Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   svchost.exe (https://www.trojaner-board.de/115892-svchost-exe.html)

Lukas1997 28.05.2012 18:19
svchost.exe
 
Also, ich habe folgendes Problem:
Seit kurzem blockt Bitdefender immer einen Prozess namens svchost.exe.
Es ist aber NICHT die svchost.exe in system32, sondern die Datei liegt unter meinem Benutzerkonto in AppData\Roaming\Microsoft.
Allerdings kann ich die Datei nicht mit dem Windows-Explorer finden und Bitdefender findet auch bei einem Systemscan nichts verdächtiges.
Ich habe auch schon Programme wie Spybot S&D ausprobiert, aber die finden auch nichts.
Was soll ich tun?

Ich habe noch etwas vergessen, irgendein Programm deaktiviert ständig den Scan von Bitdefender.
Und hier ist noch der Logfile:

BitDefender Log File

Product : Bitdefender Internet Security 2012
Scanning task : Vollständiger System-Scan
Log date : Dienstag, 29. Mai 2012 09:29:45
Log path : C:\ProgramData\Bitdefender\Desktop\Profiles\Logs\dcf483c4-26d0-4e6f-ba28-6a53a00adae1\1338275457_1_02.xml

Scan Paths:
Path : C:\

[-]Scan Results
[-]Resolved issues:Object Path Threat Name Final Status
Cookie: C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Cookies\8QS8ZOE5.txt Cookie.DoubleClick Deleted

[-]Objects that were not scanned:Object Path Reason Final Status
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/page0.html Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar1.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/page2.html Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar3.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar4.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar5.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/title.png Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar6.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar7.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/options.js Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/Babylon.dat Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar8.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/BExternal.dll Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar9.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/bab091.norecovericon.dat Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/globe.png Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar10.zip=>sbRecovery.reg Password-protected Not scanned (file was password-protected)
File: C:\Users\Lukas\Downloads\AntiVirus2012Download.rar=>AntiVirus2012Download=>AntiVirus2012.rar=>AntiVirus2012.exe Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar11.zip=>sbRecovery.reg Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/Setup-latest-30b.zpb Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar12.zip=>sbRecovery.reg Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/toolBar.jpg Password-protected Not scanned (file was password-protected)
File: C:\Program Files (x86)\InstallShield Installation Information\{B46BEA36-0B71-4A4E-AE41-87241643FA0A}\SupportFiles.7z=>PowerDVD12.ico Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\WinAgentadb.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/Setup.exe Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/SetupStrings.dat Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/page3Lrg.css Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/bab033.tbinst.dat Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar3.zip=>sbRecovery.reg Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar4.zip=>sbRecovery.reg Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar5.zip=>sbRecovery.reg Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/page3.html Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar6.zip=>sbRecovery.reg Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/Setup-tbmntr903.zpb Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar7.zip=>sbRecovery.reg Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/blueStar.png Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar8.zip=>sbRecovery.reg Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/Chrome_tb.zpb Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar9.zip=>sbRecovery.reg Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/sqlite3.dll Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar1.zip=>Users/Lukas/AppData/Roaming/Babylon/log_file.txt Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/sign Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/setup.js Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar10.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar11.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar12.zip=>sbRecovery.ini Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/page2.css Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/page3.css Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\WinAgentadb.zip=>sbRecovery.reg Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/progress.png Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/pBar.gif Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/eula.html Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/HtmlScreens/page2Lrg.css Password-protected Not scanned (file was password-protected)
File: C:\ProgramData\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip=>Users/Lukas/AppData/Local/Babylon/Setup/IECookieLow.dll Password-protected Not scanned (file was password-protected)

[-]Detailed Scan Summary
[-]Basic
Scanned items : 293799
Infected items : 1
Suspicious items : 0 (no suspected items have been detected)
Resolved items : 1
Unresolved items : 0 (no issues remained unresolved)

[-]Advanced
Scan time : 0: 17: 40
Files per second : 277
Skipped items : 390853
Password-protected items : 56
Overcompressed items : 0
Scanned archives : 7
Input-output errors : 0
Scanned boot sectors : 4
Scanned processes : 4551
Infected processes : 0
Scanned registry keys : 2010
Infected registry keys : 0
Scanned cookies : 163
Infected cookies : 1

[-]Scan Options
[-]Target Threat Types:
Scan for viruses : Yes
Scan for adware : Yes
Scan for spyware : Yes
Scan for applications : Yes
Scan for dialers : Yes
Scan for rootkits : Yes
Scan for keyloggers : Yes

[-]Target Selection Options:
Scan registry keys : Yes
Scan cookies : Yes
Scan boot sectors : Yes
Scan memory processes : Yes
Scan archives : Yes
Scan runtime packers : Yes
Scan emails : Yes
Scan all files : Yes
Heuristic Scan : Yes
Scanned extensions : none configured
Excluded extensions : none configured

[-]Target Processing:
Default primary action for infected objects : Disinfect
Default secondary action for infected objects : Move to Quarantine
Default primary action for suspicious objects : Move to Quarantine
Default secondary action for suspicious objects : None
Default action for hidden objects : Disinfect
Default action for password-protected objects : Log as not scanned

[-]Scan engines summary
Number of virus signatures : 7245322

cosinus 30.05.2012 14:07
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Lukas1997 01.06.2012 20:27
Also, das Problem hat sich erledigt als ich mit Malwarebytes gescannt habe.
Der Virus wurde gefunden und gelöscht.
Hier trotzdem noch der Logfile:

Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.01.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Lukas :: DESKTOP-PC [Administrator]

Schutz: Aktiviert

01.06.2012 13:13:55
mbam-log-2012-06-01 (13-13-55).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 355180
Laufzeit: 8 Stunde(n), 5 Minute(n), 27 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Startup (Trojan.Agent) -> Daten: C:\Users\Lukas\AppData\Roaming\Microsoft\svchost.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Users\Lukas\AppData\Roaming\dclogs (Stolen.Data) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 3
C:\Windows\System32\cmdow.exe (PUP.Tool) -> Keine Aktion durchgeführt.
C:\Users\Lukas\AppData\Roaming\Microsoft\svchost.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lukas\AppData\Roaming\dclogs\2012-05-19-7.dc (Stolen.Data) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

cosinus 02.06.2012 18:07
Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Außerdem fehlt ESET noch!

Lukas1997 02.06.2012 21:47
Ältere Scans von Malwarebytes habe ich nicht, aber hier ist das Ergebnis von
Eset:
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=7a5294b26c87b84e823767628300806f
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-06-01 11:54:44
# local_time=2012-06-01 01:54:44 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 601682 90179643 0 0
# compatibility_mode=8192 67108863 100 0 362 362 0 0
# scanned=7528
# found=0
# cleaned=0
# scan_time=1891
Aber wie bereits erwähnt ist die Datei nicht mehr zu finden.

cosinus 03.06.2012 13:00
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Lukas1997 03.06.2012 15:58
Ja, Windows startet wieder ordnungsgemäß, wenn auch etwas langsamer.
Das hat aber glaube ich eher etwas damit zu tun das Windows nicht aufgeräumt ist.
Und nein, ich habe keine leeren Verzeichnisse gefunden und es ist auch noch alles da.

cosinus 03.06.2012 17:14
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Lukas1997 06.06.2012 12:34
Habe mit OTL gescannt und es hat auch ohne Probleme geklappt.
Da das Log zu groß ist habe ich es als zip angehängt.

cosinus 06.06.2012 14:40
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKU\S-1-5-21-1452557258-77057033-3389612022-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=113480&tt=100512_1_&babsrc=HP_ss&mntrId=9ac4fba1000000000000001f1f607b79
IE - HKU\S-1-5-21-1452557258-77057033-3389612022-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1452557258-77057033-3389612022-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-1452557258-77057033-3389612022-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 8A BF 56 48 A2 2F CD 01  [binary data]
IE - HKU\S-1-5-21-1452557258-77057033-3389612022-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-1452557258-77057033-3389612022-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1452557258-77057033-3389612022-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=113480&tt=100512_1_&babsrc=SP_ss&mntrId=9ac4fba1000000000000001f1f607b79
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "https://www.google.de/"
FF - prefs.js..keyword.URL: "http://search.babylon.com/?affID=113480&tt=100512_1_&babsrc=KW_ss&mntrId=9ac4fba1000000000000001f1f607b79&q="
[2012.05.12 10:29:27 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Program Files (x86)\mozilla firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012.05.29 18:30:39 | 000,002,352 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.lnk =  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1452557258-77057033-3389612022-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003.07.03 07:07:02 | 000,000,000 | ---D | M] - D:\Autorun -- [ CDFS ]
O32 - AutoRun File - [2003.06.25 12:17:32 | 001,101,824 | R--- | M] () - D:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2003.06.25 06:59:54 | 000,001,982 | R--- | M] () - D:\autorun.csf -- [ CDFS ]
O32 - AutoRun File - [2003.06.20 07:01:00 | 000,000,027 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2003.06.25 12:17:30 | 000,087,060 | R--- | M] () - D:\autorun.obj -- [ CDFS ]
O33 - MountPoints2\{9c571211-9bae-11e1-a016-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{9c571211-9bae-11e1-a016-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe -- [2003.06.25 12:17:32 | 001,101,824 | R--- | M] ()
:Files
C:\Users\Lukas\AppData\Roaming\Babylon
C:\Users\Lukas\AppData\Roaming\kndnlpadobhdmiplckgecjhpeibcepkj
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Lukas1997 06.06.2012 15:41
Hat alles super geklappt und hier das Log:
Code:
All processes killed
========== OTL ==========
HKU\S-1-5-21-1452557258-77057033-3389612022-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-1452557258-77057033-3389612022-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKU\S-1-5-21-1452557258-77057033-3389612022-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKU\S-1-5-21-1452557258-77057033-3389612022-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
HKEY_USERS\S-1-5-21-1452557258-77057033-3389612022-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1452557258-77057033-3389612022-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1452557258-77057033-3389612022-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Prefs.js: "Search the web (Babylon)" removed from browser.search.defaultenginename
Prefs.js: "Search the web (Babylon)" removed from browser.search.order.1
Prefs.js: "Google" removed from browser.search.selectedEngine
Prefs.js: "https://www.google.de/" removed from browser.startup.homepage
Prefs.js: "hxxp://search.babylon.com/?affID=113480&tt=100512_1_&babsrc=KW_ss&mntrId=9ac4fba1000000000000001f1f607b79&q=" removed from keyword.URL
C:\Program Files (x86)\mozilla firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\META-INF folder moved successfully.
C:\Program Files (x86)\mozilla firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults\preferences folder moved successfully.
C:\Program Files (x86)\mozilla firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults folder moved successfully.
C:\Program Files (x86)\mozilla firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components folder moved successfully.
C:\Program Files (x86)\mozilla firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\chrome folder moved successfully.
C:\Program Files (x86)\mozilla firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} folder moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml moved successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp.lnk moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLinkedConnections deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-21-1452557258-77057033-3389612022-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableLockWorkstation deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File  not found.
File move failed. D:\Autorun.exe scheduled to be moved on reboot.
File move failed. D:\autorun.csf scheduled to be moved on reboot.
File move failed. D:\autorun.inf scheduled to be moved on reboot.
File move failed. D:\autorun.obj scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9c571211-9bae-11e1-a016-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9c571211-9bae-11e1-a016-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9c571211-9bae-11e1-a016-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9c571211-9bae-11e1-a016-806e6f6e6963}\ not found.
File move failed. D:\Autorun.exe scheduled to be moved on reboot.
========== FILES ==========
C:\Users\Lukas\AppData\Roaming\Babylon folder moved successfully.
C:\Users\Lukas\AppData\Roaming\kndnlpadobhdmiplckgecjhpeibcepkj\7.0.1428_0\icons folder moved successfully.
C:\Users\Lukas\AppData\Roaming\kndnlpadobhdmiplckgecjhpeibcepkj\7.0.1428_0 folder moved successfully.
C:\Users\Lukas\AppData\Roaming\kndnlpadobhdmiplckgecjhpeibcepkj folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Lukas
->Temp folder emptied: 404034864 bytes
->Temporary Internet Files folder emptied: 79206664 bytes
->FireFox cache emptied: 1119809179 bytes
->Flash cache emptied: 28889 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 326432 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 46666183 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36028471 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 1.608,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Lukas
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.46.1 log created on 06062012_163356

Files\Folders moved on Reboot...
File move failed. D:\Autorun.exe scheduled to be moved on reboot.
File move failed. D:\autorun.csf scheduled to be moved on reboot.
File move failed. D:\autorun.inf scheduled to be moved on reboot.
File move failed. D:\autorun.obj scheduled to be moved on reboot.
C:\Users\Lukas\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\CLDigitalHome\CLMS_AGENT_LOG1.txt scheduled to be moved on reboot.
File\Folder C:\Windows\temp\~bdC452.tmp not found!

Registry entries deleted on Reboot...

cosinus 06.06.2012 15:44
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Lukas1997 06.06.2012 16:03
Er hat irgend etwas im Alcohol 52% Verzeichniss gefunden.:-(
Ich hab die Datei in Quarantäne verschoben.
Hier das Log:
Code:
16:54:31.0729 3312        TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16
16:54:33.0499 3312        ============================================================
16:54:33.0499 3312        Current date / time: 2012/06/06 16:54:33.0499
16:54:33.0499 3312        SystemInfo:
16:54:33.0499 3312       
16:54:33.0499 3312        OS Version: 6.1.7601 ServicePack: 1.0
16:54:33.0499 3312        Product type: Workstation
16:54:33.0499 3312        ComputerName: DESKTOP-PC
16:54:33.0500 3312        UserName: Lukas
16:54:33.0500 3312        Windows directory: C:\Windows
16:54:33.0500 3312        System windows directory: C:\Windows
16:54:33.0500 3312        Running under WOW64
16:54:33.0500 3312        Processor architecture: Intel x64
16:54:33.0500 3312        Number of processors: 6
16:54:33.0500 3312        Page size: 0x1000
16:54:33.0500 3312        Boot type: Normal boot
16:54:33.0500 3312        ============================================================
16:54:35.0046 3312        Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:54:35.0058 3312        ============================================================
16:54:35.0058 3312        \Device\Harddisk0\DR0:
16:54:35.0058 3312        MBR partitions:
16:54:35.0058 3312        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
16:54:35.0058 3312        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D3800
16:54:35.0058 3312        ============================================================
16:54:35.0079 3312        C: <-> \Device\Harddisk0\DR0\Partition1
16:54:35.0079 3312        ============================================================
16:54:35.0079 3312        Initialize success
16:54:35.0079 3312        ============================================================
16:55:04.0990 3468        ============================================================
16:55:04.0990 3468        Scan started
16:55:04.0990 3468        Mode: Manual; SigCheck; TDLFS;
16:55:04.0990 3468        ============================================================
16:55:05.0473 3468        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
16:55:05.0536 3468        1394ohci - ok
16:55:05.0583 3468        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
16:55:05.0598 3468        ACPI - ok
16:55:05.0598 3468        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
16:55:05.0629 3468        AcpiPmi - ok
16:55:05.0676 3468        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
16:55:05.0707 3468        adp94xx - ok
16:55:05.0707 3468        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
16:55:05.0723 3468        adpahci - ok
16:55:05.0739 3468        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
16:55:05.0754 3468        adpu320 - ok
16:55:05.0785 3468        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
16:55:05.0832 3468        AeLookupSvc - ok
16:55:05.0863 3468        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
16:55:05.0879 3468        AFD - ok
16:55:05.0910 3468        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
16:55:05.0941 3468        agp440 - ok
16:55:05.0957 3468        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
16:55:05.0988 3468        ALG - ok
16:55:06.0004 3468        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
16:55:06.0019 3468        aliide - ok
16:55:06.0066 3468        ALSysIO - ok
16:55:06.0129 3468        AMD External Events Utility (20c8a3e435a47f0408a1ea674afa6194) C:\Windows\system32\atiesrxx.exe
16:55:06.0191 3468        AMD External Events Utility - ok
16:55:06.0253 3468        AMD FUEL Service - ok
16:55:06.0300 3468        AMDFusionSVC    (b2b7d8f695b5d97a63eda789e9d237e1) C:\Program Files (x86)\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe
16:55:06.0347 3468        AMDFusionSVC - ok
16:55:06.0363 3468        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
16:55:06.0363 3468        amdide - ok
16:55:06.0394 3468        amdiox64        (6a2eeb0c4133b20773bb3dd0b7b377b4) C:\Windows\system32\DRIVERS\amdiox64.sys
16:55:06.0394 3468        amdiox64 - ok
16:55:06.0409 3468        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
16:55:06.0441 3468        AmdK8 - ok
16:55:06.0815 3468        amdkmdag        (0b45c18b0f3ee996d25baa4e74884b83) C:\Windows\system32\DRIVERS\atikmdag.sys
16:55:07.0143 3468        amdkmdag - ok
16:55:07.0221 3468        amdkmdap        (0e57258e5cc4cc7a9a9a877afdf0cec6) C:\Windows\system32\DRIVERS\atikmpag.sys
16:55:07.0252 3468        amdkmdap - ok
16:55:07.0267 3468        AmdLLD64        (c27e46c19d5a48ca02c11e3c9b58f4c1) C:\Windows\system32\DRIVERS\AmdLLD64.sys
16:55:07.0283 3468        AmdLLD64 - ok
16:55:07.0299 3468        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
16:55:07.0330 3468        AmdPPM - ok
16:55:07.0361 3468        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
16:55:07.0377 3468        amdsata - ok
16:55:07.0377 3468        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
16:55:07.0392 3468        amdsbs - ok
16:55:07.0408 3468        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
16:55:07.0408 3468        amdxata - ok
16:55:07.0423 3468        AODDriver4.1    (5b25d1a753cc3a3edb909bb759ac1098) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys
16:55:07.0439 3468        AODDriver4.1 - ok
16:55:07.0486 3468        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
16:55:07.0564 3468        AppID - ok
16:55:07.0595 3468        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
16:55:07.0657 3468        AppIDSvc - ok
16:55:07.0704 3468        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
16:55:07.0751 3468        Appinfo - ok
16:55:07.0767 3468        AppMgmt        (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll
16:55:07.0782 3468        AppMgmt - ok
16:55:07.0798 3468        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
16:55:07.0813 3468        arc - ok
16:55:07.0813 3468        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
16:55:07.0829 3468        arcsas - ok
16:55:07.0860 3468        asmthub3        (6fe3237c1177e66437e7ad0e8ac1a6e5) C:\Windows\system32\DRIVERS\asmthub3.sys
16:55:07.0876 3468        asmthub3 - ok
16:55:07.0907 3468        asmtxhci        (c4043e39a2abbc56581ca25df161e9f7) C:\Windows\system32\DRIVERS\asmtxhci.sys
16:55:07.0938 3468        asmtxhci - ok
16:55:08.0063 3468        aspnet_state    (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
16:55:08.0079 3468        aspnet_state - ok
16:55:08.0110 3468        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
16:55:08.0157 3468        AsyncMac - ok
16:55:08.0188 3468        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
16:55:08.0219 3468        atapi - ok
16:55:08.0266 3468        AtiHDAudioService (24464b908e143d2561e9e452fee97309) C:\Windows\system32\drivers\AtihdW76.sys
16:55:08.0297 3468        AtiHDAudioService - ok
16:55:08.0344 3468        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
16:55:08.0406 3468        AudioEndpointBuilder - ok
16:55:08.0406 3468        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
16:55:08.0453 3468        AudioSrv - ok
16:55:08.0515 3468        avc3            (f57de310bf3bd9df0f7d301c1d7f5432) C:\Windows\system32\DRIVERS\avc3.sys
16:55:08.0547 3468        avc3 - ok
16:55:08.0578 3468        avchv          (4c6bcc638798abe1f70afca70d889c3f) C:\Windows\system32\DRIVERS\avchv.sys
16:55:08.0593 3468        avchv - ok
16:55:08.0609 3468        avckf          (6dc4cca415bbf2fc629beb532aa0e6cd) C:\Windows\system32\DRIVERS\avckf.sys
16:55:08.0625 3468        avckf - ok
16:55:08.0749 3468        AxAutoMntSrv    (7692f4b242e45870873caf4cb85cf769) C:\Program Files (x86)\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe
16:55:08.0765 3468        AxAutoMntSrv - ok
16:55:08.0812 3468        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
16:55:08.0874 3468        AxInstSV - ok
16:55:08.0905 3468        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
16:55:08.0937 3468        b06bdrv - ok
16:55:08.0968 3468        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
16:55:08.0999 3468        b57nd60a - ok
16:55:09.0030 3468        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
16:55:09.0061 3468        BDESVC - ok
16:55:09.0186 3468        BdfNdisf        (707ac68f86f97c17c30498aaf3c7e27e) c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys
16:55:09.0202 3468        BdfNdisf - ok
16:55:09.0233 3468        bdfsfltr        (ea195950fa5dd4a8f7bc00822213a363) C:\Windows\system32\DRIVERS\bdfsfltr.sys
16:55:09.0249 3468        bdfsfltr - ok
16:55:09.0295 3468        bdfwfpf        (4ce4b0098fc315c237fa8867f07886c4) C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys
16:55:09.0327 3468        bdfwfpf - ok
16:55:09.0358 3468        bdsandbox      (31571d77c6186ad228f52ee4ebdf8ee9) C:\Windows\system32\drivers\bdsandbox.sys
16:55:09.0358 3468        bdsandbox - ok
16:55:09.0373 3468        BDVEDISK        (b89deff4817b4cc6fc2bcd8f83b4e75d) C:\Windows\system32\DRIVERS\bdvedisk.sys
16:55:09.0389 3468        BDVEDISK - ok
16:55:09.0389 3468        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
16:55:09.0483 3468        Beep - ok
16:55:09.0576 3468        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
16:55:09.0639 3468        BFE - ok
16:55:09.0685 3468        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
16:55:09.0732 3468        BITS - ok
16:55:09.0763 3468        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
16:55:09.0779 3468        blbdrive - ok
16:55:09.0795 3468        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
16:55:09.0826 3468        bowser - ok
16:55:09.0857 3468        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
16:55:09.0904 3468        BrFiltLo - ok
16:55:09.0904 3468        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
16:55:09.0919 3468        BrFiltUp - ok
16:55:09.0966 3468        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
16:55:09.0997 3468        Browser - ok
16:55:10.0013 3468        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
16:55:10.0060 3468        Brserid - ok
16:55:10.0075 3468        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
16:55:10.0091 3468        BrSerWdm - ok
16:55:10.0091 3468        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
16:55:10.0107 3468        BrUsbMdm - ok
16:55:10.0122 3468        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
16:55:10.0138 3468        BrUsbSer - ok
16:55:10.0138 3468        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
16:55:10.0169 3468        BTHMODEM - ok
16:55:10.0216 3468        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
16:55:10.0263 3468        bthserv - ok
16:55:10.0263 3468        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
16:55:10.0309 3468        cdfs - ok
16:55:10.0341 3468        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
16:55:10.0372 3468        cdrom - ok
16:55:10.0387 3468        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
16:55:10.0434 3468        CertPropSvc - ok
16:55:10.0465 3468        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
16:55:10.0481 3468        circlass - ok
16:55:10.0497 3468        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
16:55:10.0512 3468        CLFS - ok
16:55:10.0653 3468        CLHNServiceForPowerDVD12 (4c6406cf07d4ebb70c5774d55c6688fb) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe
16:55:10.0684 3468        CLHNServiceForPowerDVD12 - ok
16:55:10.0746 3468        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:55:10.0762 3468        clr_optimization_v2.0.50727_32 - ok
16:55:10.0793 3468        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
16:55:10.0809 3468        clr_optimization_v2.0.50727_64 - ok
16:55:10.0855 3468        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:55:10.0871 3468        clr_optimization_v4.0.30319_32 - ok
16:55:10.0902 3468        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
16:55:10.0918 3468        clr_optimization_v4.0.30319_64 - ok
16:55:10.0949 3468        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
16:55:10.0980 3468        CmBatt - ok
16:55:11.0011 3468        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
16:55:11.0027 3468        cmdide - ok
16:55:11.0074 3468        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
16:55:11.0089 3468        CNG - ok
16:55:11.0121 3468        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
16:55:11.0136 3468        Compbatt - ok
16:55:11.0292 3468        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
16:55:11.0339 3468        CompositeBus - ok
16:55:11.0355 3468        COMSysApp - ok
16:55:11.0370 3468        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
16:55:11.0386 3468        crcdisk - ok
16:55:11.0433 3468        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
16:55:11.0479 3468        CryptSvc - ok
16:55:11.0542 3468        CSC            (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
16:55:11.0589 3468        CSC - ok
16:55:11.0620 3468        CscService      (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll
16:55:11.0667 3468        CscService - ok
16:55:11.0760 3468        CyberLink PowerDVD 12 Media Server Monitor Service (ea22bca708b37b82adebc822a171b92e) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
16:55:11.0776 3468        CyberLink PowerDVD 12 Media Server Monitor Service - ok
16:55:11.0807 3468        CyberLink PowerDVD 12 Media Server Service (3168d2f171a64590e7a11355cae60a1e) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
16:55:11.0823 3468        CyberLink PowerDVD 12 Media Server Service - ok
16:55:11.0854 3468        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
16:55:11.0916 3468        DcomLaunch - ok
16:55:11.0932 3468        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
16:55:11.0994 3468        defragsvc - ok
16:55:12.0025 3468        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
16:55:12.0088 3468        DfsC - ok
16:55:12.0103 3468        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
16:55:12.0181 3468        Dhcp - ok
16:55:12.0181 3468        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
16:55:12.0213 3468        discache - ok
16:55:12.0228 3468        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
16:55:12.0244 3468        Disk - ok
16:55:12.0259 3468        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
16:55:12.0291 3468        Dnscache - ok
16:55:12.0322 3468        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
16:55:12.0369 3468        dot3svc - ok
16:55:12.0400 3468        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
16:55:12.0431 3468        DPS - ok
16:55:12.0462 3468        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
16:55:12.0478 3468        drmkaud - ok
16:55:12.0525 3468        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
16:55:12.0540 3468        DXGKrnl - ok
16:55:12.0571 3468        E1G60          (edc6e9c057c9d7f83eea22b4cef5dcad) C:\Windows\system32\DRIVERS\E1G6032E.sys
16:55:12.0587 3468        E1G60 - ok
16:55:12.0587 3468        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
16:55:12.0634 3468        EapHost - ok
16:55:12.0759 3468        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
16:55:12.0868 3468        ebdrv - ok
16:55:12.0946 3468        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
16:55:12.0977 3468        EFS - ok
16:55:13.0024 3468        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
16:55:13.0071 3468        ehRecvr - ok
16:55:13.0086 3468        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
16:55:13.0102 3468        ehSched - ok
16:55:13.0149 3468        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
16:55:13.0164 3468        elxstor - ok
16:55:13.0195 3468        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
16:55:13.0227 3468        ErrDev - ok
16:55:13.0273 3468        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
16:55:13.0305 3468        EventSystem - ok
16:55:13.0320 3468        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
16:55:13.0367 3468        exfat - ok
16:55:13.0383 3468        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
16:55:13.0414 3468        fastfat - ok
16:55:13.0476 3468        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
16:55:13.0507 3468        Fax - ok
16:55:13.0523 3468        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
16:55:13.0554 3468        fdc - ok
16:55:13.0585 3468        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
16:55:13.0617 3468        fdPHost - ok
16:55:13.0617 3468        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
16:55:13.0663 3468        FDResPub - ok
16:55:13.0663 3468        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
16:55:13.0679 3468        FileInfo - ok
16:55:13.0679 3468        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
16:55:13.0726 3468        Filetrace - ok
16:55:13.0741 3468        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
16:55:13.0757 3468        flpydisk - ok
16:55:13.0788 3468        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
16:55:13.0819 3468        FltMgr - ok
16:55:13.0882 3468        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
16:55:13.0913 3468        FontCache - ok
16:55:13.0975 3468        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
16:55:13.0991 3468        FontCache3.0.0.0 - ok
16:55:14.0007 3468        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
16:55:14.0038 3468        FsDepends - ok
16:55:14.0053 3468        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
16:55:14.0053 3468        Fs_Rec - ok
16:55:14.0178 3468        Futuremark SystemInfo Service (ae6f0a6562d3eccd613de1fd8612ac4e) C:\Program Files (x86)\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe
16:55:14.0225 3468        Futuremark SystemInfo Service - ok
16:55:14.0287 3468        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
16:55:14.0303 3468        fvevol - ok
16:55:14.0319 3468        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
16:55:14.0334 3468        gagp30kx - ok
16:55:14.0397 3468        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
16:55:14.0443 3468        gpsvc - ok
16:55:14.0521 3468        gupdate        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
16:55:14.0553 3468        gupdate - ok
16:55:14.0553 3468        gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
16:55:14.0568 3468        gupdatem - ok
16:55:14.0584 3468        gusvc          (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
16:55:14.0677 3468        gusvc - ok
16:55:14.0693 3468        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
16:55:14.0709 3468        hcw85cir - ok
16:55:14.0771 3468        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
16:55:14.0818 3468        HdAudAddService - ok
16:55:14.0849 3468        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
16:55:14.0865 3468        HDAudBus - ok
16:55:14.0896 3468        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
16:55:14.0911 3468        HidBatt - ok
16:55:14.0927 3468        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
16:55:14.0958 3468        HidBth - ok
16:55:14.0974 3468        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
16:55:14.0989 3468        HidIr - ok
16:55:15.0021 3468        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
16:55:15.0052 3468        hidserv - ok
16:55:15.0067 3468        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys
16:55:15.0083 3468        HidUsb - ok
16:55:15.0130 3468        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
16:55:15.0177 3468        hkmsvc - ok
16:55:15.0208 3468        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
16:55:15.0255 3468        HomeGroupListener - ok
16:55:15.0301 3468        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
16:55:15.0348 3468        HomeGroupProvider - ok
16:55:15.0364 3468        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
16:55:15.0395 3468        HpSAMD - ok
16:55:15.0473 3468        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
16:55:15.0535 3468        HTTP - ok
16:55:15.0567 3468        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
16:55:15.0567 3468        hwpolicy - ok
16:55:15.0598 3468        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
16:55:15.0629 3468        i8042prt - ok
16:55:15.0691 3468        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
16:55:15.0723 3468        iaStorV - ok
16:55:15.0832 3468        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
16:55:15.0879 3468        idsvc - ok
16:55:15.0879 3468        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
16:55:15.0894 3468        iirsp - ok
16:55:15.0941 3468        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
16:55:15.0988 3468        IKEEXT - ok
16:55:16.0159 3468        IntcAzAudAddService (c7124da48e557d8f88d0d7f1254557f4) C:\Windows\system32\drivers\RTKVHD64.sys
16:55:16.0206 3468        IntcAzAudAddService - ok
16:55:16.0269 3468        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
16:55:16.0284 3468        intelide - ok
16:55:16.0347 3468        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
16:55:16.0378 3468        intelppm - ok
16:55:16.0409 3468        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
16:55:16.0440 3468        IPBusEnum - ok
16:55:16.0471 3468        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
16:55:16.0518 3468        IpFilterDriver - ok
16:55:16.0581 3468        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
16:55:16.0612 3468        iphlpsvc - ok
16:55:16.0627 3468        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
16:55:16.0659 3468        IPMIDRV - ok
16:55:16.0674 3468        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
16:55:16.0705 3468        IPNAT - ok
16:55:16.0721 3468        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
16:55:16.0752 3468        IRENUM - ok
16:55:16.0768 3468        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
16:55:16.0768 3468        isapnp - ok
16:55:16.0799 3468        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
16:55:16.0815 3468        iScsiPrt - ok
16:55:16.0830 3468        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
16:55:16.0846 3468        kbdclass - ok
16:55:16.0861 3468        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
16:55:16.0861 3468        kbdhid - ok
16:55:16.0893 3468        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:55:16.0908 3468        KeyIso - ok
16:55:16.0924 3468        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
16:55:16.0939 3468        KSecDD - ok
16:55:16.0955 3468        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
16:55:16.0971 3468        KSecPkg - ok
16:55:16.0986 3468        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
16:55:17.0033 3468        ksthunk - ok
16:55:17.0049 3468        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
16:55:17.0111 3468        KtmRm - ok
16:55:17.0127 3468        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
16:55:17.0158 3468        LanmanServer - ok
16:55:17.0189 3468        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
16:55:17.0267 3468        LanmanWorkstation - ok
16:55:17.0283 3468        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
16:55:17.0329 3468        lltdio - ok
16:55:17.0345 3468        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
16:55:17.0392 3468        lltdsvc - ok
16:55:17.0407 3468        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
16:55:17.0439 3468        lmhosts - ok
16:55:17.0454 3468        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
16:55:17.0470 3468        LSI_FC - ok
16:55:17.0470 3468        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
16:55:17.0485 3468        LSI_SAS - ok
16:55:17.0485 3468        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
16:55:17.0501 3468        LSI_SAS2 - ok
16:55:17.0501 3468        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
16:55:17.0517 3468        LSI_SCSI - ok
16:55:17.0532 3468        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
16:55:17.0579 3468        luafv - ok
16:55:17.0595 3468        MBfilt          (8ff2d95cba49b405c5de27039ff0bf35) C:\Windows\system32\drivers\MBfilt64.sys
16:55:17.0610 3468        MBfilt - ok
16:55:17.0641 3468        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
16:55:17.0657 3468        Mcx2Svc - ok
16:55:17.0657 3468        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
16:55:17.0673 3468        megasas - ok
16:55:17.0688 3468        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
16:55:17.0704 3468        MegaSR - ok
16:55:17.0735 3468        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
16:55:17.0766 3468        MMCSS - ok
16:55:17.0782 3468        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
16:55:17.0813 3468        Modem - ok
16:55:17.0829 3468        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
16:55:17.0860 3468        monitor - ok
16:55:17.0860 3468        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
16:55:17.0875 3468        mouclass - ok
16:55:17.0875 3468        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
16:55:17.0891 3468        mouhid - ok
16:55:17.0922 3468        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
16:55:17.0938 3468        mountmgr - ok
16:55:18.0016 3468        MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
16:55:18.0047 3468        MozillaMaintenance - ok
16:55:18.0078 3468        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
16:55:18.0094 3468        mpio - ok
16:55:18.0094 3468        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
16:55:18.0125 3468        mpsdrv - ok
16:55:18.0203 3468        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
16:55:18.0281 3468        MpsSvc - ok
16:55:18.0312 3468        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
16:55:18.0343 3468        MRxDAV - ok
16:55:18.0375 3468        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
16:55:18.0390 3468        mrxsmb - ok
16:55:18.0406 3468        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
16:55:18.0421 3468        mrxsmb10 - ok
16:55:18.0437 3468        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
16:55:18.0468 3468        mrxsmb20 - ok
16:55:18.0484 3468        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
16:55:18.0484 3468        msahci - ok
16:55:18.0499 3468        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
16:55:18.0515 3468        msdsm - ok
16:55:18.0531 3468        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
16:55:18.0546 3468        MSDTC - ok
16:55:18.0562 3468        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
16:55:18.0593 3468        Msfs - ok
16:55:18.0624 3468        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
16:55:18.0671 3468        mshidkmdf - ok
16:55:18.0702 3468        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
16:55:18.0718 3468        msisadrv - ok
16:55:18.0749 3468        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
16:55:18.0796 3468        MSiSCSI - ok
16:55:18.0796 3468        msiserver - ok
16:55:18.0811 3468        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
16:55:18.0843 3468        MSKSSRV - ok
16:55:18.0874 3468        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
16:55:18.0905 3468        MSPCLOCK - ok
16:55:18.0905 3468        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
16:55:18.0936 3468        MSPQM - ok
16:55:18.0983 3468        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
16:55:19.0014 3468        MsRPC - ok
16:55:19.0030 3468        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
16:55:19.0045 3468        mssmbios - ok
16:55:19.0045 3468        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
16:55:19.0092 3468        MSTEE - ok
16:55:19.0108 3468        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
16:55:19.0108 3468        MTConfig - ok
16:55:19.0139 3468        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
16:55:19.0139 3468        Mup - ok
16:55:19.0201 3468        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
16:55:19.0264 3468        napagent - ok
16:55:19.0311 3468        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
16:55:19.0342 3468        NativeWifiP - ok
16:55:19.0482 3468        NAUpdate        (934bb0d23a25c8c136570800a5a149b6) C:\Program Files (x86)\Nero\Update\NASvc.exe
16:55:19.0513 3468        NAUpdate - ok
16:55:19.0529 3468        NBVol          (daca803a8d732fe5eeaa024ec342f81d) C:\Windows\system32\DRIVERS\NBVol.sys
16:55:19.0545 3468        NBVol - ok
16:55:19.0560 3468        NBVolUp        (6208f622e9e35860dfb0753dff56f0c0) C:\Windows\system32\DRIVERS\NBVolUp.sys
16:55:19.0576 3468        NBVolUp - ok
16:55:19.0623 3468        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
16:55:19.0654 3468        NDIS - ok
16:55:19.0669 3468        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
16:55:19.0716 3468        NdisCap - ok
16:55:19.0732 3468        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
16:55:19.0763 3468        NdisTapi - ok
16:55:19.0810 3468        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
16:55:19.0857 3468        Ndisuio - ok
16:55:19.0903 3468        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
16:55:19.0966 3468        NdisWan - ok
16:55:20.0013 3468        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
16:55:20.0075 3468        NDProxy - ok
16:55:20.0075 3468        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
16:55:20.0122 3468        NetBIOS - ok
16:55:20.0153 3468        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
16:55:20.0215 3468        NetBT - ok
16:55:20.0231 3468        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:55:20.0247 3468        Netlogon - ok
16:55:20.0309 3468        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
16:55:20.0387 3468        Netman - ok
16:55:20.0465 3468        NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:55:20.0496 3468        NetMsmqActivator - ok
16:55:20.0512 3468        NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:55:20.0512 3468        NetPipeActivator - ok
16:55:20.0527 3468        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
16:55:20.0574 3468        netprofm - ok
16:55:20.0637 3468        netr28ux        (c9e9017ac2291e96ed3376b72bc7cf8d) C:\Windows\system32\DRIVERS\netr28ux.sys
16:55:20.0668 3468        netr28ux - ok
16:55:20.0683 3468        NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:55:20.0699 3468        NetTcpActivator - ok
16:55:20.0699 3468        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:55:20.0715 3468        NetTcpPortSharing - ok
16:55:20.0746 3468        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
16:55:20.0746 3468        nfrd960 - ok
16:55:20.0793 3468        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
16:55:20.0855 3468        NlaSvc - ok
16:55:20.0855 3468        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
16:55:20.0886 3468        Npfs - ok
16:55:20.0902 3468        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
16:55:20.0933 3468        nsi - ok
16:55:20.0949 3468        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
16:55:20.0980 3468        nsiproxy - ok
16:55:21.0042 3468        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
16:55:21.0089 3468        Ntfs - ok
16:55:21.0214 3468        ntk_PowerDVD12  (eaac965642ef5f818aed508cadf83e4b) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys
16:55:21.0229 3468        ntk_PowerDVD12 - ok
16:55:21.0276 3468        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
16:55:21.0323 3468        Null - ok
16:55:21.0354 3468        nvlddmkm - ok
16:55:21.0401 3468        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
16:55:21.0432 3468        nvraid - ok
16:55:21.0463 3468        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
16:55:21.0495 3468        nvstor - ok
16:55:21.0526 3468        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
16:55:21.0541 3468        nv_agp - ok
16:55:21.0557 3468        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
16:55:21.0588 3468        ohci1394 - ok
16:55:21.0635 3468        ose            (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:55:21.0713 3468        ose - ok
16:55:21.0760 3468        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
16:55:21.0791 3468        p2pimsvc - ok
16:55:21.0822 3468        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
16:55:21.0853 3468        p2psvc - ok
16:55:21.0869 3468        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
16:55:21.0900 3468        Parport - ok
16:55:21.0931 3468        partmgr        (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
16:55:21.0947 3468        partmgr - ok
16:55:21.0963 3468        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
16:55:21.0994 3468        PcaSvc - ok
16:55:22.0009 3468        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
16:55:22.0025 3468        pci - ok
16:55:22.0041 3468        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
16:55:22.0056 3468        pciide - ok
16:55:22.0056 3468        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
16:55:22.0072 3468        pcmcia - ok
16:55:22.0087 3468        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
16:55:22.0103 3468        pcw - ok
16:55:22.0119 3468        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
16:55:22.0165 3468        PEAUTH - ok
16:55:22.0212 3468        PeerDistSvc    (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll
16:55:22.0243 3468        PeerDistSvc - ok
16:55:22.0290 3468        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
16:55:22.0321 3468        PerfHost - ok
16:55:22.0446 3468        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
16:55:22.0509 3468        pla - ok
16:55:22.0540 3468        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
16:55:22.0571 3468        PlugPlay - ok
16:55:22.0587 3468        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
16:55:22.0587 3468        PNRPAutoReg - ok
16:55:22.0602 3468        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
16:55:22.0618 3468        PNRPsvc - ok
16:55:22.0649 3468        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
16:55:22.0696 3468        PolicyAgent - ok
16:55:22.0727 3468        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
16:55:22.0805 3468        Power - ok
16:55:22.0852 3468        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
16:55:22.0914 3468        PptpMiniport - ok
16:55:22.0930 3468        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
16:55:22.0945 3468        Processor - ok
16:55:22.0992 3468        ProfSvc        (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
16:55:23.0039 3468        ProfSvc - ok
16:55:23.0070 3468        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:55:23.0086 3468        ProtectedStorage - ok
16:55:23.0117 3468        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
16:55:23.0164 3468        Psched - ok
16:55:23.0226 3468        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
16:55:23.0273 3468        ql2300 - ok
16:55:23.0335 3468        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
16:55:23.0351 3468        ql40xx - ok
16:55:23.0382 3468        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
16:55:23.0398 3468        QWAVE - ok
16:55:23.0413 3468        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
16:55:23.0445 3468        QWAVEdrv - ok
16:55:23.0460 3468        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
16:55:23.0491 3468        RasAcd - ok
16:55:23.0507 3468        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
16:55:23.0538 3468        RasAgileVpn - ok
16:55:23.0554 3468        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
16:55:23.0601 3468        RasAuto - ok
16:55:23.0632 3468        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
16:55:23.0679 3468        Rasl2tp - ok
16:55:23.0710 3468        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
16:55:23.0772 3468        RasMan - ok
16:55:23.0772 3468        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
16:55:23.0819 3468        RasPppoe - ok
16:55:23.0835 3468        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
16:55:23.0881 3468        RasSstp - ok
16:55:23.0913 3468        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
16:55:23.0959 3468        rdbss - ok
16:55:23.0959 3468        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
16:55:23.0975 3468        rdpbus - ok
16:55:23.0991 3468        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
16:55:24.0022 3468        RDPCDD - ok
16:55:24.0069 3468        RDPDR          (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
16:55:24.0084 3468        RDPDR - ok
16:55:24.0100 3468        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
16:55:24.0131 3468        RDPENCDD - ok
16:55:24.0147 3468        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
16:55:24.0193 3468        RDPREFMP - ok
16:55:24.0240 3468        RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys
16:55:24.0271 3468        RdpVideoMiniport - ok
16:55:24.0303 3468        RDPWD          (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
16:55:24.0349 3468        RDPWD - ok
16:55:24.0412 3468        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
16:55:24.0443 3468        rdyboost - ok
16:55:24.0474 3468        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
16:55:24.0505 3468        RemoteAccess - ok
16:55:24.0521 3468        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
16:55:24.0568 3468        RemoteRegistry - ok
16:55:24.0615 3468        RMCAST          (caf88d6573d21cd2aa27001ddbfdc74d) C:\Windows\system32\DRIVERS\RMCAST.sys
16:55:24.0646 3468        RMCAST - ok
16:55:24.0677 3468        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
16:55:24.0708 3468        RpcEptMapper - ok
16:55:24.0724 3468        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
16:55:24.0755 3468        RpcLocator - ok
16:55:24.0802 3468        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
16:55:24.0849 3468        RpcSs - ok
16:55:24.0989 3468        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
16:55:25.0051 3468        rspndr - ok
16:55:25.0114 3468        rt61x64        (60eb8a87357ca5b088b422d1e55a2405) C:\Windows\system32\DRIVERS\netr6164.sys
16:55:25.0145 3468        rt61x64 - ok
16:55:25.0192 3468        RTL8167        (f4c374b1c46de294b573bb43723ac3f6) C:\Windows\system32\DRIVERS\Rt64win7.sys
16:55:25.0207 3468        RTL8167 - ok
16:55:25.0223 3468        s3cap          (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
16:55:25.0254 3468        s3cap - ok
16:55:25.0270 3468        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:55:25.0285 3468        SamSs - ok
16:55:25.0301 3468        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
16:55:25.0301 3468        sbp2port - ok
16:55:25.0317 3468        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
16:55:25.0363 3468        SCardSvr - ok
16:55:25.0395 3468        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
16:55:25.0473 3468        scfilter - ok
16:55:25.0551 3468        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
16:55:25.0613 3468        Schedule - ok
16:55:25.0644 3468        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
16:55:25.0675 3468        SCPolicySvc - ok
16:55:25.0707 3468        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
16:55:25.0738 3468        SDRSVC - ok
16:55:25.0769 3468        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
16:55:25.0816 3468        secdrv - ok
16:55:25.0847 3468        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
16:55:25.0894 3468        seclogon - ok
16:55:25.0894 3468        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
16:55:25.0941 3468        SENS - ok
16:55:25.0956 3468        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
16:55:25.0972 3468        SensrSvc - ok
16:55:25.0987 3468        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
16:55:26.0019 3468        Serenum - ok
16:55:26.0019 3468        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
16:55:26.0050 3468        Serial - ok
16:55:26.0081 3468        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
16:55:26.0112 3468        sermouse - ok
16:55:26.0143 3468        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
16:55:26.0190 3468        SessionEnv - ok
16:55:26.0206 3468        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
16:55:26.0221 3468        sffdisk - ok
16:55:26.0237 3468        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
16:55:26.0253 3468        sffp_mmc - ok
16:55:26.0253 3468        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
16:55:26.0284 3468        sffp_sd - ok
16:55:26.0284 3468        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
16:55:26.0299 3468        sfloppy - ok
16:55:26.0346 3468        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
16:55:26.0393 3468        SharedAccess - ok
16:55:26.0440 3468        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
16:55:26.0502 3468        ShellHWDetection - ok
16:55:26.0502 3468        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
16:55:26.0518 3468        SiSRaid2 - ok
16:55:26.0518 3468        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
16:55:26.0533 3468        SiSRaid4 - ok
16:55:26.0596 3468        SkypeUpdate    (579ba0a911ff5ea70cb604cd3b744b0a) C:\Program Files (x86)\Skype\Updater\Updater.exe
16:55:26.0611 3468        SkypeUpdate - ok
16:55:26.0627 3468        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
16:55:26.0658 3468        Smb - ok
16:55:26.0674 3468        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
16:55:26.0705 3468        SNMPTRAP - ok
16:55:26.0721 3468        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
16:55:26.0721 3468        spldr - ok
16:55:26.0767 3468        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
16:55:26.0799 3468        Spooler - ok
16:55:26.0986 3468        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
16:55:27.0079 3468        sppsvc - ok
16:55:27.0157 3468        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
16:55:27.0235 3468        sppuinotify - ok
16:55:27.0313 3468        sptd            (a15860e920b02c9a7ce8f3a6c2ff1e3a) C:\Windows\System32\Drivers\sptd.sys
16:55:27.0345 3468        sptd - ok
16:55:27.0376 3468        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
16:55:27.0407 3468        srv - ok
16:55:27.0438 3468        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
16:55:27.0454 3468        srv2 - ok
16:55:27.0469 3468        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
16:55:27.0501 3468        srvnet - ok
16:55:27.0532 3468        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
16:55:27.0594 3468        SSDPSRV - ok
16:55:27.0610 3468        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
16:55:27.0657 3468        SstpSvc - ok
16:55:27.0750 3468        StarWindServiceAE (e5c796b621f6fba8616511063d7f0ffe) C:\Program Files (x86)\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
16:55:27.0750 3468        StarWindServiceAE ( UnsignedFile.Multi.Generic ) - warning
16:55:27.0750 3468        StarWindServiceAE - detected UnsignedFile.Multi.Generic (1)
16:55:27.0797 3468        Steam Client Service - ok
16:55:27.0828 3468        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
16:55:27.0844 3468        stexstor - ok
16:55:27.0906 3468        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
16:55:27.0953 3468        stisvc - ok
16:55:27.0969 3468        storflt        (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
16:55:27.0984 3468        storflt - ok
16:55:28.0015 3468        storvsc        (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
16:55:28.0047 3468        storvsc - ok
16:55:28.0047 3468        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
16:55:28.0062 3468        swenum - ok
16:55:28.0093 3468        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
16:55:28.0156 3468        swprv - ok
16:55:28.0156 3468        Synth3dVsc - ok
16:55:28.0281 3468        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
16:55:28.0312 3468        SysMain - ok
16:55:28.0390 3468        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
16:55:28.0421 3468        TabletInputService - ok
16:55:28.0468 3468        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
16:55:28.0530 3468        TapiSrv - ok
16:55:28.0546 3468        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
16:55:28.0593 3468        TBS - ok
16:55:28.0702 3468        Tcpip          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
16:55:28.0733 3468        Tcpip - ok
16:55:28.0873 3468        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
16:55:28.0936 3468        TCPIP6 - ok
16:55:28.0983 3468        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
16:55:29.0061 3468        tcpipreg - ok
16:55:29.0076 3468        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
16:55:29.0092 3468        TDPIPE - ok
16:55:29.0107 3468        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
16:55:29.0123 3468        TDTCP - ok
16:55:29.0170 3468        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
16:55:29.0232 3468        tdx - ok
16:55:29.0248 3468        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
16:55:29.0248 3468        TermDD - ok
16:55:29.0279 3468        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
16:55:29.0341 3468        TermService - ok
16:55:29.0357 3468        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
16:55:29.0373 3468        Themes - ok
16:55:29.0404 3468        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
16:55:29.0435 3468        THREADORDER - ok
16:55:29.0451 3468        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
16:55:29.0482 3468        TrkWks - ok
16:55:29.0529 3468        trufos          (df219721ddffcbe03aa894b6b6742ba1) C:\Windows\system32\DRIVERS\trufos.sys
16:55:29.0544 3468        trufos - ok
16:55:29.0622 3468        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
16:55:29.0669 3468        TrustedInstaller - ok
16:55:29.0700 3468        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
16:55:29.0731 3468        tssecsrv - ok
16:55:29.0763 3468        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
16:55:29.0794 3468        TsUsbFlt - ok
16:55:29.0825 3468        tsusbhub - ok
16:55:29.0872 3468        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
16:55:29.0950 3468        tunnel - ok
16:55:29.0965 3468        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
16:55:29.0965 3468        uagp35 - ok
16:55:30.0043 3468        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
16:55:30.0090 3468        udfs - ok
16:55:30.0121 3468        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
16:55:30.0153 3468        UI0Detect - ok
16:55:30.0168 3468        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
16:55:30.0184 3468        uliagpkx - ok
16:55:30.0215 3468        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
16:55:30.0246 3468        umbus - ok
16:55:30.0262 3468        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
16:55:30.0277 3468        UmPass - ok
16:55:30.0293 3468        UmRdpService    (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll
16:55:30.0324 3468        UmRdpService - ok
16:55:30.0418 3468        Update Server  (7de3f30967cf77bd1fc440c2b847629a) C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe
16:55:30.0465 3468        Update Server - ok
16:55:30.0480 3468        UPDATESRV      (6fa5ffc3765c9c444d82faf1d46c1cae) C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe
16:55:30.0511 3468        UPDATESRV - ok
16:55:30.0543 3468        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
16:55:30.0574 3468        upnphost - ok
16:55:30.0589 3468        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\drivers\usbccgp.sys
16:55:30.0605 3468        usbccgp - ok
16:55:30.0621 3468        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
16:55:30.0636 3468        usbcir - ok
16:55:30.0652 3468        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
16:55:30.0683 3468        usbehci - ok
16:55:30.0714 3468        usbfilter      (858be9c0e498c8e505e198e17eece0d9) C:\Windows\system32\DRIVERS\usbfilter.sys
16:55:30.0714 3468        usbfilter - ok
16:55:30.0745 3468        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
16:55:30.0761 3468        usbhub - ok
16:55:30.0761 3468        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys
16:55:30.0777 3468        usbohci - ok
16:55:30.0792 3468        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
16:55:30.0808 3468        usbprint - ok
16:55:30.0823 3468        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
16:55:30.0855 3468        USBSTOR - ok
16:55:30.0855 3468        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
16:55:30.0886 3468        usbuhci - ok
16:55:30.0901 3468        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
16:55:30.0948 3468        UxSms - ok
16:55:30.0964 3468        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:55:30.0979 3468        VaultSvc - ok
16:55:31.0011 3468        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
16:55:31.0011 3468        vdrvroot - ok
16:55:31.0057 3468        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
16:55:31.0104 3468        vds - ok
16:55:31.0120 3468        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
16:55:31.0135 3468        vga - ok
16:55:31.0151 3468        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
16:55:31.0198 3468        VgaSave - ok
16:55:31.0198 3468        VGPU - ok
16:55:31.0229 3468        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\DRIVERS\vhdmp.sys
16:55:31.0245 3468        vhdmp - ok
16:55:31.0260 3468        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
16:55:31.0260 3468        viaide - ok
16:55:31.0291 3468        vmbus          (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
16:55:31.0307 3468        vmbus - ok
16:55:31.0323 3468        VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
16:55:31.0354 3468        VMBusHID - ok
16:55:31.0369 3468        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
16:55:31.0369 3468        volmgr - ok
16:55:31.0432 3468        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
16:55:31.0463 3468        volmgrx - ok
16:55:31.0494 3468        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
16:55:31.0510 3468        volsnap - ok
16:55:31.0510 3468        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
16:55:31.0525 3468        vsmraid - ok
16:55:31.0635 3468        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
16:55:31.0728 3468        VSS - ok
16:55:31.0791 3468        vsserv - ok
16:55:31.0869 3468        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
16:55:31.0900 3468        vwifibus - ok
16:55:31.0915 3468        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
16:55:31.0947 3468        vwififlt - ok
16:55:31.0978 3468        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
16:55:32.0040 3468        W32Time - ok
16:55:32.0056 3468        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
16:55:32.0071 3468        WacomPen - ok
16:55:32.0103 3468        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
16:55:32.0134 3468        WANARP - ok
16:55:32.0149 3468        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
16:55:32.0181 3468        Wanarpv6 - ok
16:55:32.0259 3468        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
16:55:32.0290 3468        wbengine - ok
16:55:32.0337 3468        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
16:55:32.0368 3468        WbioSrvc - ok
16:55:32.0399 3468        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
16:55:32.0446 3468        wcncsvc - ok
16:55:32.0461 3468        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
16:55:32.0493 3468        WcsPlugInService - ok
16:55:32.0493 3468        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
16:55:32.0508 3468        Wd - ok
16:55:32.0539 3468        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
16:55:32.0555 3468        Wdf01000 - ok
16:55:32.0555 3468        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
16:55:32.0586 3468        WdiServiceHost - ok
16:55:32.0586 3468        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
16:55:32.0602 3468        WdiSystemHost - ok
16:55:32.0649 3468        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
16:55:32.0680 3468        WebClient - ok
16:55:32.0695 3468        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
16:55:32.0742 3468        Wecsvc - ok
16:55:32.0742 3468        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
16:55:32.0789 3468        wercplsupport - ok
16:55:32.0805 3468        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
16:55:32.0883 3468        WerSvc - ok
16:55:32.0883 3468        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
16:55:32.0914 3468        WfpLwf - ok
16:55:32.0945 3468        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
16:55:32.0945 3468        WIMMount - ok
16:55:32.0961 3468        WinDefend - ok
16:55:32.0976 3468        WinHttpAutoProxySvc - ok
16:55:33.0039 3468        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
16:55:33.0085 3468        Winmgmt - ok
16:55:33.0163 3468        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
16:55:33.0241 3468        WinRM - ok
16:55:33.0304 3468        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
16:55:33.0351 3468        Wlansvc - ok
16:55:33.0522 3468        wlidsvc        (98f138897ef4246381d197cb81846d62) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
16:55:33.0569 3468        wlidsvc - ok
16:55:33.0631 3468        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
16:55:33.0647 3468        WmiAcpi - ok
16:55:33.0678 3468        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
16:55:33.0694 3468        wmiApSrv - ok
16:55:33.0709 3468        WMPNetworkSvc - ok
16:55:33.0725 3468        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
16:55:33.0741 3468        WPCSvc - ok
16:55:33.0772 3468        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
16:55:33.0787 3468        WPDBusEnum - ok
16:55:33.0803 3468        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
16:55:33.0850 3468        ws2ifsl - ok
16:55:33.0865 3468        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
16:55:33.0881 3468        wscsvc - ok
16:55:33.0881 3468        WSearch - ok
16:55:33.0990 3468        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
16:55:34.0053 3468        wuauserv - ok
16:55:34.0115 3468        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
16:55:34.0146 3468        WudfPf - ok
16:55:34.0162 3468        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
16:55:34.0209 3468        WUDFRd - ok
16:55:34.0240 3468        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
16:55:34.0287 3468        wudfsvc - ok
16:55:34.0302 3468        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
16:55:34.0333 3468        WwanSvc - ok
16:55:34.0443 3468        {329F96B6-DF1E-4328-BFDA-39EA953C1312} (74983addca2d9618512c088d856d6615) C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl
16:55:34.0474 3468        {329F96B6-DF1E-4328-BFDA-39EA953C1312} - ok
16:55:34.0489 3468        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
16:55:34.0926 3468        \Device\Harddisk0\DR0 - ok
16:55:34.0942 3468        Boot (0x1200)  (ebb00998683ced5cd70ccc17db0318ef) \Device\Harddisk0\DR0\Partition0
16:55:34.0942 3468        \Device\Harddisk0\DR0\Partition0 - ok
16:55:34.0973 3468        Boot (0x1200)  (e8a9755a912a76970f21c8208fe9f7bc) \Device\Harddisk0\DR0\Partition1
16:55:34.0973 3468        \Device\Harddisk0\DR0\Partition1 - ok
16:55:34.0973 3468        ============================================================
16:55:34.0973 3468        Scan finished
16:55:34.0973 3468        ============================================================
16:55:34.0989 3464        Detected object count: 1
16:55:34.0989 3464        Actual detected object count: 1
16:56:33.0613 3464        C:\Program Files (x86)\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe - copied to quarantine
16:56:33.0613 3464        StarWindServiceAE ( UnsignedFile.Multi.Generic ) - User select action: Quarantine

cosinus 06.06.2012 16:17
Zitat:
Er hat irgend etwas im Alcohol 52% Verzeichniss gefunden.:-(
Ich hab die Datei in Quarantäne verschoben.
Was hast du an meinem Hinweis denn nicht verstanden :headbang:

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

Lukas1997 06.06.2012 16:23
Asche über mein Haupt, da war ich wohl etwas voreilig.
Was soll ich jetzt tun?

cosinus 07.06.2012 10:30
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Lukas1997 07.06.2012 15:58
Hat irgend so ein komisches "Your Product" gelöscht, hab ich auch auf meinem Notebook:confused:
Hier ist das Log von ComboFix:
Code:
ComboFix 12-06-07.03 - Lukas 07.06.2012  16:40:41.2.6 - x64
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1031.18.8172.5934 [GMT 2:00]
ausgeführt von:: c:\users\Lukas\Desktop\ComboFix.exe
AV: Bitdefender Virenschutz *Disabled/Updated* {50909708-FF80-02AF-F814-B28405891E92}
FW: Bitdefender Firewall *Enabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9}
SP: Bitdefender Spyware-Schutz *Disabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Your Product\Uninstall
c:\program files (x86)\Your Product\Uninstall\IRIMG1.JPG
c:\program files (x86)\Your Product\Uninstall\IRIMG2.JPG
c:\program files (x86)\Your Product\Uninstall\uninstall.dat
c:\program files (x86)\Your Product\Uninstall\uninstall.xml
c:\programdata\1337463435.bdinstall.bin
c:\programdata\1337464459.bdinstall.bin
c:\programdata\1337464652.bdinstall.bin
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-07 bis 2012-06-07  ))))))))))))))))))))))))))))))
.
.
2012-06-07 14:47 . 2012-06-07 14:47        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-06-07 10:43 . 2012-06-07 10:56        --------        d-----w-        c:\program files (x86)\The Elder Scrolls V Skyrim
2012-06-07 09:17 . 2012-06-07 09:17        --------        d-----w-        c:\users\Public\Interface
2012-06-07 09:13 . 2012-06-07 09:16        --------        d-----w-        c:\users\Public\Strings
2012-06-06 18:48 . 2008-10-15 04:22        519000        ----a-w-        c:\windows\system32\d3dx10_40.dll
2012-06-06 18:48 . 2008-10-15 04:22        452440        ----a-w-        c:\windows\SysWow64\d3dx10_40.dll
2012-06-06 18:48 . 2008-10-15 04:22        2605920        ----a-w-        c:\windows\system32\D3DCompiler_40.dll
2012-06-06 18:48 . 2008-10-15 04:22        2036576        ----a-w-        c:\windows\SysWow64\D3DCompiler_40.dll
2012-06-06 18:48 . 2008-10-15 04:22        5631312        ----a-w-        c:\windows\system32\D3DX9_40.dll
2012-06-06 14:56 . 2012-06-06 14:56        --------        d-----w-        C:\TDSSKiller_Quarantine
2012-06-06 14:33 . 2012-06-06 14:33        --------        d-----w-        C:\_OTL
2012-06-06 11:43 . 2012-06-06 11:43        --------        d-----w-        c:\windows\SysWow64\xlive
2012-06-06 11:43 . 2012-06-06 11:43        --------        d-----w-        c:\program files (x86)\Microsoft Games for Windows - LIVE
2012-06-01 21:00 . 2012-05-15 10:48        2368832        ----a-w-        c:\windows\SysWow64\nvapi.dll.BAK
2012-06-01 20:22 . 2009-11-20 17:18        4990056        ----a-w-        c:\windows\SysWow64\NVStWiz.exe
2012-06-01 20:20 . 2012-06-02 12:44        --------        d-----w-        c:\program files\NVIDIA Corporation
2012-06-01 11:17 . 2012-06-01 11:17        --------        d-----w-        c:\program files (x86)\ESET
2012-06-01 11:12 . 2012-06-01 11:12        --------        d-----w-        c:\programdata\Malwarebytes
2012-06-01 10:47 . 2009-11-21 02:34        930272        ----a-w-        c:\windows\system32\dpinst.exe
2012-06-01 10:47 . 2009-11-21 02:34        202344        ----a-w-        c:\windows\system32\nvcod178.dll
2012-05-29 15:57 . 2012-05-29 15:57        --------        d-----w-        c:\program files\HashTab Shell Extension
2012-05-29 11:56 . 2012-05-29 11:56        --------        d-----w-        c:\program files (x86)\EA Games
2012-05-28 16:52 . 2012-06-06 12:55        109080        ----a-w-        c:\windows\SysWow64\OpenAL32.dll
2012-05-28 15:45 . 2012-05-28 16:08        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2012-05-28 14:12 . 2012-05-28 14:12        --------        d-----w-        c:\program files (x86)\MSI Kombustor 2.3
2012-05-28 14:11 . 2012-05-28 14:21        --------        d-----w-        c:\program files (x86)\MSI Afterburner
2012-05-28 11:23 . 2012-05-28 11:23        --------        d-----w-        c:\windows\symbols
2012-05-28 11:20 . 2012-05-28 11:20        --------        d-----w-        c:\programdata\VS
2012-05-27 16:50 . 2012-05-27 16:50        --------        d-----w-        c:\program files (x86)\Microsoft
2012-05-27 16:48 . 2012-05-28 12:53        --------        d-----w-        c:\program files (x86)\Microsoft Silverlight
2012-05-27 16:45 . 2000-05-10 23:00        90112        ------w-        c:\windows\Updreg.EXE
2012-05-27 16:45 . 2010-07-21 14:51        11264        ------w-        c:\windows\SysWow64\ResDefA.exe
2012-05-27 16:45 . 2009-10-01 14:42        141312        ------w-        c:\windows\system32\THXCfg64.exe
2012-05-27 16:45 . 2011-05-13 10:30        26624        ------w-        c:\windows\system32\THXCfg64.dll
2012-05-27 16:45 . 2011-05-19 07:58        246784        ----a-w-        c:\windows\system32\APOMgr64.DLL
2012-05-27 16:45 . 2011-05-19 07:56        190464        ----a-w-        c:\windows\SysWow64\APOMngr.DLL
2012-05-27 16:45 . 2009-12-29 14:53        89088        ----a-w-        c:\windows\system32\CmdRtr64.DLL
2012-05-27 16:45 . 2009-12-29 14:52        73728        ----a-w-        c:\windows\SysWow64\CmdRtr.DLL
2012-05-27 16:45 . 2012-05-27 16:45        --------        d-----w-        c:\program files (x86)\Creative
2012-05-27 11:49 . 2012-05-27 11:48        647872        ----a-w-        c:\windows\SysWow64\mscomct2.ocx
2012-05-27 09:50 . 2009-09-04 15:29        453456        ----a-w-        c:\windows\SysWow64\d3dx10_42.dll
2012-05-27 09:32 . 2012-05-27 12:13        --------        d-----w-        c:\program files (x86)\BRS
2012-05-27 09:32 . 2011-03-19 13:16        1417216        ----a-w-        c:\windows\SysWow64\rapture3d_oal.dll
2012-05-27 09:32 . 2010-09-22 11:12        19087360        ----a-w-        c:\windows\SysWow64\mkl_blueripple.dll
2012-05-27 09:32 . 2012-06-06 12:55        466456        ----a-w-        c:\windows\system32\wrap_oal.dll
2012-05-27 09:32 . 2012-06-06 12:55        122904        ----a-w-        c:\windows\system32\OpenAL32.dll
2012-05-27 09:32 . 2012-05-27 09:32        --------        d-----w-        c:\program files (x86)\OpenAL
2012-05-27 09:32 . 2012-06-06 12:55        444952        ----a-w-        c:\windows\SysWow64\wrap_oal.dll
2012-05-27 08:32 . 2012-05-27 08:32        --------        d-----w-        c:\programdata\Electronic Arts
2012-05-27 08:19 . 2012-05-27 08:19        --------        d-----w-        c:\program files (x86)\Microsoft WSE
2012-05-27 08:05 . 2012-05-27 08:32        --------        d-----w-        c:\program files (x86)\Electronic Arts
2012-05-26 12:39 . 2012-05-29 11:18        --------        d-----w-        C:\Windows Photo Viewer
2012-05-26 10:50 . 2012-05-26 10:50        --------        d-----w-        c:\program files (x86)\The Creative Assembly
2012-05-26 10:15 . 2012-05-26 10:54        --------        d-----w-        c:\program files (x86)\Activision
2012-05-25 16:59 . 2012-06-07 14:46        --------        d-----w-        c:\program files (x86)\Your Product
2012-05-25 12:30 . 2009-07-14 01:39        1402880        ----a-w-        c:\windows\system32\Utilman.exe
2012-05-20 17:23 . 2005-05-25 05:00        90112        ------w-        c:\windows\SDUnInst.exe
2012-05-20 17:23 . 2012-06-02 18:52        --------        d-----w-        c:\program files (x86)\Software by Design
2012-05-20 12:47 . 2012-05-20 12:47        --------        d-----w-        c:\program files (x86)\Microsoft SQL Server
2012-05-20 12:46 . 2012-05-20 12:46        --------        d-----w-        c:\program files\Microsoft Synchronization Services
2012-05-20 12:46 . 2012-05-20 12:46        --------        d-----w-        c:\program files\Microsoft SQL Server Compact Edition
2012-05-20 12:46 . 2012-05-20 12:46        --------        d-----w-        c:\program files (x86)\Microsoft Synchronization Services
2012-05-20 12:46 . 2012-05-20 12:46        --------        d-----w-        c:\program files (x86)\Microsoft SQL Server Compact Edition
2012-05-20 12:46 . 2012-05-28 16:57        207008        ----a-w-        c:\programdata\Microsoft\VBExpress\10.0\1031\ResourceCache.dll
2012-05-20 12:45 . 2012-05-20 12:47        --------        d-----w-        c:\program files (x86)\Microsoft Visual Studio 10.0
2012-05-20 12:44 . 2012-05-20 12:44        --------        d-----w-        c:\program files\Microsoft Visual Studio 10.0
2012-05-20 12:44 . 2012-05-20 12:44        --------        d-----w-        c:\program files\Microsoft Help Viewer
2012-05-20 12:44 . 2012-05-20 12:44        --------        d-----w-        c:\program files (x86)\Microsoft SDKs
2012-05-20 08:59 . 2012-05-20 08:59        --------        d-----w-        c:\windows\system32\config\systemprofile\AppData\Roaming\QuickScan
2012-05-20 08:30 . 2009-10-16 01:10        303616        ----a-w-        c:\windows\system32\RaCoInstx.dll
2012-05-20 08:30 . 2012-05-20 08:30        --------        d-----w-        c:\programdata\Edimax Driver
2012-05-19 21:59 . 2012-05-19 21:59        --------        d-----w-        c:\programdata\BDLogging
2012-05-19 21:59 . 2012-05-19 21:59        --------        d-----w-        c:\programdata\Bitdefender
2012-05-19 21:57 . 2011-08-16 12:59        442088        ----a-w-        c:\windows\system32\drivers\bdfsfltr.sys
2012-05-19 21:57 . 2011-10-27 13:07        329800        ------w-        c:\windows\system32\drivers\trufos.sys
2012-05-19 21:54 . 2012-05-19 21:54        --------        d-----w-        c:\program files\Bitdefender
2012-05-19 21:35 . 2012-05-19 21:57        --------        d-----w-        c:\program files\Common Files\Bitdefender
2012-05-19 21:32 . 2012-05-19 21:32        --------        d-----w-        c:\program files (x86)\Common Files\Bitdefender
2012-05-19 15:59 . 2012-05-19 16:01        --------        d-----w-        c:\program files (x86)\Common Files\Nero
2012-05-19 15:58 . 2012-05-19 16:04        --------        d-----w-        c:\programdata\Nero
2012-05-19 15:38 . 2011-12-01 09:42        15920        ------w-        c:\windows\system32\drivers\NBVolUp.sys
2012-05-19 15:37 . 2012-05-19 16:03        --------        d-----w-        c:\program files (x86)\Nero
2012-05-19 15:37 . 2011-12-01 09:42        72240        ------w-        c:\windows\system32\drivers\NBVol.sys
2012-05-19 15:37 . 2009-09-04 15:29        1974616        ----a-w-        c:\windows\SysWow64\D3DCompiler_42.dll
2012-05-19 15:36 . 2009-09-04 15:29        1892184        ----a-w-        c:\windows\SysWow64\D3DX9_42.dll
2012-05-19 15:35 . 2008-10-15 04:22        4379984        ----a-w-        c:\windows\SysWow64\D3DX9_40.dll
2012-05-19 11:48 . 2012-05-19 11:48        --------        d-----w-        c:\program files (x86)\Alcohol Soft
2012-05-19 11:47 . 2012-05-19 11:47        --------        d--h--w-        c:\programdata\Common Files
2012-05-18 18:06 . 2012-05-25 12:15        --------        d-----w-        c:\program files (x86)\Inno Setup 5
2012-05-18 14:28 . 2012-05-18 14:28        560184        ------w-        c:\windows\system32\drivers\sptd.sys
2012-05-18 14:27 . 2012-05-29 16:31        500        ----a-w-        C:\user.js
2012-05-18 14:27 . 2012-05-18 14:27        --------        d-----w-        c:\programdata\Babylon
2012-05-18 14:08 . 2011-01-17 11:09        197120        ----a-w-        c:\windows\system32\d3d10_1.dll
2012-05-18 14:08 . 2011-01-17 05:47        161792        ----a-w-        c:\windows\SysWow64\d3d10_1.dll
2012-05-18 13:02 . 2012-05-25 12:15        --------        d-----w-        c:\program files (x86)\Common Files\Skype
2012-05-18 13:02 . 2012-05-18 13:02        --------        d-----r-        c:\program files (x86)\Skype
2012-05-18 12:54 . 2012-05-08 17:02        8955792        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{3B7A242F-D942-48BD-9A7A-41BE132B043E}\mpengine.dll
2012-05-18 12:53 . 2012-01-25 06:38        77312        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-05-18 12:53 . 2012-01-25 06:38        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-05-17 12:27 . 2012-05-17 12:28        --------        d-----w-        c:\programdata\boost_interprocess
2012-05-17 12:26 . 2012-05-18 13:02        --------        d-----w-        c:\programdata\Skype
2012-05-17 08:29 . 2012-05-17 08:29        --------        d-----w-        C:\AMD
2012-05-16 17:33 . 2012-05-16 17:33        --------        d-----w-        c:\programdata\Divinity 2
2012-05-16 17:28 . 2012-05-16 17:28        --------        d-----w-        C:\cabs
2012-05-16 17:21 . 2012-05-25 12:15        --------        d-----w-        c:\program files (x86)\Divinity II - Ego Draconis
2012-05-16 16:38 . 2012-05-16 16:38        --------        d-----w-        c:\programdata\PDVD
2012-05-16 16:38 . 2012-05-19 14:09        --------        d-----w-        c:\users\Public\CyberLink
2012-05-16 16:35 . 2012-05-16 16:35        --------        d-----w-        c:\programdata\install_clap
2012-05-16 15:23 . 2012-05-19 14:06        --------        d-----w-        c:\programdata\CyberLink
2012-05-16 15:19 . 2012-05-16 15:19        --------        d-----w-        c:\windows\system32\SPReview
2012-05-16 14:40 . 2012-05-16 14:40        --------        d-----w-        c:\windows\system32\EventProviders
2012-05-16 14:25 . 2011-03-11 06:41        189824        ----a-w-        c:\windows\system32\drivers\storport.sys
2012-05-16 14:25 . 2011-03-11 06:41        166272        ----a-w-        c:\windows\system32\drivers\nvstor.sys
2012-05-16 14:25 . 2011-03-11 06:41        1659776        ----a-w-        c:\windows\system32\drivers\ntfs.sys
2012-05-16 14:25 . 2011-03-11 06:41        148352        ----a-w-        c:\windows\system32\drivers\nvraid.sys
2012-05-16 14:25 . 2011-03-11 06:41        107904        ----a-w-        c:\windows\system32\drivers\amdsata.sys
2012-05-16 14:25 . 2011-03-11 06:33        2565632        ----a-w-        c:\windows\system32\esent.dll
2012-05-16 14:25 . 2011-03-11 05:33        1699328        ----a-w-        c:\windows\SysWow64\esent.dll
2012-05-16 14:25 . 2011-03-11 06:41        410496        ----a-w-        c:\windows\system32\drivers\iaStorV.sys
2012-05-16 14:25 . 2011-03-11 06:41        27008        ----a-w-        c:\windows\system32\drivers\amdxata.sys
2012-05-16 14:25 . 2011-03-11 06:30        96768        ----a-w-        c:\windows\system32\fsutil.exe
2012-05-16 14:25 . 2011-03-11 05:31        74240        ----a-w-        c:\windows\SysWow64\fsutil.exe
2012-05-16 14:24 . 2011-03-25 03:29        343040        ----a-w-        c:\windows\system32\drivers\usbhub.sys
2012-05-16 14:24 . 2011-03-25 03:29        325120        ----a-w-        c:\windows\system32\drivers\usbport.sys
2012-05-16 14:24 . 2011-03-25 03:29        52736        ----a-w-        c:\windows\system32\drivers\usbehci.sys
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-16 15:22 . 2009-07-14 02:36        175616        ----a-w-        c:\windows\system32\msclmd.dll
2012-05-16 15:22 . 2009-07-14 02:36        152576        ----a-w-        c:\windows\SysWow64\msclmd.dll
2012-04-06 02:20 . 2011-07-08 03:28        1067520        ----a-w-        c:\windows\system32\aticfx64.dll
2012-04-06 01:54 . 2011-07-08 03:10        7479296        ----a-w-        c:\windows\system32\atidxx64.dll
2012-04-06 01:34 . 2011-07-08 03:05        4731904        ----a-w-        c:\windows\system32\atiumd6a.dll
2012-04-06 01:23 . 2011-07-08 02:54        7431680        ----a-w-        c:\windows\system32\atiumd64.dll
2012-04-06 01:09 . 2011-07-08 02:46        54784        ----a-w-        c:\windows\system32\atiuxp64.dll
2012-04-06 01:09 . 2011-07-08 02:46        44544        ----a-w-        c:\windows\system32\atiu9p64.dll
2012-04-05 20:34 . 2012-04-05 20:34        187392        ----a-w-        c:\windows\system32\clinfo.exe
2012-04-05 20:34 . 2012-04-05 20:34        74752        ----a-w-        c:\windows\system32\OpenVideo64.dll
2012-04-05 20:34 . 2012-04-05 20:34        64512        ----a-w-        c:\windows\SysWow64\OpenVideo.dll
2012-04-05 20:33 . 2012-04-05 20:33        63488        ----a-w-        c:\windows\system32\OVDecode64.dll
2012-04-05 20:33 . 2012-04-05 20:33        56320        ----a-w-        c:\windows\SysWow64\OVDecode.dll
2012-04-05 20:33 . 2012-04-05 20:33        16457216        ----a-w-        c:\windows\system32\amdocl64.dll
2012-04-05 20:32 . 2012-04-05 20:32        13007872        ----a-w-        c:\windows\SysWow64\amdocl.dll
2012-03-20 18:22 . 2012-03-20 18:22        691896        ----a-w-        c:\windows\system32\drivers\avc3.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-05-16 1242448]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"AlcoholAutomount"="c:\program files (x86)\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe" [2012-01-05 75624]
"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-07-07 393216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"THX TruStudio NB Settings"="c:\program files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" [2011-05-19 909824]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-05 641664]
"RemoteControl"="c:\program files (x86)\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"PowerDVD12DMREngine"="c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe" [2012-01-02 501544]
"PowerDVD12Agent"="c:\program files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe" [2012-01-12 371256]
"NBAgent"="c:\program files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe" [2012-01-13 1493288]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service;c:\program files (x86)\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe [2012-01-05 75624]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-12 136176]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856]
R3 AmdLLD64;AMD Low Level Device Driver;c:\windows\system32\DRIVERS\AmdLLD64.sys [x]
R3 bdsandbox;bdsandbox;c:\windows\system32\drivers\bdsandbox.sys [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe [2012-04-26 135584]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-12 136176]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-05-13 129976]
R3 netr28ux;RT2870 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr28ux.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe [2011-10-14 466736]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [x]
S0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\DRIVERS\NBVol.sys [x]
S0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\DRIVERS\NBVolUp.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [2011-11-14 90192]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2011-11-14 103504]
S1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 {329F96B6-DF1E-4328-BFDA-39EA953C1312};Power Control [2012/05/19 15:58];c:\program files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [2012-01-11 20:57 146928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-04-05 361984]
S2 AMDFusionSVC;AMD Fusion Utility Service;c:\program files (x86)\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe [2009-09-08 383544]
S2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-03-05 53888]
S2 CLHNServiceForPowerDVD12;CLHNServiceForPowerDVD12;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [2012-01-12 87336]
S2 CyberLink PowerDVD 12 Media Server Monitor Service;CyberLink PowerDVD 12 Media Server Monitor Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [2012-01-12 75048]
S2 CyberLink PowerDVD 12 Media Server Service;CyberLink PowerDVD 12 Media Server Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [2012-01-12 296232]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-11-25 687400]
S2 ntk_PowerDVD12;ntk_PowerDVD12;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [2011-10-27 82928]
S2 UPDATESRV;BitDefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender 2012\updatesrv.exe [2012-03-13 66096]
S3 ALSysIO;ALSysIO;c:\users\Lukas\AppData\Local\Temp\ALSysIO64.sys [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys [x]
S3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [x]
S3 rt61x64;RT61 Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr6164.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-12 08:16]
.
2012-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-12 08:16]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"THXCfg64"="c:\windows\system32\RunDLL32.exe" [2009-07-14 45568]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-05-18 11855976]
"BDAgent"="c:\program files\Bitdefender\Bitdefender 2012\bdagent.exe" [2012-03-22 1067256]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page =
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wionzyv9.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - prefs.js: network.proxy.type - 0
user_pref(security.warn_submit_insecure,false);user_pref(security.warn_viewing_mixed,false);FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=113480&tt=100512_1_
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 9ac4fba1000000000000001f1f607b79
FF - user.js: extensions.BabylonToolbar_i.hardId - 9ac4fba1000000000000001f1f607b79
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15489
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1718:31
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-Argus Monitor - c:\program files (x86)\ArgusMonitor\ArgusMonitor.exe
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{329F96B6-DF1E-4328-BFDA-39EA953C1312}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-06-07  16:51:22
ComboFix-quarantined-files.txt  2012-06-07 14:51
.
Vor Suchlauf: 14 Verzeichnis(se), 771.367.337.984 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 770.987.421.696 Bytes frei
.
- - End Of File - - ED19E0E5D9B6E44F0A5D16598F4F51A8

cosinus 07.06.2012 20:04
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Firefox::
FF - ProfilePath - c:\users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wionzyv9.default\
user_pref(security.warn_submit_insecure,false);user_pref(security.warn_viewing_mixed,false);FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=113480&tt=100512_1_
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 9ac4fba1000000000000001f1f607b79
FF - user.js: extensions.BabylonToolbar_i.hardId - 9ac4fba1000000000000001f1f607b79
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15489
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1718:31
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Lukas1997 08.06.2012 11:01
Code:
ComboFix 12-06-08.01 - Lukas 08.06.2012  11:36:34.3.6 - x64
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1031.18.8172.6306 [GMT 2:00]
ausgeführt von:: c:\users\Lukas\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Lukas\Desktop\CFScript.txt
AV: Bitdefender Virenschutz *Disabled/Updated* {50909708-FF80-02AF-F814-B28405891E92}
FW: Bitdefender Firewall *Enabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9}
SP: Bitdefender Spyware-Schutz *Disabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Your Product\lua5.1.dll
c:\users\Lukas\AppData\Roaming\Help\coredb\storage
c:\windows\logboot_08.06.2012.tureg.log
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-08 bis 2012-06-08  ))))))))))))))))))))))))))))))
.
.
2012-06-08 09:45 . 2012-06-08 09:45        --------        d-----w-        c:\windows\system32\config\systemprofile\AppData\Local\temp
2012-06-08 09:45 . 2012-06-08 09:45        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-06-07 17:42 . 2011-10-20 11:40        34624        ----a-w-        c:\windows\system32\TURegOpt.exe
2012-06-07 17:42 . 2011-10-20 11:40        25920        ----a-w-        c:\windows\system32\authuitu.dll
2012-06-07 17:42 . 2011-10-20 11:40        21312        ----a-w-        c:\windows\SysWow64\authuitu.dll
2012-06-07 17:42 . 2012-06-07 17:42        --------        d-----w-        c:\program files (x86)\TuneUp Utilities 2012
2012-06-07 17:40 . 2012-06-07 17:42        --------        d-----w-        c:\programdata\TuneUp Software
2012-06-07 17:29 . 2012-06-07 17:29        --------        d-sh--w-        c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2012-06-07 10:43 . 2012-06-07 10:56        --------        d-----w-        c:\program files (x86)\The Elder Scrolls V Skyrim
2012-06-07 09:17 . 2012-06-07 09:17        --------        d-----w-        c:\users\Public\Interface
2012-06-07 09:13 . 2012-06-07 09:16        --------        d-----w-        c:\users\Public\Strings
2012-06-06 18:48 . 2008-10-15 04:22        519000        ----a-w-        c:\windows\system32\d3dx10_40.dll
2012-06-06 18:48 . 2008-10-15 04:22        452440        ----a-w-        c:\windows\SysWow64\d3dx10_40.dll
2012-06-06 18:48 . 2008-10-15 04:22        2605920        ----a-w-        c:\windows\system32\D3DCompiler_40.dll
2012-06-06 18:48 . 2008-10-15 04:22        2036576        ----a-w-        c:\windows\SysWow64\D3DCompiler_40.dll
2012-06-06 18:48 . 2008-10-15 04:22        5631312        ----a-w-        c:\windows\system32\D3DX9_40.dll
2012-06-06 14:56 . 2012-06-06 14:56        --------        d-----w-        C:\TDSSKiller_Quarantine
2012-06-06 14:33 . 2012-06-06 14:33        --------        d-----w-        C:\_OTL
2012-06-06 11:43 . 2012-06-06 11:43        --------        d-----w-        c:\windows\SysWow64\xlive
2012-06-06 11:43 . 2012-06-06 11:43        --------        d-----w-        c:\program files (x86)\Microsoft Games for Windows - LIVE
2012-06-01 21:00 . 2012-05-15 10:48        2368832        ----a-w-        c:\windows\SysWow64\nvapi.dll.BAK
2012-06-01 20:22 . 2009-11-20 17:18        4990056        ----a-w-        c:\windows\SysWow64\NVStWiz.exe
2012-06-01 20:20 . 2012-06-02 12:44        --------        d-----w-        c:\program files\NVIDIA Corporation
2012-06-01 11:17 . 2012-06-01 11:17        --------        d-----w-        c:\program files (x86)\ESET
2012-06-01 11:12 . 2012-06-01 11:12        --------        d-----w-        c:\programdata\Malwarebytes
2012-06-01 10:47 . 2009-11-21 02:34        930272        ----a-w-        c:\windows\system32\dpinst.exe
2012-06-01 10:47 . 2009-11-21 02:34        202344        ----a-w-        c:\windows\system32\nvcod178.dll
2012-05-29 15:57 . 2012-05-29 15:57        --------        d-----w-        c:\program files\HashTab Shell Extension
2012-05-29 11:56 . 2012-05-29 11:56        --------        d-----w-        c:\program files (x86)\EA Games
2012-05-28 16:52 . 2012-06-06 12:55        109080        ----a-w-        c:\windows\SysWow64\OpenAL32.dll
2012-05-28 15:45 . 2012-05-28 16:08        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2012-05-28 14:12 . 2012-05-28 14:12        --------        d-----w-        c:\program files (x86)\MSI Kombustor 2.3
2012-05-28 14:11 . 2012-05-28 14:21        --------        d-----w-        c:\program files (x86)\MSI Afterburner
2012-05-28 11:23 . 2012-05-28 11:23        --------        d-----w-        c:\windows\symbols
2012-05-28 11:20 . 2012-05-28 11:20        --------        d-----w-        c:\programdata\VS
2012-05-27 16:50 . 2012-05-27 16:50        --------        d-----w-        c:\program files (x86)\Microsoft
2012-05-27 16:48 . 2012-05-28 12:53        --------        d-----w-        c:\program files (x86)\Microsoft Silverlight
2012-05-27 16:45 . 2000-05-10 23:00        90112        ------w-        c:\windows\Updreg.EXE
2012-05-27 16:45 . 2010-07-21 14:51        11264        ------w-        c:\windows\SysWow64\ResDefA.exe
2012-05-27 16:45 . 2009-10-01 14:42        141312        ------w-        c:\windows\system32\THXCfg64.exe
2012-05-27 16:45 . 2011-05-13 10:30        26624        ------w-        c:\windows\system32\THXCfg64.dll
2012-05-27 16:45 . 2011-05-19 07:58        246784        ----a-w-        c:\windows\system32\APOMgr64.DLL
2012-05-27 16:45 . 2011-05-19 07:56        190464        ----a-w-        c:\windows\SysWow64\APOMngr.DLL
2012-05-27 16:45 . 2009-12-29 14:53        89088        ----a-w-        c:\windows\system32\CmdRtr64.DLL
2012-05-27 16:45 . 2009-12-29 14:52        73728        ----a-w-        c:\windows\SysWow64\CmdRtr.DLL
2012-05-27 16:45 . 2012-05-27 16:45        --------        d-----w-        c:\program files (x86)\Creative
2012-05-27 11:49 . 2012-05-27 11:48        647872        ----a-w-        c:\windows\SysWow64\mscomct2.ocx
2012-05-27 09:50 . 2009-09-04 15:29        453456        ----a-w-        c:\windows\SysWow64\d3dx10_42.dll
2012-05-27 09:32 . 2012-05-27 12:13        --------        d-----w-        c:\program files (x86)\BRS
2012-05-27 09:32 . 2011-03-19 13:16        1417216        ----a-w-        c:\windows\SysWow64\rapture3d_oal.dll
2012-05-27 09:32 . 2010-09-22 11:12        19087360        ----a-w-        c:\windows\SysWow64\mkl_blueripple.dll
2012-05-27 09:32 . 2012-06-06 12:55        466456        ----a-w-        c:\windows\system32\wrap_oal.dll
2012-05-27 09:32 . 2012-06-06 12:55        122904        ----a-w-        c:\windows\system32\OpenAL32.dll
2012-05-27 09:32 . 2012-05-27 09:32        --------        d-----w-        c:\program files (x86)\OpenAL
2012-05-27 09:32 . 2012-06-06 12:55        444952        ----a-w-        c:\windows\SysWow64\wrap_oal.dll
2012-05-27 08:32 . 2012-05-27 08:32        --------        d-----w-        c:\programdata\Electronic Arts
2012-05-27 08:19 . 2012-05-27 08:19        --------        d-----w-        c:\program files (x86)\Microsoft WSE
2012-05-27 08:05 . 2012-05-27 08:32        --------        d-----w-        c:\program files (x86)\Electronic Arts
2012-05-26 12:39 . 2012-05-29 11:18        --------        d-----w-        C:\Windows Photo Viewer
2012-05-26 10:50 . 2012-05-26 10:50        --------        d-----w-        c:\program files (x86)\The Creative Assembly
2012-05-26 10:15 . 2012-05-26 10:54        --------        d-----w-        c:\program files (x86)\Activision
2012-05-25 16:59 . 2012-06-08 09:42        --------        d-----w-        c:\program files (x86)\Your Product
2012-05-25 12:30 . 2009-07-14 01:39        1402880        ----a-w-        c:\windows\system32\Utilman.exe
2012-05-20 17:23 . 2005-05-25 05:00        90112        ------w-        c:\windows\SDUnInst.exe
2012-05-20 17:23 . 2012-06-02 18:52        --------        d-----w-        c:\program files (x86)\Software by Design
2012-05-20 12:47 . 2012-05-20 12:47        --------        d-----w-        c:\program files (x86)\Microsoft SQL Server
2012-05-20 12:46 . 2012-05-20 12:46        --------        d-----w-        c:\program files\Microsoft Synchronization Services
2012-05-20 12:46 . 2012-05-20 12:46        --------        d-----w-        c:\program files\Microsoft SQL Server Compact Edition
2012-05-20 12:46 . 2012-05-20 12:46        --------        d-----w-        c:\program files (x86)\Microsoft Synchronization Services
2012-05-20 12:46 . 2012-05-20 12:46        --------        d-----w-        c:\program files (x86)\Microsoft SQL Server Compact Edition
2012-05-20 12:46 . 2012-05-28 16:57        207008        ----a-w-        c:\programdata\Microsoft\VBExpress\10.0\1031\ResourceCache.dll
2012-05-20 12:45 . 2012-05-20 12:47        --------        d-----w-        c:\program files (x86)\Microsoft Visual Studio 10.0
2012-05-20 12:44 . 2012-05-20 12:44        --------        d-----w-        c:\program files\Microsoft Visual Studio 10.0
2012-05-20 12:44 . 2012-05-20 12:44        --------        d-----w-        c:\program files\Microsoft Help Viewer
2012-05-20 12:44 . 2012-05-20 12:44        --------        d-----w-        c:\program files (x86)\Microsoft SDKs
2012-05-20 08:59 . 2012-05-20 08:59        --------        d-----w-        c:\windows\system32\config\systemprofile\AppData\Roaming\QuickScan
2012-05-20 08:30 . 2009-10-16 01:10        303616        ----a-w-        c:\windows\system32\RaCoInstx.dll
2012-05-20 08:30 . 2012-05-20 08:30        --------        d-----w-        c:\programdata\Edimax Driver
2012-05-19 21:59 . 2012-05-19 21:59        --------        d-----w-        c:\programdata\BDLogging
2012-05-19 21:59 . 2012-05-19 21:59        --------        d-----w-        c:\programdata\Bitdefender
2012-05-19 21:57 . 2011-08-16 12:59        442088        ----a-w-        c:\windows\system32\drivers\bdfsfltr.sys
2012-05-19 21:57 . 2011-10-27 13:07        329800        ------w-        c:\windows\system32\drivers\trufos.sys
2012-05-19 21:54 . 2012-05-19 21:54        --------        d-----w-        c:\program files\Bitdefender
2012-05-19 21:35 . 2012-05-19 21:57        --------        d-----w-        c:\program files\Common Files\Bitdefender
2012-05-19 21:32 . 2012-05-19 21:32        --------        d-----w-        c:\program files (x86)\Common Files\Bitdefender
2012-05-19 15:59 . 2012-05-19 16:01        --------        d-----w-        c:\program files (x86)\Common Files\Nero
2012-05-19 15:58 . 2012-05-19 16:04        --------        d-----w-        c:\programdata\Nero
2012-05-19 15:38 . 2011-12-01 09:42        15920        ------w-        c:\windows\system32\drivers\NBVolUp.sys
2012-05-19 15:37 . 2012-05-19 16:03        --------        d-----w-        c:\program files (x86)\Nero
2012-05-19 15:37 . 2011-12-01 09:42        72240        ------w-        c:\windows\system32\drivers\NBVol.sys
2012-05-19 15:37 . 2009-09-04 15:29        1974616        ----a-w-        c:\windows\SysWow64\D3DCompiler_42.dll
2012-05-19 15:36 . 2009-09-04 15:29        1892184        ----a-w-        c:\windows\SysWow64\D3DX9_42.dll
2012-05-19 15:35 . 2008-10-15 04:22        4379984        ----a-w-        c:\windows\SysWow64\D3DX9_40.dll
2012-05-19 11:48 . 2012-05-19 11:48        --------        d-----w-        c:\program files (x86)\Alcohol Soft
2012-05-19 11:47 . 2012-05-19 11:47        --------        d--h--w-        c:\programdata\Common Files
2012-05-18 18:06 . 2012-05-25 12:15        --------        d-----w-        c:\program files (x86)\Inno Setup 5
2012-05-18 14:28 . 2012-05-18 14:28        560184        ------w-        c:\windows\system32\drivers\sptd.sys
2012-05-18 14:27 . 2012-05-29 16:31        500        ----a-w-        C:\user.js
2012-05-18 14:27 . 2012-05-18 14:27        --------        d-----w-        c:\programdata\Babylon
2012-05-18 14:08 . 2011-01-17 11:09        197120        ----a-w-        c:\windows\system32\d3d10_1.dll
2012-05-18 14:08 . 2011-01-17 05:47        161792        ----a-w-        c:\windows\SysWow64\d3d10_1.dll
2012-05-18 13:02 . 2012-05-25 12:15        --------        d-----w-        c:\program files (x86)\Common Files\Skype
2012-05-18 13:02 . 2012-05-18 13:02        --------        d-----r-        c:\program files (x86)\Skype
2012-05-18 12:54 . 2012-05-08 17:02        8955792        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{3B7A242F-D942-48BD-9A7A-41BE132B043E}\mpengine.dll
2012-05-18 12:53 . 2012-01-25 06:38        77312        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-05-18 12:53 . 2012-01-25 06:38        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-05-17 12:27 . 2012-05-17 12:28        --------        d-----w-        c:\programdata\boost_interprocess
2012-05-17 12:26 . 2012-05-18 13:02        --------        d-----w-        c:\programdata\Skype
2012-05-17 08:29 . 2012-05-17 08:29        --------        d-----w-        C:\AMD
2012-05-16 17:33 . 2012-05-16 17:33        --------        d-----w-        c:\programdata\Divinity 2
2012-05-16 17:28 . 2012-05-16 17:28        --------        d-----w-        C:\cabs
2012-05-16 17:21 . 2012-05-25 12:15        --------        d-----w-        c:\program files (x86)\Divinity II - Ego Draconis
2012-05-16 16:38 . 2012-05-16 16:38        --------        d-----w-        c:\programdata\PDVD
2012-05-16 16:38 . 2012-05-19 14:09        --------        d-----w-        c:\users\Public\CyberLink
2012-05-16 16:35 . 2012-05-16 16:35        --------        d-----w-        c:\programdata\install_clap
2012-05-16 15:23 . 2012-05-19 14:06        --------        d-----w-        c:\programdata\CyberLink
2012-05-16 15:19 . 2012-05-16 15:19        --------        d-----w-        c:\windows\system32\SPReview
2012-05-16 14:40 . 2012-05-16 14:40        --------        d-----w-        c:\windows\system32\EventProviders
2012-05-16 14:25 . 2011-03-11 06:41        189824        ----a-w-        c:\windows\system32\drivers\storport.sys
2012-05-16 14:25 . 2011-03-11 06:41        166272        ----a-w-        c:\windows\system32\drivers\nvstor.sys
2012-05-16 14:25 . 2011-03-11 06:41        1659776        ----a-w-        c:\windows\system32\drivers\ntfs.sys
2012-05-16 14:25 . 2011-03-11 06:41        148352        ----a-w-        c:\windows\system32\drivers\nvraid.sys
2012-05-16 14:25 . 2011-03-11 06:41        107904        ----a-w-        c:\windows\system32\drivers\amdsata.sys
2012-05-16 14:25 . 2011-03-11 06:33        2565632        ----a-w-        c:\windows\system32\esent.dll
2012-05-16 14:25 . 2011-03-11 05:33        1699328        ----a-w-        c:\windows\SysWow64\esent.dll
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-16 15:22 . 2009-07-14 02:36        175616        ----a-w-        c:\windows\system32\msclmd.dll
2012-05-16 15:22 . 2009-07-14 02:36        152576        ----a-w-        c:\windows\SysWow64\msclmd.dll
2012-04-06 02:20 . 2011-07-08 03:28        1067520        ----a-w-        c:\windows\system32\aticfx64.dll
2012-04-06 01:54 . 2011-07-08 03:10        7479296        ----a-w-        c:\windows\system32\atidxx64.dll
2012-04-06 01:34 . 2011-07-08 03:05        4731904        ----a-w-        c:\windows\system32\atiumd6a.dll
2012-04-06 01:23 . 2011-07-08 02:54        7431680        ----a-w-        c:\windows\system32\atiumd64.dll
2012-04-06 01:09 . 2011-07-08 02:46        54784        ----a-w-        c:\windows\system32\atiuxp64.dll
2012-04-06 01:09 . 2011-07-08 02:46        44544        ----a-w-        c:\windows\system32\atiu9p64.dll
2012-04-05 20:34 . 2012-04-05 20:34        187392        ----a-w-        c:\windows\system32\clinfo.exe
2012-04-05 20:34 . 2012-04-05 20:34        74752        ----a-w-        c:\windows\system32\OpenVideo64.dll
2012-04-05 20:34 . 2012-04-05 20:34        64512        ----a-w-        c:\windows\SysWow64\OpenVideo.dll
2012-04-05 20:33 . 2012-04-05 20:33        63488        ----a-w-        c:\windows\system32\OVDecode64.dll
2012-04-05 20:33 . 2012-04-05 20:33        56320        ----a-w-        c:\windows\SysWow64\OVDecode.dll
2012-04-05 20:33 . 2012-04-05 20:33        16457216        ----a-w-        c:\windows\system32\amdocl64.dll
2012-04-05 20:32 . 2012-04-05 20:32        13007872        ----a-w-        c:\windows\SysWow64\amdocl.dll
2012-03-20 18:22 . 2012-03-20 18:22        691896        ----a-w-        c:\windows\system32\drivers\avc3.sys
.
.
(((((((((((((((((((((((((((((  SnapShot@2012-06-07_14.48.05  )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-14 05:16 . 2012-06-08 09:05        45254              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-06-08 09:05        36104              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2012-05-11 15:24 . 2012-06-08 09:05        10576              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1452557258-77057033-3389612022-1000_UserData.bin
+ 2012-06-08 09:03 . 2012-06-08 09:03        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-06-07 07:46 . 2012-06-07 07:46        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-06-08 09:03 . 2012-06-08 09:03        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-06-07 07:46 . 2012-06-07 07:46        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-05-17 16:08 . 2012-06-07 16:09        250916              c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
+ 2009-07-14 02:36 . 2012-06-07 17:32        652150              c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-06-06 12:17        652150              c:\windows\system32\perfh009.dat
+ 2009-07-14 17:58 . 2012-06-07 17:32        696832              c:\windows\system32\perfh007.dat
- 2009-07-14 17:58 . 2012-06-06 12:17        696832              c:\windows\system32\perfh007.dat
+ 2009-07-14 02:36 . 2012-06-07 17:32        121082              c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-06-06 12:17        121082              c:\windows\system32\perfc009.dat
- 2009-07-14 17:58 . 2012-06-06 12:17        148128              c:\windows\system32\perfc007.dat
+ 2009-07-14 17:58 . 2012-06-07 17:32        148128              c:\windows\system32\perfc007.dat
+ 2009-07-14 05:01 . 2012-06-08 08:45        331800              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-06-06 18:58        331800              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-05-11 15:31 . 2012-06-08 08:45        1676352              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
- 2012-05-11 15:31 . 2012-06-06 18:58        1676352              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2012-05-12 15:09 . 2012-06-08 08:45        5688992              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1452557258-77057033-3389612022-1000-12288.dat
- 2012-05-12 15:09 . 2012-06-06 14:36        5688992              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1452557258-77057033-3389612022-1000-12288.dat
+ 2012-06-07 17:40 . 2012-06-07 17:40        1881088              c:\windows\Installer\216347b.msi
+ 2012-05-12 09:55 . 2012-06-08 08:45        16791880              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1452557258-77057033-3389612022-1000-8192.dat
+ 2012-06-07 17:40 . 2012-06-07 17:40        23696384              c:\windows\Installer\216347f.msi
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"AlcoholAutomount"="c:\program files (x86)\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe" [2012-01-05 75624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"THX TruStudio NB Settings"="c:\program files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" [2011-05-19 909824]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-05 641664]
"RemoteControl"="c:\program files (x86)\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"PowerDVD12DMREngine"="c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe" [2012-01-02 501544]
"PowerDVD12Agent"="c:\program files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe" [2012-01-12 371256]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"NBAgent"="c:\program files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe" /WinStart
.
R2 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service;c:\program files (x86)\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe [2012-01-05 75624]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 ALSysIO;ALSysIO;c:\users\Lukas\AppData\Local\Temp\ALSysIO64.sys [x]
R3 AmdLLD64;AMD Low Level Device Driver;c:\windows\system32\DRIVERS\AmdLLD64.sys [x]
R3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [x]
R3 bdsandbox;bdsandbox;c:\windows\system32\drivers\bdsandbox.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-05-13 129976]
R3 netr28ux;RT2870 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr28ux.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe [2011-10-14 466736]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R4 AMDFusionSVC;AMD Fusion Utility Service;c:\program files (x86)\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe [2009-09-08 383544]
R4 CLHNServiceForPowerDVD12;CLHNServiceForPowerDVD12;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [2012-01-12 87336]
R4 CyberLink PowerDVD 12 Media Server Monitor Service;CyberLink PowerDVD 12 Media Server Monitor Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [2012-01-12 75048]
R4 CyberLink PowerDVD 12 Media Server Service;CyberLink PowerDVD 12 Media Server Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [2012-01-12 296232]
R4 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe [2012-04-26 135584]
R4 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-12 136176]
R4 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-12 136176]
R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856]
S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [x]
S0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\DRIVERS\NBVol.sys [x]
S0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\DRIVERS\NBVolUp.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [2011-11-14 90192]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2011-11-14 103504]
S1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 {329F96B6-DF1E-4328-BFDA-39EA953C1312};Power Control [2012/05/19 15:58];c:\program files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [2012-01-11 20:57 146928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-04-05 361984]
S2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-03-05 53888]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-11-25 687400]
S2 ntk_PowerDVD12;ntk_PowerDVD12;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [2011-10-27 82928]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2011-10-20 2072896]
S2 UPDATESRV;BitDefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender 2012\updatesrv.exe [2012-03-13 66096]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [x]
S3 rt61x64;RT61 Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr6164.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-10-20 11856]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-12 08:16]
.
2012-06-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-12 08:16]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"THXCfg64"="c:\windows\system32\RunDLL32.exe" [2009-07-14 45568]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-05-18 11855976]
"BDAgent"="c:\program files\Bitdefender\Bitdefender 2012\bdagent.exe" [2012-03-22 1067256]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page =
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wionzyv9.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - prefs.js: network.proxy.type - 0
user_pref(security.warn_submit_insecure,false);user_pref(security.warn_viewing_mixed,false);FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=113480&tt=100512_1_
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{329F96B6-DF1E-4328-BFDA-39EA953C1312}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-06-08  11:58:56
ComboFix-quarantined-files.txt  2012-06-08 09:58
ComboFix2.txt  2012-06-07 14:51
.
Vor Suchlauf: 17 Verzeichnis(se), 894.301.687.808 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 894.368.669.696 Bytes frei
.
- - End Of File - - AE3C7DE9924862440E92833DF4DCB2B8

cosinus 08.06.2012 11:52
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Lukas1997 08.06.2012 12:50
Habe mit allen drei Programmen gescannt, aswMBR hat erst nicht funktioniert, aber dann habe ich ich (none) eingestellt und es hat geklappt.

cosinus 08.06.2012 13:16
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Lukas1997 08.06.2012 13:58
Hat nichts gefunden ausser halt das übliche, Adware Tracking Cookies und so.
SUPERAntiSpyware:
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 06/08/2012 at 02:30 PM

Application Version : 5.0.1150

Core Rules Database Version : 8704
Trace Rules Database Version: 6516

Scan type      : Quick Scan
Total Scan Time : 00:04:38

Operating System Information
Windows 7 Ultimate 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 942
Memory threats detected  : 0
Registry items scanned    : 54405
Registry threats detected : 0
File items scanned        : 10547
File threats detected    : 153

Adware.Tracking Cookie
        .doubleclick.net [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        stats.computecmedia.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Cookies\8TKNJZJ7.txt [ /c.atdmt.com ]
        .tradedoubler.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Cookies\WB7QV981.txt [ /tracking.quisma.com ]
        .tradedoubler.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        tracking.mlsat02.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Cookies\RAE30Y4K.txt [ /serving-sys.com ]
        .xiti.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\LUKAS\AppData\Roaming\Microsoft\Windows\Cookies\Low\lukas@lucidmedia[1].txt [ Cookie:lukas@lucidmedia.com/ ]
        C:\USERS\LUKAS\AppData\Roaming\Microsoft\Windows\Cookies\Low\lukas@adfarm1.adition[1].txt [ Cookie:lukas@adfarm1.adition.com/ ]
        .lucidmedia.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\LUKAS\AppData\Roaming\Microsoft\Windows\Cookies\Low\lukas@ad.yieldmanager[2].txt [ Cookie:lukas@ad.yieldmanager.com/ ]
        .ru4.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\LUKAS\AppData\Roaming\Microsoft\Windows\Cookies\Low\lukas@adserver.adtechus[1].txt [ Cookie:lukas@adserver.adtechus.com/ ]
        C:\USERS\LUKAS\AppData\Roaming\Microsoft\Windows\Cookies\Low\lukas@ad.zanox[2].txt [ Cookie:lukas@ad.zanox.com/ ]
        C:\USERS\LUKAS\AppData\Roaming\Microsoft\Windows\Cookies\Low\lukas@www.mediafire[1].txt [ Cookie:lukas@www.mediafire.com/ ]
        C:\USERS\LUKAS\AppData\Roaming\Microsoft\Windows\Cookies\Low\lukas@media6degrees[1].txt [ Cookie:lukas@media6degrees.com/ ]
        .adserver.adtechus.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\LUKAS\AppData\Roaming\Microsoft\Windows\Cookies\Low\lukas@imrworldwide[2].txt [ Cookie:lukas@imrworldwide.com/cgi-bin ]
        .doubleclick.net [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\LUKAS\AppData\Roaming\Microsoft\Windows\Cookies\Low\lukas@invitemedia[2].txt [ Cookie:lukas@invitemedia.com/ ]
        .atdmt.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\LUKAS\AppData\Roaming\Microsoft\Windows\Cookies\Low\lukas@im.banner.t-online[1].txt [ Cookie:lukas@im.banner.t-online.de/ ]
        .adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\LUKAS\AppData\Roaming\Microsoft\Windows\Cookies\Low\lukas@www.active-tracking[1].txt [ Cookie:lukas@www.active-tracking.de/ ]
        .webmasterplan.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\LUKAS\AppData\Roaming\Microsoft\Windows\Cookies\Low\lukas@adbrite[2].txt [ Cookie:lukas@adbrite.com/ ]
        banner.testberichte.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        banner.testberichte.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        banner.testberichte.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\LUKAS\Cookies\WB7QV981.txt [ Cookie:lukas@tracking.quisma.com/ ]
        .smartadserver.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\LUKAS\Cookies\RAE30Y4K.txt [ Cookie:lukas@serving-sys.com/ ]
        .estat.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .game-advertising-online.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .myroitracking.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .yieldmanager.net [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .blogads.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .blogads.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .a.revenuemax.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        ww251.smartadserver.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .yadro.ru [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LUKAS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WIONZYV9.DEFAULT\COOKIES.SQLITE ]
Und hier Malwarebytes:
Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.08.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Lukas :: DESKTOP-PC [Administrator]

Schutz: Deaktiviert

08.06.2012 14:24:48
mbam-log-2012-06-08 (14-24-48).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 359285
Laufzeit: 32 Minute(n), 4 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Windows\System32\cmdow.exe (PUP.Tool) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

cosinus 08.06.2012 18:35
Sieht ok aus, da wurden nur Cookies gefunden. Und ein Überrest bei Malwarebytes war dabei.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Lukas1997 08.06.2012 18:50
Habe CookieCuller installiert und eben noch mal mit TuneUp gereinigt, es läuft wieder alles so wie es soll.

cosinus 08.06.2012 18:59
Zitat:
TuneUp gereinigt, es läuft wieder alles so wie es soll.
:eek: :balla: :stirn:

TuneUp ist eine Software, die ich als Problembeschaffungsmaßnahme bzw. Schlangenöl bezeichnen würde :balla:
Das zieht sich - warum auch immer - fast durchgängig durch alle Logs hier, warum weiß ich nicht, denn TuneUp ist eigentlich der letzte Schrott => TuneUp: Wundermittel oder Placebo Reloaded | DerFisch.de :stirn:

Lukas1997 08.06.2012 19:13
Ist ja in Ordnung, dann benutze ich es eben nicht mehr aber ich persönlich hatte erst den Eindruck das es hilft.
Aber sonst klappt alles auf meinem PC.

cosinus 08.06.2012 19:15
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Lukas1997 08.06.2012 19:18
Ist alles erledigt und danke nochmal.:daumenhoc

cosinus 08.06.2012 19:19
In drei MInuten erledigt? :D

Lukas1997 08.06.2012 19:21
Ja, das entfernen ging schnell und Java, Windows etc. halte ich eh immer auf dem neusten Stand.

cosinus 08.06.2012 19:30
Dann ist ja gut :)

Lukas1997 08.06.2012 22:20
hab da noch mal ne frage:gibts eine alternative zu tuneup?

cosinus 08.06.2012 22:47
Zitat:
gibts eine alternative zu tuneup?
Ja. Brain und den CCleaner aber Finger von der Registry!


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:07 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132