinem Rechner?
Siehst du doch in den Logs der Virenscanner und anderen Tools :wtf: wieso muss ich das alles nochmal wiederholen
Zitat:
Ist da irgendetwas "faul"?
War das direkt nach den Updates?

flaaghuhn 01.05.2012 16:29
Meinst du die von dir vorgeschlagenen Updates? Nein, früher.


Alle Zeitangaben in WEZ +1. Es ist jetzt 13:47 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131