Trojaner-Board - Mor.exe abgewendet?

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Mor.exe abgewendet? (https://www.trojaner-board.de/117920-mor-exe-abgewendet.html)

Mor.exe abgewendet?

Sorry war mir nicht ganz sicher ob ich das in einen Thread zum Thema mor.exe posten soll.

Gestern abend war ich auf TV Tropes auf der Seite von Dead Rising 2. Ich benutze Firefox und normaler Weise habe ich immer Cookies deaktiviert, aber weil ich einen kleinen Eintrag by Tv Tropes machen wollte änderte ich die Einstellung zu normalen Cookies (nicht von Drittanbierten) zu erlaube. Als ich dort war klickte ich auf ein Link zu einen Artikel auf der Seite siliconera.com. Wobei ich vergass die Cookies wieder zu deaktivieren.

Nachdem ich den Tab mit den Artikel schnell geschlossen hatte, da ich die Seite nicht kannte. Erschien prlötzlich von Anti-Vir die Anfrage ob mor.exe erlaubt werden soll oder zurückgewiesen werden sollte. Ich habe nähmlich die Anti-Vir Einstellung das es immer fragen soll bevor eine .exe datei ausgeführt werden soll.
Schnell klickte ich auf Zurückweisen und sah in meinen Ordner AppData/Local/Temp nach, da ich wusse dass dort meistens solche Malware und Viren .exe datein auftreten. Aber die Datei fehlte komplett.

Aus Angst suchte ich im Internet nach mor.exe und fand einen Eintrag hier. Ich follgte der ersten Anweisung, installiert Malwarebytes, updatete es zur neusten Version. Ging in den Abgesicherten Modus und ließ einen kompletten Scan machen.

Eine Stunde später kahm dieses Ergebniss heraus:

Zitat:

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.24.06

Windows 7 x86 NTFS (Abgesichertenmodus)
Internet Explorer 8.0.7600.16385
*Name von mir und meines Computers* [Administrator]

24.06.2012 23:29:56
mbam-log-2012-06-24 (23-29-56).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 440531
Laufzeit: 57 Minute(n), 5 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Mein Rechner wurde also als komplett clean berichtet. Ich ließ noch einmal einen komplett Scan mit meinen Avira machen (sowohl normal also auch speziell nach Mal-ware) und erneut wurde mir nichts angezeigt.

Ich scannte noch einmal mein Java order direkt mit Walwarebytes und erneut nicht ein Fund.

Ich entschloss mich dann ein paar wichtige Daten auf meine sonst getrennte exteren Festplatte zu koppieren (Text für die Uni und Bilder, keine exe dateien).

Aber wo ich nochmal nach informationen zur Malware suchend, auf Microsoft nachgelesen habe das die Gefahr die hinter der Malware mit mor.exe steht als "severe" beschrieben wird, bin ich mir nicht sicher ob ich nicht zu vorschnell war.

Also meine Frage ist. Kann ich dem Urteil von Malwarebytes trauen UND ist es möglich das ich durch das zurückweisen per Avira die Malwareattacke im Keim erstickt habe?

Oder sollte ich mir nun mehr Sorgen den je machen (da ich vielleicht meine Exterene Festplatte infiziert habe)?

Entschuldigt den Doppelpost. Aber ich konnte meinen Eintrag nicht editieren. Nach genaueren erinnern ist mir eingefallen das ich nicht die bloße Ausführung des Programms sonder das Herunter laden der exe Datei verboten habe. Das ist bei mir ebenfalls eingestellt. Ausführung von exe datein und das herunterladen von Ausführungen aus dem Internent brauchen meine Erlaubnis.

Jetzt ist die Frage ob mor.exe die Malware installiert oder von ihr herunter geladen wird.

Also ob ich das Sympton verhindert habe oder die Infektion?

Hier ist nochmal was mein Anvira gemacht hat:

Zitat:

Gesperrte Anwendung:
Lokale IP: ****
Lokaler Port: ****
Remote IP: ****
Remote Port: ****
Aktionscode: Connect
Pfad der Anwendung: C:\Users\*Namevonmir*\AppData\Local\Temp\mor.exe
Benutzer: *MeinName*.

Falls der remote IP code wichtig ist bitte sagen.

Führ bitte auch ESET aus, danach sehen wir weiter.

Hinweis: ESET zeigt durchaus öfter ein paar Fehlalarme. Deswegen soll auch von ESET immer nur erst das Log gepostet und nichts entfernt werden.

ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.

Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt so öffnen: per Rechtsklick => als Administrator ausführen
Dein Anti-Virus-Programm während des Scans deaktivieren.

Button http://img695.imageshack.us/img695/1599/eset1l.jpg (<< klick) drücken.
- Firefox-User:
  Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
- IE-User:
  müssen das Installieren eines ActiveX Elements erlauben.
Setze den einen Haken bei Yes, i accept the Terms of Use.
Drücke den http://img707.imageshack.us/img707/687/starteg.jpg Button.
Warte bis die Komponenten herunter geladen wurden.
Setze einen Haken bei "Scan archives".
Gehe sicher das bei Remove Found Threats kein Hacken gesetzt ist.
http://img707.imageshack.us/img707/687/starteg.jpg drücken.
Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.

Wenn der Scan beendet wurde

Klicke Finish.
Browser schließen.

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und kopiere folgenden Text in das Ausführen Fenster.

Code:

"%PROGRAMFILES%\Eset\Eset Online Scanner\log.txt"

Hinweis: Falls du ein 64-Bit-Windows einsetzt, lautet der Pfad so:

Code:

"%PROGRAMFILES(X86)%\Eset\Eset Online Scanner\log.txt"

Poste nun den Inhalt der log.txt.

Okay, erst einmal vielen Dank.

Ich hoffe nur das temporäre abschalten meiner Firewall und Aviras hat mit nicht in den hinter gebissen.

Übrigens Avira hatte zwischen durch ein update gemacht da ich nur die Abwehrprogramme und Firewall abgeschaltet habe Avira selbst aber noch an war. Hoffe das macht keinen großen Unterschied

Auf jedenfall hier ist der Inhalt der Log datei.

Es sind zwei Suchdurchläufe weil ich beim ersten vergessen hatte den esetsmartinstaller als Administrator auszuführen:

Zitat:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=b200f29f0e317a488102ee69bd47d76f
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-06-28 12:58:40
# local_time=2012-06-28 02:58:40 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1792 16777215 100 0 22541993 22541993 0 0
# compatibility_mode=5893 16776574 100 94 28747576 92512043 0 0
# compatibility_mode=8192 67108863 100 0 142 142 0 0
# scanned=255870
# found=0
# cleaned=0
# scan_time=7468
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=b200f29f0e317a488102ee69bd47d76f
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-06-28 03:05:55
# local_time=2012-06-28 05:05:55 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode=1792 16777215 100 0 22549725 22549725 0 0
# compatibility_mode=5893 16776574 100 94 28755308 92519775 0 0
# compatibility_mode=8192 67108863 100 0 7874 7874 0 0
# scanned=255875
# found=0
# cleaned=0
# scan_time=7371

Ich habe übrigens auch die letzten zwei Tage lange die Desinfec't CD des C'T magazines auf meinen Rechner angewedent und weder Avira, Kapersky, ClamAV oder BitDefender konnten etwas finden.

Ich hoffe du kannst mir jetzt die letzte Gewissheit geben.

Ich warte dann auf deine Antwort. Nochmal vielen Dank.

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Du hattest nur all Programme abschalten gesagt, ich war mir nicht sicher ob das auch Avira beinhaltete oder nur die normal Programme. Wenn ja, sag es dann mach ich den Suchlauf nochmal.

Ach ja, ich hoffe es macht keine zu große Änderung aber ich habe die Angaben meines Namens als User durch *Name* ersetzt in da ich den nicht einfach groß im Internent sichtbar haben wollte. Ich habe zur sicherheit aber auch noch die orginal OTL.txt datai mit dem drin falls das so wichtig ist.

So mal sehen was du mir aus diesen Daten noch sagen kannst.

OTL Logfile:

Code:

OTL logfile created on: 6/29/2012 12:18:49 PM - Run 1

OTL by OldTimer - Version 3.2.53.0     Folder = C:\Users\*Name*\Desktop

 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3.25 Gb Total Physical Memory | 2.37 Gb Available Physical Memory | 72.91% Memory free

6.50 Gb Paging File | 5.40 Gb Available in Paging File | 83.16% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 900.41 Gb Total Space | 732.34 Gb Free Space | 81.33% Space Free | Partition Type: NTFS

Drive D: | 30.00 Gb Total Space | 12.52 Gb Free Space | 41.72% Space Free | Partition Type: NTFS

 

Computer Name: *Name* | User Name: *Name* | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012/06/29 12:16:51 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\*Name*\Desktop\OTL.exe

PRC - [2012/05/14 18:24:38 | 000,619,472 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe

PRC - [2012/05/14 18:24:38 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

PRC - [2012/05/14 18:24:38 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

PRC - [2012/05/14 18:24:38 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012/05/14 18:24:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2012/05/14 18:24:38 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2012/05/14 18:24:38 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2011/07/16 06:31:12 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2011/02/26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010/09/29 03:51:26 | 000,380,928 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe

PRC - [2010/09/29 03:50:58 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe

PRC - [2009/11/02 23:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe

PRC - [2009/07/14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012/06/14 11:22:23 | 011,824,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\84fbf353f91385690a3e4e982aa6930e\System.Web.ni.dll

MOD - [2012/06/14 11:22:01 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll

MOD - [2012/06/14 11:21:56 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll

MOD - [2012/05/13 03:27:21 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll

MOD - [2012/05/13 03:26:17 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll

MOD - [2012/05/13 03:26:14 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll

MOD - [2012/05/13 03:26:12 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll

MOD - [2012/05/13 03:26:05 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll

MOD - [2010/10/01 08:36:20 | 000,270,336 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

MOD - [2010/05/12 15:12:53 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll

MOD - [2010/05/12 15:12:50 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2009/11/02 23:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll

MOD - [2009/11/02 23:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012/05/19 02:04:55 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2012/05/14 18:24:38 | 000,619,472 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe -- (AntiVirFirewallService)

SRV - [2012/05/14 18:24:38 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)

SRV - [2012/05/14 18:24:38 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)

SRV - [2012/05/14 18:24:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012/05/14 18:24:38 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2010/10/11 22:30:15 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2010/09/29 03:50:58 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\BENJAM~1\AppData\Local\Temp\mdxgthkn.sys -- (mdxgthkn)

DRV - [2012/05/14 18:24:38 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2012/05/14 18:24:38 | 000,112,032 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avfwot.sys -- (avfwot)

DRV - [2012/05/14 18:24:38 | 000,091,968 | ---- | M] (Avira GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avfwim.sys -- (avfwim)

DRV - [2012/05/14 18:24:38 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2012/02/07 21:30:57 | 000,097,792 | ---- | M] (Protect Software GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ACEDRV05.sys -- (ACEDRV05)

DRV - [2012/01/07 20:16:56 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2012/01/07 20:16:55 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2011/10/11 15:05:48 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011/10/11 15:05:48 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010/09/29 04:25:14 | 006,472,192 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)

DRV - [2010/09/29 03:14:30 | 000,228,352 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)

DRV - [2010/09/24 14:46:24 | 000,102,416 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)

DRV - [2010/06/14 11:41:10 | 000,030,464 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbfilter.sys -- (usbfilter)

DRV - [2010/05/15 00:04:14 | 000,062,592 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\amd_sata.sys -- (amd_sata)

DRV - [2010/05/15 00:04:14 | 000,024,192 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\amd_xata.sys -- (amd_xata)

DRV - [2010/05/06 11:21:42 | 000,108,560 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV - [2010/03/10 04:03:50 | 000,014,392 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)

DRV - [2010/02/06 16:49:00 | 000,597,536 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su)

DRV - [2009/06/10 23:19:48 | 009,853,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com

IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\..\SearchScopes,DefaultScope = {C7FD346B-CF18-44A6-8A58-713C6A7DE869}

IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\..\SearchScopes\{C7FD346B-CF18-44A6-8A58-713C6A7DE869}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MDNA_enDE393

IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.update: false

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Eigene Programme\Mozilla Firefox\components [2012/06/16 22:16:16 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Eigene Programme\Mozilla Firefox\components [2012/06/16 22:16:16 | 000,000,000 | ---D | M]

 

[2011/04/22 12:30:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*Name*\AppData\Roaming\mozilla\Extensions

[2012/06/25 22:21:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*Name*\AppData\Roaming\mozilla\Firefox\Profiles\o042joyq.default\extensions

[2012/06/25 22:21:23 | 000,000,000 | ---D | M] (WOT) -- C:\Users\*Name*\AppData\Roaming\mozilla\Firefox\Profiles\o042joyq.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2012/05/31 14:32:55 | 000,505,801 | ---- | M] () (No name found) -- C:\USERS\*NAME*\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O042JOYQ.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI

[2012/01/06 12:08:02 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\*Name*\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O042JOYQ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

 

O1 HOSTS File: ([2009/06/10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found

O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O13 - gopher Prefix: missing

O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab (Office Genuine Advantage Validation Tool)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.10

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5426975B-F785-4627-B2B1-8176017CD259}: DhcpNameServer = 192.168.0.10

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B684A91E-4B96-4D09-AAC1-C3EC08A4A5ED}: DhcpNameServer = 192.168.0.10

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012/06/29 12:16:51 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\*Name*\Desktop\OTL.exe

[2012/06/28 21:40:09 | 002,322,184 | ---- | C] (ESET) -- C:\Users\*Name*\Desktop\esetsmartinstaller_enu.exe

[2012/06/25 20:24:50 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview

[2012/06/25 17:08:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/06/25 17:08:01 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012/06/22 13:40:54 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012/06/22 12:29:24 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2012

[2012/06/16 19:11:10 | 000,000,000 | ---D | C] -- C:\Users\*Name*\AppData\Local\capcom

[2012/06/11 02:09:17 | 000,000,000 | ---D | C] -- C:\Users\*Name*\AppData\Roaming\dvdcss

[2012/06/10 14:02:21 | 000,000,000 | ---D | C] -- C:\Users\*Name*\AppData\Local\PunkBuster

[2012/06/09 12:48:42 | 000,000,000 | ---D | C] -- C:\Users\*Name*\AppData\Roaming\TuneUp Software

[2012/06/09 12:47:31 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software

[2012/06/09 12:47:25 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files

[2012/06/09 12:47:25 | 000,000,000 | ---D | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}

[2012/06/03 20:18:07 | 000,000,000 | ---D | C] -- C:\Users\*Name*\AppData\Local\Microsoft Games

[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012/06/29 12:16:51 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\*Name*\Desktop\OTL.exe

[2012/06/29 11:59:05 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012/06/29 11:09:06 | 000,010,096 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012/06/29 11:09:06 | 000,010,096 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012/06/29 11:08:35 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012/06/29 11:08:35 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012/06/29 11:08:35 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012/06/29 11:08:35 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012/06/29 11:03:21 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012/06/29 11:01:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012/06/29 11:01:38 | 2616,684,544 | -HS- | M] () -- C:\hiberfil.sys

[2012/06/28 22:13:39 | 000,138,992 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2012/06/28 22:13:28 | 000,281,288 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr

[2012/06/28 21:40:10 | 002,322,184 | ---- | M] (ESET) -- C:\Users\*Name*\Desktop\esetsmartinstaller_enu.exe

[2012/06/28 10:55:46 | 000,000,018 | ---- | M] () -- C:\Users\*Name*\AppData\Roaming\mbam.context.scan

[2012/06/28 02:22:41 | 000,007,597 | ---- | M] () -- C:\Users\*Name*\AppData\Local\Resmon.ResmonCfg

[2012/06/28 01:05:36 | 000,281,288 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0

[2012/06/25 17:09:06 | 000,000,899 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012/06/23 03:12:44 | 000,000,000 | ---- | M] () -- C:\Windows\System32\GetInitReference()

[2012/06/14 11:20:53 | 000,304,400 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012/06/10 13:44:48 | 000,138,904 | ---- | M] () -- C:\Users\*Name*\AppData\Roaming\PnkBstrK.sys

[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012/06/28 10:55:19 | 000,000,018 | ---- | C] () -- C:\Users\*Name*\AppData\Roaming\mbam.context.scan

[2012/06/25 17:08:51 | 000,000,899 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012/06/23 03:12:44 | 000,000,000 | ---- | C] () -- C:\Windows\System32\GetInitReference()

[2012/06/10 13:44:48 | 000,138,992 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2012/06/10 13:44:32 | 000,281,288 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe

[2012/06/10 13:44:32 | 000,076,888 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe

[2012/01/07 20:16:56 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2012/01/07 20:16:55 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2011/12/09 03:18:24 | 000,138,904 | ---- | C] () -- C:\Users\*Name*\AppData\Roaming\PnkBstrK.sys

[2011/07/30 20:19:36 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll

[2011/07/30 17:21:46 | 000,007,597 | ---- | C] () -- C:\Users\*Name*\AppData\Local\Resmon.ResmonCfg

[2011/07/24 00:48:53 | 000,000,196 | ---- | C] () -- C:\Windows\System32\swkotor.ini

[2010/09/15 15:24:00 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2010/09/15 15:01:00 | 000,000,018 | ---- | C] () -- C:\Windows\System32\drivers\VERSION.DAT

[2010/09/15 13:12:24 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll

[2010/08/11 15:24:20 | 000,224,342 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

 
 ========== LOP Check ==========

 

[2011/04/22 12:43:52 | 000,000,000 | ---D | M] -- C:\Users\*Name*\AppData\Roaming\GHISLER

[2011/08/16 12:19:34 | 000,000,000 | ---D | M] -- C:\Users\*Name*\AppData\Roaming\LEGO Company

[2011/09/08 15:36:13 | 000,000,000 | ---D | M] -- C:\Users\*Name*\AppData\Roaming\OpenOffice.org

[2011/08/12 14:04:14 | 000,000,000 | ---D | M] -- C:\Users\*Name*\AppData\Roaming\ScummVM

[2012/06/09 12:48:42 | 000,000,000 | ---D | M] -- C:\Users\*Name*\AppData\Roaming\TuneUp Software

[2012/06/28 12:41:58 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < sceclt.dll >

 
 < ntelogon.dll >

 
 < winlogon.exe >

 
 < logevent.dll >

 
 < user32.DLL >

 
 < iaStor.sys >

 
 < nvstor.sys >

 
 < atapi.sys >

 
 < IdeChnDr.sys >

 
 < viasraid.sys >

 
 < AGP440.sys >

 
 < vaxscsi.sys >

 
 < nvatabus.sys >

 
 < viamraid.sys >

 
 < nvata.sys >

 
 < nvgts.sys >

 
 < iastorv.sys >

 
 < ViPrt.sys >

 
 < eNetHook.dll >

 
 < ahcix86.sys >

 
 < KR10N.sys >

 
 < nvstor32.sys >

 
 < ahcix86s.sys >

 
 < /md5stop >

Invalid Switch: md5stop

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 

< End of report >

--- --- ---

Beim CustomScan ist irgenwas schiefegegangen. Hast du den Text da richtig 1:1 kopiert und eingefügt?

Also das was ich da gepostet habe war der Inhalt der log.txt datei.

Ich habe aber zwei Text Datein erhalten. Einmal Log.txt und extra.txt.

Ist es vielleicht der Inhalt von der Anderen die du brauchst oder war es vielleicht der Avira der noch aktive war?

Soll ich den Test nochmal machen? Vielleicht hatte ich einen Fehler gemacht?

Was genau ist den schief gelaufen?

Edit:
Okay, ich habe einen zweiten Lauf gemacht diesmal ist dieß der Inhalt und es gibt dort nun eindeutig mehr Informationen aus dem Custom Scan:

OTL Logfile:

Code:

OTL logfile created on: 6/29/2012 3:41:11 PM - Run 2

OTL by OldTimer - Version 3.2.53.0     Folder = C:\Users\Name\Desktop

 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3.25 Gb Total Physical Memory | 1.96 Gb Available Physical Memory | 60.37% Memory free

6.50 Gb Paging File | 5.09 Gb Available in Paging File | 78.29% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 900.41 Gb Total Space | 731.99 Gb Free Space | 81.30% Space Free | Partition Type: NTFS

Drive D: | 30.00 Gb Total Space | 12.52 Gb Free Space | 41.72% Space Free | Partition Type: NTFS

 

Computer Name: NamesPC | User Name: Name | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012/06/29 12:16:51 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Name\Desktop\OTL.exe

PRC - [2012/06/16 22:16:16 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Eigene Programme\Mozilla Firefox\firefox.exe

PRC - [2012/05/14 18:24:38 | 000,619,472 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe

PRC - [2012/05/14 18:24:38 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

PRC - [2012/05/14 18:24:38 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

PRC - [2012/05/14 18:24:38 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012/05/14 18:24:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2012/05/14 18:24:38 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2012/05/14 18:24:38 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2011/07/16 06:31:12 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2011/02/26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010/09/29 03:51:26 | 000,380,928 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe

PRC - [2010/09/29 03:50:58 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe

PRC - [2009/11/02 23:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe

PRC - [2009/07/14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012/06/16 22:16:15 | 002,042,848 | ---- | M] () -- C:\Eigene Programme\Mozilla Firefox\mozjs.dll

MOD - [2012/06/14 11:22:23 | 011,824,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\84fbf353f91385690a3e4e982aa6930e\System.Web.ni.dll

MOD - [2012/06/14 11:22:01 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll

MOD - [2012/06/14 11:21:56 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll

MOD - [2012/05/13 03:27:21 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll

MOD - [2012/05/13 03:26:17 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll

MOD - [2012/05/13 03:26:14 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll

MOD - [2012/05/13 03:26:12 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll

MOD - [2012/05/13 03:26:05 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll

MOD - [2010/10/01 08:36:20 | 000,270,336 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

MOD - [2010/05/12 15:12:53 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll

MOD - [2010/05/12 15:12:50 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2009/11/02 23:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll

MOD - [2009/11/02 23:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012/05/19 02:04:55 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2012/05/14 18:24:38 | 000,619,472 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe -- (AntiVirFirewallService)

SRV - [2012/05/14 18:24:38 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)

SRV - [2012/05/14 18:24:38 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)

SRV - [2012/05/14 18:24:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012/05/14 18:24:38 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2010/10/11 22:30:15 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2010/09/29 03:50:58 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Name\AppData\Local\Temp\mdxgthkn.sys -- (mdxgthkn)

DRV - [2012/05/14 18:24:38 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2012/05/14 18:24:38 | 000,112,032 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avfwot.sys -- (avfwot)

DRV - [2012/05/14 18:24:38 | 000,091,968 | ---- | M] (Avira GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avfwim.sys -- (avfwim)

DRV - [2012/05/14 18:24:38 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2012/02/07 21:30:57 | 000,097,792 | ---- | M] (Protect Software GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ACEDRV05.sys -- (ACEDRV05)

DRV - [2012/01/07 20:16:56 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2012/01/07 20:16:55 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2011/10/11 15:05:48 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011/10/11 15:05:48 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010/09/29 04:25:14 | 006,472,192 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)

DRV - [2010/09/29 03:14:30 | 000,228,352 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)

DRV - [2010/09/24 14:46:24 | 000,102,416 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)

DRV - [2010/06/14 11:41:10 | 000,030,464 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbfilter.sys -- (usbfilter)

DRV - [2010/05/15 00:04:14 | 000,062,592 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\amd_sata.sys -- (amd_sata)

DRV - [2010/05/15 00:04:14 | 000,024,192 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\amd_xata.sys -- (amd_xata)

DRV - [2010/05/06 11:21:42 | 000,108,560 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV - [2010/03/10 04:03:50 | 000,014,392 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)

DRV - [2010/02/06 16:49:00 | 000,597,536 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su)

DRV - [2009/06/10 23:19:48 | 009,853,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com

IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\..\SearchScopes,DefaultScope = {C7FD346B-CF18-44A6-8A58-713C6A7DE869}

IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\..\SearchScopes\{C7FD346B-CF18-44A6-8A58-713C6A7DE869}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MDNA_enDE393

IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.update: false

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Eigene Programme\Mozilla Firefox\components [2012/06/16 22:16:16 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Eigene Programme\Mozilla Firefox\components [2012/06/16 22:16:16 | 000,000,000 | ---D | M]

 

[2011/04/22 12:30:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Name\AppData\Roaming\mozilla\Extensions

[2012/06/25 22:21:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Name\AppData\Roaming\mozilla\Firefox\Profiles\o042joyq.default\extensions

[2012/06/25 22:21:23 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Name\AppData\Roaming\mozilla\Firefox\Profiles\o042joyq.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2012/05/31 14:32:55 | 000,505,801 | ---- | M] () (No name found) -- C:\USERS\Name\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O042JOYQ.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI

[2012/01/06 12:08:02 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\Name\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O042JOYQ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

 

O1 HOSTS File: ([2009/06/10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found

O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)

O13 - gopher Prefix: missing

O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab (Office Genuine Advantage Validation Tool)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.10

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5426975B-F785-4627-B2B1-8176017CD259}: DhcpNameServer = 192.168.0.10

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B684A91E-4B96-4D09-AAC1-C3EC08A4A5ED}: DhcpNameServer = 192.168.0.10

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: BsScanner - Service

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: BsScanner - Service

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012/06/29 12:16:51 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Name\Desktop\OTL.exe

[2012/06/28 21:40:09 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Name\Desktop\esetsmartinstaller_enu.exe

[2012/06/25 20:24:50 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview

[2012/06/25 17:08:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/06/25 17:08:01 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012/06/22 13:40:54 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012/06/22 12:29:24 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2012

[2012/06/16 19:11:10 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\capcom

[2012/06/11 02:09:17 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Roaming\dvdcss

[2012/06/10 14:02:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\PunkBuster

[2012/06/09 12:48:42 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Roaming\TuneUp Software

[2012/06/09 12:47:31 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software

[2012/06/09 12:47:25 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files

[2012/06/09 12:47:25 | 000,000,000 | ---D | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}

[2012/06/03 20:18:07 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\Microsoft Games

[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012/06/29 14:59:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012/06/29 12:16:51 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Name\Desktop\OTL.exe

[2012/06/29 11:09:06 | 000,010,096 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012/06/29 11:09:06 | 000,010,096 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012/06/29 11:08:35 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012/06/29 11:08:35 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012/06/29 11:08:35 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012/06/29 11:08:35 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012/06/29 11:03:21 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012/06/29 11:01:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012/06/29 11:01:38 | 2616,684,544 | -HS- | M] () -- C:\hiberfil.sys

[2012/06/28 22:13:39 | 000,138,992 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2012/06/28 22:13:28 | 000,281,288 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr

[2012/06/28 21:40:10 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Name\Desktop\esetsmartinstaller_enu.exe

[2012/06/28 10:55:46 | 000,000,018 | ---- | M] () -- C:\Users\Name\AppData\Roaming\mbam.context.scan

[2012/06/28 02:22:41 | 000,007,597 | ---- | M] () -- C:\Users\Name\AppData\Local\Resmon.ResmonCfg

[2012/06/28 01:05:36 | 000,281,288 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0

[2012/06/25 17:09:06 | 000,000,899 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012/06/23 03:12:44 | 000,000,000 | ---- | M] () -- C:\Windows\System32\GetInitReference()

[2012/06/14 11:20:53 | 000,304,400 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012/06/10 13:44:48 | 000,138,904 | ---- | M] () -- C:\Users\Name\AppData\Roaming\PnkBstrK.sys

[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012/06/28 10:55:19 | 000,000,018 | ---- | C] () -- C:\Users\Name\AppData\Roaming\mbam.context.scan

[2012/06/25 17:08:51 | 000,000,899 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012/06/23 03:12:44 | 000,000,000 | ---- | C] () -- C:\Windows\System32\GetInitReference()

[2012/06/10 13:44:48 | 000,138,992 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2012/06/10 13:44:32 | 000,281,288 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe

[2012/06/10 13:44:32 | 000,076,888 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe

[2012/01/07 20:16:56 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2012/01/07 20:16:55 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2011/12/09 03:18:24 | 000,138,904 | ---- | C] () -- C:\Users\Name\AppData\Roaming\PnkBstrK.sys

[2011/07/30 20:19:36 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll

[2011/07/30 17:21:46 | 000,007,597 | ---- | C] () -- C:\Users\Name\AppData\Local\Resmon.ResmonCfg

[2011/07/24 00:48:53 | 000,000,196 | ---- | C] () -- C:\Windows\System32\swkotor.ini

[2010/09/15 15:24:00 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2010/09/15 15:01:00 | 000,000,018 | ---- | C] () -- C:\Windows\System32\drivers\VERSION.DAT

[2010/09/15 13:12:24 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll

[2010/08/11 15:24:20 | 000,224,342 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

 
 ========== LOP Check ==========

 

[2011/04/22 12:43:52 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\GHISLER

[2011/08/16 12:19:34 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\LEGO Company

[2011/09/08 15:36:13 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\OpenOffice.org

[2011/08/12 14:04:14 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\ScummVM

[2012/06/09 12:48:42 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\TuneUp Software

[2012/06/28 12:41:58 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011/04/21 15:27:26 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Adobe

[2011/04/21 14:34:30 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\ATI

[2011/10/11 15:15:02 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Avira

[2012/06/11 02:15:20 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\dvdcss

[2011/04/22 12:43:52 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\GHISLER

[2011/04/21 14:33:49 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Identities

[2011/07/21 21:59:53 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\InstallShield

[2011/08/16 12:19:34 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\LEGO Company

[2010/09/15 14:21:18 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Macromedia

[2011/07/25 13:34:51 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Malwarebytes

[2009/07/14 09:48:18 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Media Center Programs

[2012/06/22 12:44:24 | 000,000,000 | --SD | M] -- C:\Users\Name\AppData\Roaming\Microsoft

[2011/04/22 12:30:39 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Mozilla

[2011/09/08 15:36:13 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\OpenOffice.org

[2011/08/12 14:04:14 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\ScummVM

[2011/07/22 22:56:50 | 000,000,000 | RH-D | M] -- C:\Users\Name\AppData\Roaming\SecuROM

[2012/06/09 12:48:42 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\TuneUp Software

[2012/06/11 02:09:16 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\vlc

 
 < %APPDATA%\*.exe /s >

[2010/11/12 01:58:12 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Name\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys

[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys

[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys

 
 < MD5 for: AHCIX86S.SYS  >

[2007/11/14 19:44:42 | 000,129,552 | ---- | M] (Promise Technology, Inc.) MD5=58CB1FA96B24DFE2196548E959B1996B -- C:\ATI\Win7_Vista\8_741\Packages\Drivers\SBDrv\SB6xx\RAID\LH\ahcix86s.sys

[2007/11/14 19:44:42 | 000,129,552 | ---- | M] (Promise Technology, Inc.) MD5=58CB1FA96B24DFE2196548E959B1996B -- C:\ATI\Win7_Vista\8_782\Packages\Drivers\SBDrv\SB6xx\RAID\LH\ahcix86s.sys

[2009/10/26 19:41:10 | 000,189,496 | ---- | M] (Advanced Micro Devices, Inc) MD5=6C27F0A964EA98F457CAAB9A47030538 -- C:\ATI\Win7_Vista\8_741\Packages\Drivers\SBDrv\SB6xx\RAID\W7\ahcix86s.sys

[2009/10/26 19:41:10 | 000,189,496 | ---- | M] (Advanced Micro Devices, Inc) MD5=6C27F0A964EA98F457CAAB9A47030538 -- C:\ATI\Win7_Vista\8_782\Packages\Drivers\SBDrv\SB6xx\RAID\W7\ahcix86s.sys

 
 < MD5 for: ATAPI.SYS  >

[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys

[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys

[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll

[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2010/05/12 11:05:35 | 000,332,168 | ---- | M] (Intel Corporation) MD5=2D2918606673C46769FB516A5ACE958E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16592_none_aed9db9de9265a3a\iaStorV.sys

[2011/03/11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys

[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys

[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys

[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys

[2011/03/11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys

[2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys

[2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

[2010/11/20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys

[2011/03/11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys

[2010/05/12 11:20:41 | 000,332,160 | ---- | M] (Intel Corporation) MD5=FE8186428F0AB44F0E500C7AA33E9B51 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20712_none_afb9f9af020317a3\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010/11/20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll

[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll

[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2010/05/12 11:05:45 | 000,143,752 | ---- | M] (NVIDIA Corporation) MD5=1D8B6A440DFF2BDEAA4EB209FCBA21BF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16592_none_39a34c4d205d0412\nvstor.sys

[2011/03/11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys

[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys

[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys

[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys

[2011/03/11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys

[2011/03/11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys

[2010/11/20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys

[2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys

[2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

[2010/05/12 11:20:52 | 000,143,752 | ---- | M] (NVIDIA Corporation) MD5=F3596C8A63D3871890B0D3A0DFFEF0D0 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20712_none_3a836a5e3939c17b\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll

[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

[2010/11/20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009/07/14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll

[2009/07/14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

[2010/11/20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010/11/20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe

[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe

[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012/04/04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Eigene Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe

[2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009/10/28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2010/11/20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe

[2009/07/14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 

< End of report >

--- --- ---

Ist dies besser oder sollte ich es nochmal versuchen?

Hast du wirklich alles vom Text abkopiert? Da gibt es den Button alles markieren bzw. alles kopieren
Die letzte Zeile für den CustomScan lautet CREATERESTOREPOINT

Sorry. Ich habe einen Edit in meinen vorherigen Post gemacht nachdem ich einen zweiten lauf gemacht habe, wobei ich aufgepasst habe die letzte Zeile diesmal mit zu kopieren. Kannst du nachsehen ob das nun die richtigen Informationen sind?

Ja so ist richtig!! :daumenhoc

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Okay, habe ich erledigt.

Kann ich mir sicher sein das ich nichts auf meinen Rechner habe?

Ach ja, ... Schuldige die Skepsis aber was genau habe ich hier jetzt eigentlich gemacht und welche Auswirkungen hat es auf meine Einstellungen und System?

Hier ist das Ergebnis, wie vorher habe ich meinen Name entfernt.

Code:

All processes killed

========== OTL ==========

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\autoexec.bat moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Name

->Temp folder emptied: 281464 bytes

->Temporary Internet Files folder emptied: 30359116 bytes

->FireFox cache emptied: 57096884 bytes

->Flash cache emptied: 82689 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 56502 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 619520 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 74822 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 84.00 mb

 

 

[EMPTYFLASH]

 

User: All Users

 

User: Name

->Flash cache emptied: 0 bytes

 

User: Default

->Flash cache emptied: 0 bytes

 

User: Default User

->Flash cache emptied: 0 bytes

 

User: Public

 

Total Flash Files Cleaned = 0.00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.53.0 log created on 06302012_004619
 

Files\Folders moved on Reboot...
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Mir fällt auch gerade ein ich hatte vergessen wieder Scanne Alle Benutzer anzuklicken. Oder war das unnötig?

Auf jeden fall vielen Dank schonmal.

Beim Fix ist das egal, nur bei der Logerstellung ist das wichtig

Zitat:

Kann ich mir sicher sein das ich nichts auf meinen Rechner habe?

100% Sicherheit gibt es in keinem technischen Gerät - warum soll der Computer eine Ausnahme sein?

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Ich weiß das man sich nie 100% sicher sein kann, wer weiß vielleicht laufe ich auch mit irgendeinen Retrovirus im körper herum. Ich könnte mir auch nicht sicher sein wenn ich meine Rechner platt gemacht hätte und neu installiert.

Aber ich würde nun langsam gerne wissen was nun eigentlich das Ziel unserer Aktionen hier ist?

Sorry, ich möchte nicht undankbar klingen. Ich bin sehr Dankbar für deine Zeit, Aufmerksamkeit und Expertise mit der du mir hilfst, aber wie viel müssen wir noch machen und wofür?

Edit:Habe den Scan gemacht.

Hier ist das Ergebnis:

Code:

 16:37:03.0542 3424        TDSS rootkit removing tool 2.7.43.0 Jun 29 2012 17:54:22

16:37:03.0822 3424        ============================================================

16:37:03.0822 3424        Current date / time: 2012/07/01 16:37:03.0822

16:37:03.0822 3424        SystemInfo:

16:37:03.0822 3424        

16:37:03.0822 3424        OS Version: 6.1.7600 ServicePack: 0.0

16:37:03.0822 3424        Product type: Workstation

16:37:03.0822 3424        ComputerName: Name

16:37:03.0822 3424        UserName: Name

16:37:03.0822 3424        Windows directory: C:\Windows

16:37:03.0822 3424        System windows directory: C:\Windows

16:37:03.0822 3424        Processor architecture: Intel x86

16:37:03.0822 3424        Number of processors: 3

16:37:03.0822 3424        Page size: 0x1000

16:37:03.0822 3424        Boot type: Normal boot

16:37:03.0822 3424        ============================================================

16:37:04.0805 3424        Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

16:37:04.0821 3424        ============================================================

16:37:04.0821 3424        \Device\Harddisk0\DR0:

16:37:04.0821 3424        MBR partitions:

16:37:04.0821 3424        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000

16:37:04.0821 3424        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x708D3000

16:37:04.0821 3424        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x70906000, BlocksNum 0x3C00000

16:37:04.0821 3424        ============================================================

16:37:04.0852 3424        C: <-> \Device\Harddisk0\DR0\Partition1

16:37:04.0914 3424        D: <-> \Device\Harddisk0\DR0\Partition2

16:37:04.0914 3424        ============================================================

16:37:04.0914 3424        Initialize success

16:37:04.0914 3424        ============================================================

16:37:29.0328 4140        ============================================================

16:37:29.0328 4140        Scan started

16:37:29.0328 4140        Mode: Manual; SigCheck; TDLFS; 

16:37:29.0328 4140        ============================================================

16:37:31.0856 4140        1394ohci        (d01e0b1cef9ee82100c2bb07294880ef) C:\Windows\system32\DRIVERS\1394ohci.sys

16:37:32.0027 4140        1394ohci - ok

16:37:32.0058 4140        ACEDRV05        (0a1e97197609f92d2425b67da0bb0a7f) C:\Windows\system32\drivers\ACEDRV05.sys

16:37:32.0074 4140        ACEDRV05 ( UnsignedFile.Multi.Generic ) - warning

16:37:32.0074 4140        ACEDRV05 - detected UnsignedFile.Multi.Generic (1)

16:37:32.0121 4140        ACPI            (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys

16:37:32.0136 4140        ACPI - ok

16:37:32.0168 4140        AcpiPmi         (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys

16:37:32.0246 4140        AcpiPmi - ok

16:37:32.0324 4140        adp94xx         (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys

16:37:32.0355 4140        adp94xx - ok

16:37:32.0417 4140        adpahci         (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys

16:37:32.0448 4140        adpahci - ok

16:37:32.0495 4140        adpu320         (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys

16:37:32.0511 4140        adpu320 - ok

16:37:32.0542 4140        AeLookupSvc     (8b5eefeec1e6d1a72a06c526628ad161) C:\Windows\System32\aelupsvc.dll

16:37:32.0667 4140        AeLookupSvc - ok

16:37:32.0729 4140        AFD             (0db7a48388d54d154ebec120461a0fcd) C:\Windows\system32\drivers\afd.sys

16:37:32.0792 4140        AFD - ok

16:37:32.0823 4140        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys

16:37:32.0838 4140        agp440 - ok

16:37:32.0916 4140        aic78xx         (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys

16:37:32.0948 4140        aic78xx - ok

16:37:32.0979 4140        ALG             (18a54e132947cd98fea9accc57f98f13) C:\Windows\System32\alg.exe

16:37:33.0057 4140        ALG - ok

16:37:33.0088 4140        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys

16:37:33.0119 4140        aliide - ok

16:37:33.0150 4140        AMD External Events Utility (aa8c7a0a40d3b8992ea1845ef89fe2d4) C:\Windows\system32\atiesrxx.exe

16:37:33.0197 4140        AMD External Events Utility - ok

16:37:33.0228 4140        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys

16:37:33.0244 4140        amdagp - ok

16:37:33.0291 4140        amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys

16:37:33.0306 4140        amdide - ok

16:37:33.0353 4140        AmdK8           (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys

16:37:33.0431 4140        AmdK8 - ok

16:37:33.0977 4140        amdkmdag        (5ab10c74c8ea15e98a6c771b7269615e) C:\Windows\system32\DRIVERS\atikmdag.sys

16:37:34.0164 4140        amdkmdag - ok

16:37:34.0305 4140        amdkmdap        (e9890f7ec1ab4d09afeb09dd76334622) C:\Windows\system32\DRIVERS\atikmpag.sys

16:37:34.0336 4140        amdkmdap - ok

16:37:34.0383 4140        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys

16:37:34.0414 4140        AmdPPM - ok

16:37:34.0445 4140        amdsata         (19ce906b4cdc11fc4fef5745f33a63b6) C:\Windows\system32\drivers\amdsata.sys

16:37:34.0476 4140        amdsata - ok

16:37:34.0523 4140        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys

16:37:34.0539 4140        amdsbs - ok

16:37:34.0554 4140        amdxata         (869e67d66be326a5a9159fba8746fa70) C:\Windows\system32\drivers\amdxata.sys

16:37:34.0570 4140        amdxata - ok

16:37:34.0586 4140        amd_sata        (437c824deac935dea9e9c488675efd09) C:\Windows\system32\DRIVERS\amd_sata.sys

16:37:34.0617 4140        amd_sata - ok

16:37:34.0632 4140        amd_xata        (d919795612eabba7d5f5222377bebd7b) C:\Windows\system32\DRIVERS\amd_xata.sys

16:37:34.0648 4140        amd_xata - ok

16:37:34.0757 4140        AntiVirFirewallService (6acc11e9d2f01c88251123d26c1c5489) C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe

16:37:34.0804 4140        AntiVirFirewallService - ok

16:37:34.0882 4140        AntiVirMailService (b7fa28aefa586fb5a04876c7b31d03e6) C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

16:37:34.0913 4140        AntiVirMailService - ok

16:37:34.0976 4140        AntiVirSchedulerService (2e35310d600f4cc64624786a813a041e) C:\Program Files\Avira\AntiVir Desktop\sched.exe

16:37:35.0007 4140        AntiVirSchedulerService - ok

16:37:35.0069 4140        AntiVirService  (984102b9e2f6513008ed4e0c5ac4151d) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

16:37:35.0085 4140        AntiVirService - ok

16:37:35.0163 4140        AntiVirWebService (9bc7247fd7379307bcff92cf8eb64b87) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

16:37:35.0194 4140        AntiVirWebService - ok

16:37:35.0334 4140        AppID           (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys

16:37:35.0412 4140        AppID - ok

16:37:35.0459 4140        AppIDSvc        (62a9c86cb6085e20db4823e4e97826f5) C:\Windows\System32\appidsvc.dll

16:37:35.0553 4140        AppIDSvc - ok

16:37:35.0584 4140        Appinfo         (7dead9e3f65dcb2794f2711003bbf650) C:\Windows\System32\appinfo.dll

16:37:35.0646 4140        Appinfo - ok

16:37:35.0709 4140        arc             (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys

16:37:35.0740 4140        arc - ok

16:37:35.0756 4140        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys

16:37:35.0771 4140        arcsas - ok

16:37:35.0802 4140        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys

16:37:35.0927 4140        AsyncMac - ok

16:37:35.0958 4140        atapi           (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys

16:37:35.0974 4140        atapi - ok

16:37:36.0021 4140        AtiHDAudioService (c8b17ac82ad2ee9e0e58e3461008c5f7) C:\Windows\system32\drivers\AtihdW73.sys

16:37:36.0052 4140        AtiHDAudioService - ok

16:37:36.0099 4140        AtiHdmiService  (8df873d0587596c1d35a9cececc61da1) C:\Windows\system32\drivers\AtiHdmi.sys

16:37:36.0130 4140        AtiHdmiService - ok

16:37:36.0146 4140        AtiPcie         (4ffe74e33bd9170950116f0ca46eac89) C:\Windows\system32\DRIVERS\AtiPcie.sys

16:37:36.0161 4140        AtiPcie - ok

16:37:36.0255 4140        atksgt          (f0d933b42cd0594048e4d5200ae9e417) C:\Windows\system32\DRIVERS\atksgt.sys

16:37:36.0286 4140        atksgt - ok

16:37:36.0333 4140        AudioEndpointBuilder (510c873bfa135aa829f4180352772734) C:\Windows\System32\Audiosrv.dll

16:37:36.0380 4140        AudioEndpointBuilder - ok

16:37:36.0395 4140        Audiosrv        (510c873bfa135aa829f4180352772734) C:\Windows\System32\Audiosrv.dll

16:37:36.0411 4140        Audiosrv - ok

16:37:36.0473 4140        avfwim          (e6263cdd0ef3b98cfa2a251a21d8be2e) C:\Windows\system32\DRIVERS\avfwim.sys

16:37:36.0504 4140        avfwim - ok

16:37:36.0551 4140        avfwot          (48929a52c039738c3193581f7fc483a5) C:\Windows\system32\DRIVERS\avfwot.sys

16:37:36.0582 4140        avfwot - ok

16:37:36.0614 4140        avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\Windows\system32\DRIVERS\avgntflt.sys

16:37:36.0629 4140        avgntflt - ok

16:37:36.0660 4140        avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\Windows\system32\DRIVERS\avipbb.sys

16:37:36.0660 4140        avipbb - ok

16:37:36.0676 4140        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys

16:37:36.0692 4140        avkmgr - ok

16:37:36.0723 4140        AxInstSV        (dd6a431b43e34b91a767d1ce33728175) C:\Windows\System32\AxInstSV.dll

16:37:36.0832 4140        AxInstSV - ok

16:37:36.0894 4140        b06bdrv         (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys

16:37:36.0988 4140        b06bdrv - ok

16:37:37.0066 4140        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys

16:37:37.0097 4140        b57nd60x - ok

16:37:37.0128 4140        BDESVC          (ee1e9c3bb8228ae423dd38db69128e71) C:\Windows\System32\bdesvc.dll

16:37:37.0222 4140        BDESVC - ok

16:37:37.0238 4140        Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys

16:37:37.0300 4140        Beep - ok

16:37:37.0362 4140        BFE             (85ac71c045ceb054ed48a7841aae0c11) C:\Windows\System32\bfe.dll

16:37:37.0409 4140        BFE - ok

16:37:37.0472 4140        BITS            (53f476476f55a27f580661bde09c4ec4) C:\Windows\System32\qmgr.dll

16:37:37.0534 4140        BITS - ok

16:37:37.0581 4140        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys

16:37:37.0612 4140        blbdrive - ok

16:37:37.0643 4140        bowser          (9a5c671b7fbae4865149bb11f59b91b2) C:\Windows\system32\DRIVERS\bowser.sys

16:37:37.0706 4140        bowser - ok

16:37:37.0737 4140        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys

16:37:37.0752 4140        BrFiltLo - ok

16:37:37.0768 4140        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys

16:37:37.0799 4140        BrFiltUp - ok

16:37:37.0846 4140        Browser         (598e1280e7ff3744f4b8329366cc5635) C:\Windows\System32\browser.dll

16:37:37.0908 4140        Browser - ok

16:37:37.0940 4140        Brserid         (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys

16:37:38.0033 4140        Brserid - ok

16:37:38.0064 4140        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys

16:37:38.0096 4140        BrSerWdm - ok

16:37:38.0127 4140        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys

16:37:38.0158 4140        BrUsbMdm - ok

16:37:38.0174 4140        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys

16:37:38.0189 4140        BrUsbSer - ok

16:37:38.0220 4140        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys

16:37:38.0252 4140        BTHMODEM - ok

16:37:38.0283 4140        bthserv         (1df19c96eef6c29d1c3e1a8678e07190) C:\Windows\system32\bthserv.dll

16:37:38.0330 4140        bthserv - ok

16:37:38.0361 4140        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys

16:37:38.0392 4140        cdfs - ok

16:37:38.0423 4140        cdrom           (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys

16:37:38.0439 4140        cdrom - ok

16:37:38.0470 4140        CertPropSvc     (628a9e30ec5e18dd5de6be4dbdc12198) C:\Windows\System32\certprop.dll

16:37:38.0517 4140        CertPropSvc - ok

16:37:38.0532 4140        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys

16:37:38.0579 4140        circlass - ok

16:37:38.0610 4140        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys

16:37:38.0626 4140        CLFS - ok

16:37:38.0720 4140        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

16:37:38.0735 4140        clr_optimization_v2.0.50727_32 - ok

16:37:38.0813 4140        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

16:37:38.0891 4140        clr_optimization_v4.0.30319_32 - ok

16:37:38.0922 4140        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys

16:37:38.0938 4140        CmBatt - ok

16:37:38.0954 4140        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys

16:37:38.0969 4140        cmdide - ok

16:37:39.0016 4140        CNG             (36c252e474b2ffa0f0fbbff20d92a640) C:\Windows\system32\Drivers\cng.sys

16:37:39.0078 4140        CNG - ok

16:37:39.0110 4140        Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys

16:37:39.0125 4140        Compbatt - ok

16:37:39.0141 4140        CompositeBus    (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys

16:37:39.0172 4140        CompositeBus - ok

16:37:39.0188 4140        COMSysApp - ok

16:37:39.0219 4140        crcdisk         (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys

16:37:39.0234 4140        crcdisk - ok

16:37:39.0281 4140        CryptSvc        (520a108a2657f4bca7fced9ca7d885de) C:\Windows\system32\cryptsvc.dll

16:37:39.0359 4140        CryptSvc - ok

16:37:39.0406 4140        DcomLaunch      (b82cd39e336973359d7c9bf911e8e84f) C:\Windows\system32\rpcss.dll

16:37:39.0453 4140        DcomLaunch - ok

16:37:39.0484 4140        defragsvc       (8d6e10a2d9a5eed59562d9b82cf804e1) C:\Windows\System32\defragsvc.dll

16:37:39.0546 4140        defragsvc - ok

16:37:39.0578 4140        DfsC            (83d1ecea8faae75604c0fa49ac7ad996) C:\Windows\system32\Drivers\dfsc.sys

16:37:39.0624 4140        DfsC - ok

16:37:39.0687 4140        Dhcp            (c56495fbd770712367cad35e5de72da6) C:\Windows\system32\dhcpcore.dll

16:37:39.0765 4140        Dhcp - ok

16:37:39.0780 4140        discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys

16:37:39.0858 4140        discache - ok

16:37:39.0905 4140        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys

16:37:39.0936 4140        Disk - ok

16:37:39.0968 4140        Dnscache        (b15be77a2bacf9c3177d27518afe26a9) C:\Windows\System32\dnsrslvr.dll

16:37:40.0030 4140        Dnscache - ok

16:37:40.0077 4140        dot3svc         (4408c85c21eea48eb0ce486baeef0502) C:\Windows\System32\dot3svc.dll

16:37:40.0124 4140        dot3svc - ok

16:37:40.0155 4140        DPS             (7fa81c6e11caa594adb52084da73a1e5) C:\Windows\system32\dps.dll

16:37:40.0186 4140        DPS - ok

16:37:40.0217 4140        drmkaud         (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys

16:37:40.0233 4140        drmkaud - ok

16:37:40.0280 4140        DXGKrnl         (1679a4669326cb1a67cc95658d273234) C:\Windows\System32\drivers\dxgkrnl.sys

16:37:40.0311 4140        DXGKrnl - ok

16:37:40.0326 4140        EapHost         (8600142fa91c1b96367d3300ad0f3f3a) C:\Windows\System32\eapsvc.dll

16:37:40.0358 4140        EapHost - ok

16:37:40.0826 4140        ebdrv           (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys

16:37:40.0966 4140        ebdrv - ok

16:37:41.0060 4140        EFS             (c2243ff9e9aad0c30e8b1a0914da15b6) C:\Windows\System32\lsass.exe

16:37:41.0122 4140        EFS - ok

16:37:41.0216 4140        ehRecvr         (1697c39978cd69f6fbc15302edcece1f) C:\Windows\ehome\ehRecvr.exe

16:37:41.0294 4140        ehRecvr - ok

16:37:41.0309 4140        ehSched         (d389bff34f80caede417bf9d1507996a) C:\Windows\ehome\ehsched.exe

16:37:41.0387 4140        ehSched - ok

16:37:41.0496 4140        elxstor         (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys

16:37:41.0528 4140        elxstor - ok

16:37:41.0559 4140        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys

16:37:41.0574 4140        ErrDev - ok

16:37:41.0621 4140        EventSystem     (f6916efc29d9953d5d0df06882ae8e16) C:\Windows\system32\es.dll

16:37:41.0668 4140        EventSystem - ok

16:37:41.0715 4140        exfat           (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys

16:37:41.0777 4140        exfat - ok

16:37:41.0808 4140        fastfat         (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys

16:37:41.0840 4140        fastfat - ok

16:37:41.0933 4140        Fax             (f7ea23cc5e6bf2181f3f399d54f6efc1) C:\Windows\system32\fxssvc.exe

16:37:42.0011 4140        Fax - ok

16:37:42.0058 4140        fdc             (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys

16:37:42.0105 4140        fdc - ok

16:37:42.0136 4140        fdPHost         (f3222c893bd2f5821a0179e5c71e88fb) C:\Windows\system32\fdPHost.dll

16:37:42.0198 4140        fdPHost - ok

16:37:42.0230 4140        FDResPub        (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\Windows\system32\fdrespub.dll

16:37:42.0261 4140        FDResPub - ok

16:37:42.0292 4140        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys

16:37:42.0292 4140        FileInfo - ok

16:37:42.0308 4140        Filetrace       (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys

16:37:42.0339 4140        Filetrace - ok

16:37:42.0370 4140        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys

16:37:42.0386 4140        flpydisk - ok

16:37:42.0401 4140        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys

16:37:42.0417 4140        FltMgr - ok

16:37:42.0495 4140        FontCache       (7fe4995528a7529a761875151ee3d512) C:\Windows\system32\FntCache.dll

16:37:42.0588 4140        FontCache - ok

16:37:42.0635 4140        FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

16:37:42.0698 4140        FontCache3.0.0.0 - ok

16:37:42.0729 4140        FsDepends       (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys

16:37:42.0760 4140        FsDepends - ok

16:37:42.0791 4140        Fs_Rec          (500a9814fd9446a8126858a5a7f7d273) C:\Windows\system32\drivers\Fs_Rec.sys

16:37:42.0791 4140        Fs_Rec - ok

16:37:42.0838 4140        fvevol          (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys

16:37:42.0869 4140        fvevol - ok

16:37:42.0885 4140        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys

16:37:42.0900 4140        gagp30kx - ok

16:37:42.0963 4140        gpsvc           (8ba3c04702bf8f927ab36ae8313ca4ee) C:\Windows\System32\gpsvc.dll

16:37:43.0010 4140        gpsvc - ok

16:37:43.0088 4140        gupdate         (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe

16:37:43.0103 4140        gupdate - ok

16:37:43.0134 4140        gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe

16:37:43.0166 4140        gupdatem - ok

16:37:43.0197 4140        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys

16:37:43.0275 4140        hcw85cir - ok

16:37:43.0322 4140        HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys

16:37:43.0384 4140        HdAudAddService - ok

16:37:43.0415 4140        HDAudBus        (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys

16:37:43.0446 4140        HDAudBus - ok

16:37:43.0478 4140        HidBatt         (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys

16:37:43.0493 4140        HidBatt - ok

16:37:43.0524 4140        HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys

16:37:43.0556 4140        HidBth - ok

16:37:43.0587 4140        HidIr           (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys

16:37:43.0618 4140        HidIr - ok

16:37:43.0649 4140        hidserv         (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\Windows\system32\hidserv.dll

16:37:43.0696 4140        hidserv - ok

16:37:43.0727 4140        HidUsb          (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys

16:37:43.0758 4140        HidUsb - ok

16:37:43.0790 4140        hkmsvc          (741c2a45ca8407e374aaba3e330b7872) C:\Windows\system32\kmsvc.dll

16:37:43.0852 4140        hkmsvc - ok

16:37:43.0883 4140        HomeGroupListener (a768ca158bb06782a2835b907f4873c3) C:\Windows\system32\ListSvc.dll

16:37:43.0977 4140        HomeGroupListener - ok

16:37:44.0024 4140        HomeGroupProvider (fb08dec5ef43d0c66d83b8e9694e7549) C:\Windows\system32\provsvc.dll

16:37:44.0055 4140        HomeGroupProvider - ok

16:37:44.0086 4140        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys

16:37:44.0102 4140        HpSAMD - ok

16:37:44.0180 4140        HTTP            (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys

16:37:44.0258 4140        HTTP - ok

16:37:44.0273 4140        hwpolicy        (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys

16:37:44.0289 4140        hwpolicy - ok

16:37:44.0336 4140        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys

16:37:44.0382 4140        i8042prt - ok

16:37:44.0445 4140        iaStorV         (71f1a494fedf4b33c02c4a6a28d6d9e9) C:\Windows\system32\drivers\iaStorV.sys

16:37:44.0476 4140        iaStorV - ok

16:37:44.0585 4140        IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

16:37:44.0648 4140        IDriverT ( UnsignedFile.Multi.Generic ) - warning

16:37:44.0648 4140        IDriverT - detected UnsignedFile.Multi.Generic (1)

16:37:44.0788 4140        idsvc           (5af815eb5bc9802e5a064e2ba62bfc0c) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

16:37:44.0897 4140        idsvc - ok

16:37:45.0022 4140        iirsp           (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys

16:37:45.0053 4140        iirsp - ok

16:37:45.0116 4140        IKEEXT          (fac0ee6562b121b1399d6e855583f7a5) C:\Windows\System32\ikeext.dll

16:37:45.0162 4140        IKEEXT - ok

16:37:45.0459 4140        IntcAzAudAddService (4be85cf5831a41104c2dded55fbc3565) C:\Windows\system32\drivers\RTKVHDA.sys

16:37:45.0537 4140        IntcAzAudAddService - ok

16:37:45.0802 4140        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys

16:37:45.0818 4140        intelide - ok

16:37:45.0880 4140        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys

16:37:45.0911 4140        intelppm - ok

16:37:45.0958 4140        IPBusEnum       (acb364b9075a45c0736e5c47be5cae19) C:\Windows\system32\ipbusenum.dll

16:37:46.0020 4140        IPBusEnum - ok

16:37:46.0052 4140        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys

16:37:46.0083 4140        IpFilterDriver - ok

16:37:46.0161 4140        iphlpsvc        (477397b432a256a50ee7e4339eb9ea14) C:\Windows\System32\iphlpsvc.dll

16:37:46.0208 4140        iphlpsvc - ok

16:37:46.0239 4140        IPMIDRV         (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys

16:37:46.0254 4140        IPMIDRV - ok

16:37:46.0286 4140        IPNAT           (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys

16:37:46.0317 4140        IPNAT - ok

16:37:46.0364 4140        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys

16:37:46.0410 4140        IRENUM - ok

16:37:46.0442 4140        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys

16:37:46.0457 4140        isapnp - ok

16:37:46.0488 4140        iScsiPrt        (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys

16:37:46.0504 4140        iScsiPrt - ok

16:37:46.0520 4140        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys

16:37:46.0535 4140        kbdclass - ok

16:37:46.0566 4140        kbdhid          (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys

16:37:46.0598 4140        kbdhid - ok

16:37:46.0613 4140        KeyIso          (c2243ff9e9aad0c30e8b1a0914da15b6) C:\Windows\system32\lsass.exe

16:37:46.0629 4140        KeyIso - ok

16:37:46.0644 4140        KSecDD          (0263364acb9c834ace52fb85c2c064ec) C:\Windows\system32\Drivers\ksecdd.sys

16:37:46.0644 4140        KSecDD - ok

16:37:46.0676 4140        KSecPkg         (27391db553be2a4e2b0adeea2873b2af) C:\Windows\system32\Drivers\ksecpkg.sys

16:37:46.0707 4140        KSecPkg - ok

16:37:46.0769 4140        KtmRm           (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\Windows\system32\msdtckrm.dll

16:37:46.0816 4140        KtmRm - ok

16:37:46.0847 4140        LanmanServer    (8f6bf790d3168224c16f2af68a84438c) C:\Windows\system32\srvsvc.dll

16:37:46.0894 4140        LanmanServer - ok

16:37:46.0925 4140        LanmanWorkstation (b9891f885dcf1f0513a51cb58493cb1f) C:\Windows\System32\wkssvc.dll

16:37:46.0988 4140        LanmanWorkstation - ok

16:37:47.0050 4140        lirsgt          (f8a7212d0864ef5e9185fb95e6623f4d) C:\Windows\system32\DRIVERS\lirsgt.sys

16:37:47.0081 4140        lirsgt - ok

16:37:47.0112 4140        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys

16:37:47.0144 4140        lltdio - ok

16:37:47.0222 4140        lltdsvc         (5700673e13a2117fa3b9020c852c01e2) C:\Windows\System32\lltdsvc.dll

16:37:47.0300 4140        lltdsvc - ok

16:37:47.0300 4140        lmhosts         (55ca01ba19d0006c8f2639b6c045e08b) C:\Windows\System32\lmhsvc.dll

16:37:47.0346 4140        lmhosts - ok

16:37:47.0378 4140        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys

16:37:47.0393 4140        LSI_FC - ok

16:37:47.0409 4140        LSI_SAS         (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys

16:37:47.0424 4140        LSI_SAS - ok

16:37:47.0456 4140        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys

16:37:47.0487 4140        LSI_SAS2 - ok

16:37:47.0518 4140        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys

16:37:47.0565 4140        LSI_SCSI - ok

16:37:47.0580 4140        luafv           (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys

16:37:47.0627 4140        luafv - ok

16:37:47.0674 4140        MBAMProtector   (fb097bbc1a18f044bd17bd2fccf97865) C:\Windows\system32\drivers\mbam.sys

16:37:47.0690 4140        MBAMProtector - ok

16:37:47.0846 4140        MBAMService     (ba400ed640bca1eae5c727ae17c10207) C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamservice.exe

16:37:47.0892 4140        MBAMService - ok

16:37:47.0970 4140        Mcx2Svc         (e2b0887816ed336685954e3d8fdaa51d) C:\Windows\system32\Mcx2Svc.dll

16:37:47.0986 4140        Mcx2Svc - ok

16:37:48.0064 4140        mdxgthkn - ok

16:37:48.0095 4140        megasas         (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys

16:37:48.0126 4140        megasas - ok

16:37:48.0158 4140        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys

16:37:48.0173 4140        MegaSR - ok

16:37:48.0204 4140        MMCSS           (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll

16:37:48.0251 4140        MMCSS - ok

16:37:48.0267 4140        Modem           (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys

16:37:48.0282 4140        Modem - ok

16:37:48.0314 4140        monitor         (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys

16:37:48.0345 4140        monitor - ok

16:37:48.0360 4140        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys

16:37:48.0392 4140        mouclass - ok

16:37:48.0438 4140        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys

16:37:48.0485 4140        mouhid - ok

16:37:48.0501 4140        mountmgr        (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys

16:37:48.0516 4140        mountmgr - ok

16:37:48.0548 4140        mpio            (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys

16:37:48.0563 4140        mpio - ok

16:37:48.0579 4140        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys

16:37:48.0610 4140        mpsdrv - ok

16:37:48.0672 4140        MpsSvc          (5cd996cecf45cbc3e8d109c86b82d69e) C:\Windows\system32\mpssvc.dll

16:37:48.0719 4140        MpsSvc - ok

16:37:48.0750 4140        MRxDAV          (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys

16:37:48.0766 4140        MRxDAV - ok

16:37:48.0813 4140        mrxsmb          (ca7570e42522e24324a12161db14ec02) C:\Windows\system32\DRIVERS\mrxsmb.sys

16:37:48.0875 4140        mrxsmb - ok

16:37:48.0922 4140        mrxsmb10        (f965c3ab2b2ae5c378f4562486e35051) C:\Windows\system32\DRIVERS\mrxsmb10.sys

16:37:48.0984 4140        mrxsmb10 - ok

16:37:49.0016 4140        mrxsmb20        (25c38264a3c72594dd21d355d70d7a5d) C:\Windows\system32\DRIVERS\mrxsmb20.sys

16:37:49.0047 4140        mrxsmb20 - ok

16:37:49.0078 4140        msahci          (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys

16:37:49.0078 4140        msahci - ok

16:37:49.0125 4140        msdsm           (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys

16:37:49.0140 4140        msdsm - ok

16:37:49.0172 4140        MSDTC           (e1bce74a3bd9902b72599c0192a07e27) C:\Windows\System32\msdtc.exe

16:37:49.0187 4140        MSDTC - ok

16:37:49.0218 4140        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys

16:37:49.0265 4140        Msfs - ok

16:37:49.0265 4140        mshidkmdf       (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys

16:37:49.0296 4140        mshidkmdf - ok

16:37:49.0328 4140        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys

16:37:49.0328 4140        msisadrv - ok

16:37:49.0359 4140        MSiSCSI         (90f7d9e6b6f27e1a707d4a297f077828) C:\Windows\system32\iscsiexe.dll

16:37:49.0390 4140        MSiSCSI - ok

16:37:49.0390 4140        msiserver - ok

16:37:49.0437 4140        MSKSSRV         (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys

16:37:49.0484 4140        MSKSSRV - ok

16:37:49.0499 4140        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys

16:37:49.0530 4140        MSPCLOCK - ok

16:37:49.0562 4140        MSPQM           (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys

16:37:49.0577 4140        MSPQM - ok

16:37:49.0608 4140        MsRPC           (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys

16:37:49.0608 4140        MsRPC - ok

16:37:49.0640 4140        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys

16:37:49.0655 4140        mssmbios - ok

16:37:49.0686 4140        MSTEE           (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys

16:37:49.0702 4140        MSTEE - ok

16:37:49.0733 4140        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys

16:37:49.0764 4140        MTConfig - ok

16:37:49.0796 4140        Mup             (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys

16:37:49.0811 4140        Mup - ok

16:37:49.0842 4140        napagent        (80284f1985c70c86f0b5f86da2dfe1df) C:\Windows\system32\qagentRT.dll

16:37:49.0889 4140        napagent - ok

16:37:49.0936 4140        NativeWifiP     (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys

16:37:49.0983 4140        NativeWifiP - ok

16:37:50.0076 4140        NDIS            (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys

16:37:50.0123 4140        NDIS - ok

16:37:50.0154 4140        NdisCap         (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys

16:37:50.0201 4140        NdisCap - ok

16:37:50.0232 4140        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys

16:37:50.0279 4140        NdisTapi - ok

16:37:50.0295 4140        Ndisuio         (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys

16:37:50.0326 4140        Ndisuio - ok

16:37:50.0342 4140        NdisWan         (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys

16:37:50.0373 4140        NdisWan - ok

16:37:50.0388 4140        NDProxy         (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys

16:37:50.0420 4140        NDProxy - ok

16:37:50.0435 4140        Net Driver HPZ12 (a081cb6fb9a12668f233eb5414be3a0e) C:\Windows\system32\HPZinw12.dll

16:37:50.0466 4140        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning

16:37:50.0466 4140        Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)

16:37:50.0482 4140        NetBIOS         (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys

16:37:50.0560 4140        NetBIOS - ok

16:37:50.0591 4140        NetBT           (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys

16:37:50.0622 4140        NetBT - ok

16:37:50.0654 4140        Netlogon        (c2243ff9e9aad0c30e8b1a0914da15b6) C:\Windows\system32\lsass.exe

16:37:50.0654 4140        Netlogon - ok

16:37:50.0700 4140        Netman          (7cccfca7510684768da22092d1fa4db2) C:\Windows\System32\netman.dll

16:37:50.0747 4140        Netman - ok

16:37:50.0778 4140        netprofm        (8c338238c16777a802d6a9211eb2ba50) C:\Windows\System32\netprofm.dll

16:37:50.0810 4140        netprofm - ok

16:37:50.0888 4140        NetTcpPortSharing (fe2aa5a684b0dd9b1fae57b7817c198b) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

16:37:50.0919 4140        NetTcpPortSharing - ok

16:37:50.0934 4140        nfrd960         (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys

16:37:50.0950 4140        nfrd960 - ok

16:37:50.0981 4140        NlaSvc          (2226496e34bd40734946a054b1cd657f) C:\Windows\System32\nlasvc.dll

16:37:51.0012 4140        NlaSvc - ok

16:37:51.0028 4140        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys

16:37:51.0075 4140        Npfs - ok

16:37:51.0090 4140        nsi             (ba387e955e890c8a88306d9b8d06bf17) C:\Windows\system32\nsisvc.dll

16:37:51.0106 4140        nsi - ok

16:37:51.0137 4140        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys

16:37:51.0168 4140        nsiproxy - ok

16:37:51.0262 4140        Ntfs            (187002ce05693c306f43c873f821381f) C:\Windows\system32\drivers\Ntfs.sys

16:37:51.0293 4140        Ntfs - ok

16:37:51.0418 4140        Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys

16:37:51.0480 4140        Null - ok

16:37:52.0245 4140        nvlddmkm        (b0881dda5a8160422561ffab7f0008b1) C:\Windows\system32\DRIVERS\nvlddmkm.sys

16:37:52.0479 4140        nvlddmkm - ok

16:37:52.0619 4140        nvraid          (f1b0bed906f97e16f6d0c3629d2f21c6) C:\Windows\system32\drivers\nvraid.sys

16:37:52.0650 4140        nvraid - ok

16:37:52.0682 4140        nvstor          (4520b63899e867f354ee012d34e11536) C:\Windows\system32\drivers\nvstor.sys

16:37:52.0728 4140        nvstor - ok

16:37:52.0760 4140        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys

16:37:52.0775 4140        nv_agp - ok

16:37:52.0806 4140        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys

16:37:52.0853 4140        ohci1394 - ok

16:37:52.0900 4140        p2pimsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll

16:37:52.0994 4140        p2pimsvc - ok

16:37:53.0072 4140        p2psvc          (59c3ddd501e39e006dac31bf55150d91) C:\Windows\system32\p2psvc.dll

16:37:53.0103 4140        p2psvc - ok

16:37:53.0134 4140        Parport         (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys

16:37:53.0150 4140        Parport - ok

16:37:53.0181 4140        partmgr         (66d3415c159741ade7038a277efff99f) C:\Windows\system32\drivers\partmgr.sys

16:37:53.0196 4140        partmgr - ok

16:37:53.0212 4140        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys

16:37:53.0243 4140        Parvdm - ok

16:37:53.0274 4140        PcaSvc          (358ab7956d3160000726574083dfc8a6) C:\Windows\System32\pcasvc.dll

16:37:53.0290 4140        PcaSvc - ok

16:37:53.0321 4140        pci             (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys

16:37:53.0352 4140        pci - ok

16:37:53.0368 4140        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys

16:37:53.0368 4140        pciide - ok

16:37:53.0399 4140        pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys

16:37:53.0446 4140        pcmcia - ok

16:37:53.0462 4140        pcw             (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys

16:37:53.0477 4140        pcw - ok

16:37:53.0540 4140        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys

16:37:53.0586 4140        PEAUTH - ok

16:37:53.0696 4140        pla             (9c1bff7910c89a1d12e57343475840cb) C:\Windows\system32\pla.dll

16:37:53.0742 4140        pla - ok

16:37:53.0898 4140        PlugPlay        (71def5ec79774c798342d0ea16e41780) C:\Windows\system32\umpnpmgr.dll

16:37:53.0961 4140        PlugPlay - ok

16:37:54.0008 4140        Pml Driver HPZ12 (65bc271f337637731d3c71455ae1f476) C:\Windows\system32\HPZipm12.dll

16:37:54.0039 4140        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning

16:37:54.0039 4140        Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)

16:37:54.0117 4140        PnkBstrA        (3a2e85f7d90d15460c337ce80c2e3b29) C:\Windows\system32\PnkBstrA.exe

16:37:54.0148 4140        PnkBstrA - ok

16:37:54.0179 4140        PNRPAutoReg     (63ff8572611249931eb16bb8eed6afc8) C:\Windows\system32\pnrpauto.dll

16:37:54.0195 4140        PNRPAutoReg - ok

16:37:54.0226 4140        PNRPsvc         (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll

16:37:54.0242 4140        PNRPsvc - ok

16:37:54.0304 4140        PolicyAgent     (48e1b75c6dc0232fd92baae4bd344721) C:\Windows\System32\ipsecsvc.dll

16:37:54.0366 4140        PolicyAgent - ok

16:37:54.0398 4140        Power           (dbff83f709a91049621c1d35dd45c92c) C:\Windows\system32\umpo.dll

16:37:54.0429 4140        Power - ok

16:37:54.0491 4140        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys

16:37:54.0554 4140        PptpMiniport - ok

16:37:54.0585 4140        Processor       (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys

16:37:54.0616 4140        Processor - ok

16:37:54.0647 4140        ProfSvc         (aea3bdbdba667aa6f678cb38907e4f5e) C:\Windows\system32\profsvc.dll

16:37:54.0741 4140        ProfSvc - ok

16:37:54.0756 4140        ProtectedStorage (c2243ff9e9aad0c30e8b1a0914da15b6) C:\Windows\system32\lsass.exe

16:37:54.0788 4140        ProtectedStorage - ok

16:37:54.0834 4140        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys

16:37:54.0897 4140        Psched - ok

16:37:54.0944 4140        PSI_SVC_2       (a6a7ad767bf5141665f5c675f671b3e1) c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

16:37:54.0975 4140        PSI_SVC_2 - ok

16:37:55.0084 4140        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys

16:37:55.0115 4140        ql2300 - ok

16:37:55.0256 4140        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys

16:37:55.0287 4140        ql40xx - ok

16:37:55.0318 4140        QWAVE           (31ac809e7707eb580b2bdb760390765a) C:\Windows\system32\qwave.dll

16:37:55.0349 4140        QWAVE - ok

16:37:55.0380 4140        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys

16:37:55.0427 4140        QWAVEdrv - ok

16:37:55.0427 4140        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys

16:37:55.0474 4140        RasAcd - ok

16:37:55.0505 4140        RasAgileVpn     (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys

16:37:55.0536 4140        RasAgileVpn - ok

16:37:55.0568 4140        RasAuto         (a60f1839849c0c00739787fd5ec03f13) C:\Windows\System32\rasauto.dll

16:37:55.0599 4140        RasAuto - ok

16:37:55.0630 4140        Rasl2tp         (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys

16:37:55.0692 4140        Rasl2tp - ok

16:37:55.0724 4140        RasMan          (0ce66ec736b7fc526d78f7624c7d2a94) C:\Windows\System32\rasmans.dll

16:37:55.0770 4140        RasMan - ok

16:37:55.0802 4140        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys

16:37:55.0817 4140        RasPppoe - ok

16:37:55.0864 4140        RasSstp         (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys

16:37:55.0911 4140        RasSstp - ok

16:37:55.0942 4140        rdbss           (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys

16:37:55.0973 4140        rdbss - ok

16:37:55.0989 4140        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys

16:37:56.0004 4140        rdpbus - ok

16:37:56.0036 4140        RDPCDD          (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys

16:37:56.0098 4140        RDPCDD - ok

16:37:56.0129 4140        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys

16:37:56.0160 4140        RDPENCDD - ok

16:37:56.0176 4140        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys

16:37:56.0207 4140        RDPREFMP - ok

16:37:56.0254 4140        RDPWD           (c5b8d47a4688de9d335204ea757c2240) C:\Windows\system32\drivers\RDPWD.sys

16:37:56.0332 4140        RDPWD - ok

16:37:56.0379 4140        rdyboost        (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys

16:37:56.0394 4140        rdyboost - ok

16:37:56.0410 4140        RemoteAccess    (7b5e1419717fac363a31cc302895217a) C:\Windows\System32\mprdim.dll

16:37:56.0457 4140        RemoteAccess - ok

16:37:56.0488 4140        RemoteRegistry  (cb9a8683f4ef2bf99e123d79950d7935) C:\Windows\system32\regsvc.dll

16:37:56.0519 4140        RemoteRegistry - ok

16:37:56.0535 4140        RpcEptMapper    (78d072f35bc45d9e4e1b61895c152234) C:\Windows\System32\RpcEpMap.dll

16:37:56.0566 4140        RpcEptMapper - ok

16:37:56.0597 4140        RpcLocator      (94d36c0e44677dd26981d2bfeef2a29d) C:\Windows\system32\locator.exe

16:37:56.0613 4140        RpcLocator - ok

16:37:56.0644 4140        RpcSs           (b82cd39e336973359d7c9bf911e8e84f) C:\Windows\system32\rpcss.dll

16:37:56.0675 4140        RpcSs - ok

16:37:56.0706 4140        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys

16:37:56.0722 4140        rspndr - ok

16:37:56.0769 4140        RTL8167         (0516998076ad894ae7e362c3110aa071) C:\Windows\system32\DRIVERS\Rt86win7.sys

16:37:56.0784 4140        RTL8167 - ok

16:37:56.0847 4140        RTL8192su       (740fd26a79655a90e60b4e752bef0fe3) C:\Windows\system32\DRIVERS\RTL8192su.sys

16:37:56.0909 4140        RTL8192su - ok

16:37:56.0925 4140        SamSs           (c2243ff9e9aad0c30e8b1a0914da15b6) C:\Windows\system32\lsass.exe

16:37:56.0940 4140        SamSs - ok

16:37:56.0972 4140        sbp2port        (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys

16:37:56.0987 4140        sbp2port - ok

16:37:57.0018 4140        SCardSvr        (8fc518ffe9519c2631d37515a68009c4) C:\Windows\System32\SCardSvr.dll

16:37:57.0050 4140        SCardSvr - ok

16:37:57.0065 4140        scfilter        (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys

16:37:57.0096 4140        scfilter - ok

16:37:57.0159 4140        Schedule        (df1e5c82e4d09cf8105cc644980c4803) C:\Windows\system32\schedsvc.dll

16:37:57.0206 4140        Schedule - ok

16:37:57.0221 4140        SCPolicySvc     (628a9e30ec5e18dd5de6be4dbdc12198) C:\Windows\System32\certprop.dll

16:37:57.0237 4140        SCPolicySvc - ok

16:37:57.0268 4140        SDRSVC          (5fd90abdbfaee85986802622cbb03446) C:\Windows\System32\SDRSVC.dll

16:37:57.0330 4140        SDRSVC - ok

16:37:57.0362 4140        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

16:37:57.0408 4140        secdrv - ok

16:37:57.0440 4140        seclogon        (a59b3a4442c52060cc7a85293aa3546f) C:\Windows\system32\seclogon.dll

16:37:57.0471 4140        seclogon - ok

16:37:57.0533 4140        SENS            (dcb7fcdcc97f87360f75d77425b81737) C:\Windows\System32\sens.dll

16:37:57.0596 4140        SENS - ok

16:37:57.0611 4140        SensrSvc        (50087fe1ee447009c9cc2997b90de53f) C:\Windows\system32\sensrsvc.dll

16:37:57.0689 4140        SensrSvc - ok

16:37:57.0720 4140        Serenum         (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys

16:37:57.0767 4140        Serenum - ok

16:37:57.0798 4140        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys

16:37:57.0845 4140        Serial - ok

16:37:57.0876 4140        sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys

16:37:57.0892 4140        sermouse - ok

16:37:57.0923 4140        SessionEnv      (8f55ce568c543d5adf45c409d16718fc) C:\Windows\system32\sessenv.dll

16:37:57.0970 4140        SessionEnv - ok

16:37:57.0986 4140        sffdisk         (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys

16:37:58.0017 4140        sffdisk - ok

16:37:58.0048 4140        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys

16:37:58.0079 4140        sffp_mmc - ok

16:37:58.0110 4140        sffp_sd         (a0708bbd07d245c06ff9de549ca47185) C:\Windows\system32\DRIVERS\sffp_sd.sys

16:37:58.0142 4140        sffp_sd - ok

16:37:58.0188 4140        sfloppy         (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys

16:37:58.0220 4140        sfloppy - ok

16:37:58.0282 4140        SharedAccess    (d1a079a0de2ea524513b6930c24527a2) C:\Windows\System32\ipnathlp.dll

16:37:58.0329 4140        SharedAccess - ok

16:37:58.0376 4140        ShellHWDetection (cd2e48fa5b29ee2b3b5858056d246ef2) C:\Windows\System32\shsvcs.dll

16:37:58.0422 4140        ShellHWDetection - ok

16:37:58.0454 4140        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys

16:37:58.0469 4140        sisagp - ok

16:37:58.0500 4140        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys

16:37:58.0516 4140        SiSRaid2 - ok

16:37:58.0547 4140        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys

16:37:58.0563 4140        SiSRaid4 - ok

16:37:58.0610 4140        Smb             (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys

16:37:58.0688 4140        Smb - ok

16:37:58.0719 4140        SNMPTRAP        (6a984831644eca1a33ffeae4126f4f37) C:\Windows\System32\snmptrap.exe

16:37:58.0734 4140        SNMPTRAP - ok

16:37:58.0766 4140        spldr           (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys

16:37:58.0781 4140        spldr - ok

16:37:58.0828 4140        Spooler         (d1bb750eb51694de183e08b9c33be5b2) C:\Windows\System32\spoolsv.exe

16:37:58.0875 4140        Spooler - ok

16:37:59.0171 4140        sppsvc          (4c287f9069fedbd791178876ee9de536) C:\Windows\system32\sppsvc.exe

16:37:59.0296 4140        sppsvc - ok

16:37:59.0405 4140        sppuinotify     (d8e3e19eebdab49dd4a8d3062ead4ec7) C:\Windows\system32\sppuinotify.dll

16:37:59.0468 4140        sppuinotify - ok

16:37:59.0530 4140        srv             (c4a027b8c0bd3fc0699f41fa5e9e0c87) C:\Windows\system32\DRIVERS\srv.sys

16:37:59.0608 4140        srv - ok

16:37:59.0639 4140        srv2            (414bb592cad8a79649d01f9d94318fb3) C:\Windows\system32\DRIVERS\srv2.sys

16:37:59.0686 4140        srv2 - ok

16:37:59.0717 4140        srvnet          (ff207d67700aa18242aaf985d3e7d8f4) C:\Windows\system32\DRIVERS\srvnet.sys

16:37:59.0733 4140        srvnet - ok

16:37:59.0764 4140        SSDPSRV         (d887c9fd02ac9fa880f6e5027a43e118) C:\Windows\System32\ssdpsrv.dll

16:37:59.0811 4140        SSDPSRV - ok

16:37:59.0826 4140        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys

16:37:59.0842 4140        ssmdrv - ok

16:37:59.0858 4140        SstpSvc         (d318f23be45d5e3a107469eb64815b50) C:\Windows\system32\sstpsvc.dll

16:37:59.0889 4140        SstpSvc - ok

16:37:59.0967 4140        Steam Client Service - ok

16:37:59.0998 4140        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys

16:38:00.0014 4140        stexstor - ok

16:38:00.0076 4140        StiSvc          (a22825e7bb7018e8af3e229a5af17221) C:\Windows\System32\wiaservc.dll

16:38:00.0154 4140        StiSvc - ok

16:38:00.0170 4140        swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys

16:38:00.0185 4140        swenum - ok

16:38:00.0232 4140        swprv           (a28bd92df340e57b024ba433165d34d7) C:\Windows\System32\swprv.dll

16:38:00.0279 4140        swprv - ok

16:38:00.0372 4140        SysMain         (04105c8da62353589c29bdaeb8d88bd8) C:\Windows\system32\sysmain.dll

16:38:00.0404 4140        SysMain - ok

16:38:00.0435 4140        TabletInputService (fcfb6c552fbc0da299799cbd50ad9fd4) C:\Windows\System32\TabSvc.dll

16:38:00.0466 4140        TabletInputService - ok

16:38:00.0497 4140        TapiSrv         (2f46b0c70a4adc8c90cf825da3b4feaf) C:\Windows\System32\tapisrv.dll

16:38:00.0513 4140        TapiSrv - ok

16:38:00.0544 4140        TBS             (b799d9fdb26111737f58288d8dc172d9) C:\Windows\System32\tbssvc.dll

16:38:00.0591 4140        TBS - ok

16:38:00.0762 4140        Tcpip           (55e9965552741f3850cb22cbba9671ed) C:\Windows\system32\drivers\tcpip.sys

16:38:00.0809 4140        Tcpip - ok

16:38:01.0059 4140        TCPIP6          (55e9965552741f3850cb22cbba9671ed) C:\Windows\system32\DRIVERS\tcpip.sys

16:38:01.0090 4140        TCPIP6 - ok

16:38:01.0199 4140        tcpipreg        (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys

16:38:01.0277 4140        tcpipreg - ok

16:38:01.0308 4140        TDPIPE          (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys

16:38:01.0371 4140        TDPIPE - ok

16:38:01.0418 4140        TDTCP           (7156308896d34ea75a582f9a09e50c17) C:\Windows\system32\drivers\tdtcp.sys

16:38:01.0449 4140        TDTCP - ok

16:38:01.0464 4140        tdx             (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys

16:38:01.0496 4140        tdx - ok

16:38:01.0527 4140        TermDD          (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys

16:38:01.0527 4140        TermDD - ok

16:38:01.0605 4140        TermService     (a01e50a04d7b1960b33e92b9080e6a94) C:\Windows\System32\termsrv.dll

16:38:01.0667 4140        TermService - ok

16:38:01.0683 4140        Themes          (42fb6afd6b79d9fe07381609172e7ca4) C:\Windows\system32\themeservice.dll

16:38:01.0698 4140        Themes - ok

16:38:01.0730 4140        THREADORDER     (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll

16:38:01.0761 4140        THREADORDER - ok

16:38:01.0776 4140        TrkWks          (4792c0378db99a9bc2ae2de6cfff0c3a) C:\Windows\System32\trkwks.dll

16:38:01.0839 4140        TrkWks - ok

16:38:01.0901 4140        TrustedInstaller (41a4c781d2286208d397d72099304133) C:\Windows\servicing\TrustedInstaller.exe

16:38:01.0948 4140        TrustedInstaller - ok

16:38:01.0979 4140        tssecsrv        (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys

16:38:02.0057 4140        tssecsrv - ok

16:38:02.0104 4140        tunnel          (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys

16:38:02.0166 4140        tunnel - ok

16:38:02.0198 4140        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys

16:38:02.0213 4140        uagp35 - ok

16:38:02.0244 4140        udfs            (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys

16:38:02.0322 4140        udfs - ok

16:38:02.0354 4140        UI0Detect       (8344fd4fce927880aa1aa7681d4927e5) C:\Windows\system32\UI0Detect.exe

16:38:02.0385 4140        UI0Detect - ok

16:38:02.0416 4140        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys

16:38:02.0416 4140        uliagpkx - ok

16:38:02.0447 4140        umbus           (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys

16:38:02.0463 4140        umbus - ok

16:38:02.0494 4140        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys

16:38:02.0525 4140        UmPass - ok

16:38:02.0619 4140        upnphost        (833fbb672460efce8011d262175fad33) C:\Windows\System32\upnphost.dll

16:38:02.0666 4140        upnphost - ok

16:38:02.0697 4140        usbccgp         (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\drivers\usbccgp.sys

16:38:02.0759 4140        usbccgp - ok

16:38:03.0180 4140        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys

16:38:03.0227 4140        usbcir - ok

16:38:03.0258 4140        usbehci         (e4c436d914768ce965d5e659ba7eebd8) C:\Windows\system32\DRIVERS\usbehci.sys

16:38:03.0321 4140        usbehci - ok

16:38:03.0352 4140        usbfilter       (fb0e8b624d1f7e214edb3d6e56b4ec88) C:\Windows\system32\DRIVERS\usbfilter.sys

16:38:03.0383 4140        usbfilter - ok

16:38:03.0414 4140        usbhub          (bdcd7156ec37448f08633fd899823620) C:\Windows\system32\DRIVERS\usbhub.sys

16:38:03.0477 4140        usbhub - ok

16:38:03.0492 4140        usbohci         (eb2d819a639015253c871cda09d91d58) C:\Windows\system32\DRIVERS\usbohci.sys

16:38:03.0524 4140        usbohci - ok

16:38:03.0555 4140        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys

16:38:03.0586 4140        usbprint - ok

16:38:03.0617 4140        USBSTOR         (694c991cd0b8138888f086da6009adbc) C:\Windows\system32\DRIVERS\USBSTOR.SYS

16:38:03.0695 4140        USBSTOR - ok

16:38:03.0711 4140        usbuhci         (22480bf4e5a09192e5e30ba4dde79fa4) C:\Windows\system32\drivers\usbuhci.sys

16:38:03.0742 4140        usbuhci - ok

16:38:03.0773 4140        UxSms           (081e6e1c91aec36758902a9f727cd23c) C:\Windows\System32\uxsms.dll

16:38:03.0804 4140        UxSms - ok

16:38:03.0820 4140        VaultSvc        (c2243ff9e9aad0c30e8b1a0914da15b6) C:\Windows\system32\lsass.exe

16:38:03.0820 4140        VaultSvc - ok

16:38:03.0851 4140        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys

16:38:03.0867 4140        vdrvroot - ok

16:38:03.0914 4140        vds             (8c4e7c49d3641bc9e299e466a7f8867d) C:\Windows\System32\vds.exe

16:38:03.0945 4140        vds - ok

16:38:03.0992 4140        vga             (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys

16:38:04.0023 4140        vga - ok

16:38:04.0054 4140        VgaSave         (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys

16:38:04.0085 4140        VgaSave - ok

16:38:04.0116 4140        vhdmp           (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys

16:38:04.0132 4140        vhdmp - ok

16:38:04.0163 4140        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys

16:38:04.0163 4140        viaagp - ok

16:38:04.0194 4140        ViaC7           (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys

16:38:04.0194 4140        ViaC7 - ok

16:38:04.0226 4140        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys

16:38:04.0241 4140        viaide - ok

16:38:04.0257 4140        volmgr          (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys

16:38:04.0257 4140        volmgr - ok

16:38:04.0304 4140        volmgrx         (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys

16:38:04.0335 4140        volmgrx - ok

16:38:04.0366 4140        volsnap         (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys

16:38:04.0397 4140        volsnap - ok

16:38:04.0428 4140        vsmraid         (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys

16:38:04.0460 4140        vsmraid - ok

16:38:04.0569 4140        VSS             (7ea2bcd94d9cfaf4c556f5cc94532a6c) C:\Windows\system32\vssvc.exe

16:38:04.0631 4140        VSS - ok

16:38:04.0662 4140        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys

16:38:04.0678 4140        vwifibus - ok

16:38:04.0694 4140        vwififlt        (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys

16:38:04.0709 4140        vwififlt - ok

16:38:04.0756 4140        W32Time         (55187fd710e27d5095d10a472c8baf1c) C:\Windows\system32\w32time.dll

16:38:04.0787 4140        W32Time - ok

16:38:04.0803 4140        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys

16:38:04.0818 4140        WacomPen - ok

16:38:04.0850 4140        WANARP          (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys

16:38:04.0896 4140        WANARP - ok

16:38:04.0896 4140        Wanarpv6        (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys

16:38:04.0912 4140        Wanarpv6 - ok

16:38:05.0052 4140        WatAdminSvc     (353a04c273ec58475d8633e75ccd5604) C:\Windows\system32\Wat\WatAdminSvc.exe

16:38:05.0099 4140        WatAdminSvc - ok

16:38:05.0318 4140        wbengine        (7790b77fe1e5ee47dcc66247095bb4c9) C:\Windows\system32\wbengine.exe

16:38:05.0458 4140        wbengine - ok

16:38:05.0489 4140        WbioSrvc        (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\Windows\System32\wbiosrvc.dll

16:38:05.0520 4140        WbioSrvc - ok

16:38:05.0552 4140        wcncsvc         (6d9b75275c3e3a5f51aef81affadb2b6) C:\Windows\System32\wcncsvc.dll

16:38:05.0598 4140        wcncsvc - ok

16:38:05.0630 4140        WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\Windows\System32\WcsPlugInService.dll

16:38:05.0708 4140        WcsPlugInService - ok

16:38:05.0754 4140        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys

16:38:05.0786 4140        Wd - ok

16:38:05.0848 4140        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys

16:38:05.0879 4140        Wdf01000 - ok

16:38:05.0895 4140        WdiServiceHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll

16:38:05.0926 4140        WdiServiceHost - ok

16:38:05.0926 4140        WdiSystemHost   (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll

16:38:05.0942 4140        WdiSystemHost - ok

16:38:05.0973 4140        WebClient       (bb5ec38f8d4600119b4720bc5d4211f1) C:\Windows\System32\webclnt.dll

16:38:06.0035 4140        WebClient - ok

16:38:06.0066 4140        Wecsvc          (760f0afe937a77cff27153206534f275) C:\Windows\system32\wecsvc.dll

16:38:06.0113 4140        Wecsvc - ok

16:38:06.0129 4140        wercplsupport   (ac804569bb2364fb6017370258a4091b) C:\Windows\System32\wercplsupport.dll

16:38:06.0160 4140        wercplsupport - ok

16:38:06.0191 4140        WerSvc          (08e420d873e4fd85241ee2421b02c4a4) C:\Windows\System32\WerSvc.dll

16:38:06.0207 4140        WerSvc - ok

16:38:06.0238 4140        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys

16:38:06.0285 4140        WfpLwf - ok

16:38:06.0316 4140        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys

16:38:06.0332 4140        WIMMount - ok

16:38:06.0441 4140        WinDefend       (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll

16:38:06.0488 4140        WinDefend - ok

16:38:06.0488 4140        WinHttpAutoProxySvc - ok

16:38:06.0550 4140        Winmgmt         (f62e510b6ad4c21eb9fe8668ed251826) C:\Windows\system32\wbem\WMIsvc.dll

16:38:06.0612 4140        Winmgmt - ok

16:38:06.0706 4140        WinRM           (c4f5d3901d1b41d602ddc196e0b95b51) C:\Windows\system32\WsmSvc.dll

16:38:06.0737 4140        WinRM - ok

16:38:06.0800 4140        Wlansvc         (16935c98ff639d185086a3529b1f2067) C:\Windows\System32\wlansvc.dll

16:38:06.0831 4140        Wlansvc - ok

16:38:06.0909 4140        wlcrasvc        (6067acef367e79914af628fa1e9b5330) C:\Program Files\Windows Live\Mesh\wlcrasvc.exe

16:38:06.0940 4140        wlcrasvc - ok

16:38:07.0143 4140        wlidsvc         (0a70f4022ec2e14c159efc4f69aa2477) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

16:38:07.0190 4140        wlidsvc - ok

16:38:07.0315 4140        WmiAcpi         (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys

16:38:07.0361 4140        WmiAcpi - ok

16:38:07.0424 4140        wmiApSrv        (6eb6b66517b048d87dc1856ddf1f4c3f) C:\Windows\system32\wbem\WmiApSrv.exe

16:38:07.0471 4140        wmiApSrv - ok

16:38:07.0627 4140        WMPNetworkSvc   (77fbd400984cf72ba0fc4b3489d65f74) C:\Program Files\Windows Media Player\wmpnetwk.exe

16:38:07.0736 4140        WMPNetworkSvc - ok

16:38:07.0861 4140        WPCSvc          (a2f0ec770a92f2b3f9de6d518e11409c) C:\Windows\System32\wpcsvc.dll

16:38:07.0939 4140        WPCSvc - ok

16:38:07.0970 4140        WPDBusEnum      (b7f658a2ebc07129538ad9ab35212637) C:\Windows\system32\wpdbusenum.dll

16:38:08.0048 4140        WPDBusEnum - ok

16:38:08.0095 4140        ws2ifsl         (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys

16:38:08.0157 4140        ws2ifsl - ok

16:38:08.0173 4140        wscsvc          (a661a76333057b383a06e65f0073222f) C:\Windows\System32\wscsvc.dll

16:38:08.0204 4140        wscsvc - ok

16:38:08.0204 4140        WSearch - ok

16:38:08.0407 4140        wuauserv        (fc3ec24fce372c89423e015a2ac1a31e) C:\Windows\system32\wuaueng.dll

16:38:08.0453 4140        wuauserv - ok

16:38:08.0578 4140        WudfPf          (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys

16:38:08.0641 4140        WudfPf - ok

16:38:08.0672 4140        WUDFRd          (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys

16:38:08.0719 4140        WUDFRd - ok

16:38:08.0750 4140        wudfsvc         (ddee3682fe97037c45f4d7ab467cb8b6) C:\Windows\System32\WUDFSvc.dll

16:38:08.0781 4140        wudfsvc - ok

16:38:08.0812 4140        WwanSvc         (ff2d745b560f7c71b31f30f4d49f73d2) C:\Windows\System32\wwansvc.dll

16:38:08.0843 4140        WwanSvc - ok

16:38:08.0875 4140        MBR (0x1B8)     (4624822e540ec83cd0819525c65846ba) \Device\Harddisk0\DR0

16:38:11.0324 4140        \Device\Harddisk0\DR0 - ok

16:38:11.0324 4140        Boot (0x1200)   (58dce7f82636db6c7e9db6ece2538b58) \Device\Harddisk0\DR0\Partition0

16:38:11.0324 4140        \Device\Harddisk0\DR0\Partition0 - ok

16:38:11.0371 4140        Boot (0x1200)   (97f7cf239436882d20a672eabe986f93) \Device\Harddisk0\DR0\Partition1

16:38:11.0371 4140        \Device\Harddisk0\DR0\Partition1 - ok

16:38:11.0417 4140        Boot (0x1200)   (a549e879ecbf85aa75f70ed669e492c8) \Device\Harddisk0\DR0\Partition2

16:38:11.0417 4140        \Device\Harddisk0\DR0\Partition2 - ok

16:38:11.0417 4140        ============================================================

16:38:11.0417 4140        Scan finished

16:38:11.0417 4140        ============================================================

16:38:11.0433 4004        Detected object count: 4

16:38:11.0433 4004        Actual detected object count: 4

16:38:19.0327 4004        ACEDRV05 ( UnsignedFile.Multi.Generic ) - skipped by user

16:38:19.0327 4004        ACEDRV05 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:38:19.0327 4004        IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

16:38:19.0327 4004        IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:38:19.0327 4004        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user

16:38:19.0327 4004        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:38:19.0327 4004        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user

16:38:19.0327 4004        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:38:28.0499 2872        Deinitialize success

Erneut verzeihe meine Skepsis. Vielen Dank für deine Zeit.

Zitat:

Aber ich würde nun langsam gerne wissen was nun eigentlich das Ziel unserer Aktionen hier ist?

Ist das nicht zu erkennen?
Eine Analyse ist nicht mit einem Tool getan. Und die Entfernung auch nicht wenn da da was sein sollte

Wir können auch einfach an dieser Stelle Schluss machen, denn bisher hab ich keine weiteren Hinweise auf Schädlinge und du fühlst dich eh nicht sehr wohl dabei :pfeiff:

Nochmal verzei mir, aber es ist nun eine Woche her und jedes mal wenn wir einen neun Scan machen fühle ich als würde mein Herz stehen bleiben, weil doch irgend etwas sein könnte.

Machen wir einfach weiter und vergessen wir meinen kurzen Ausbruch okay? Ich weiß du machst das alles hier in deiner freihen Zeit und aus gutem Willen.

Habe meinen log oben in einen Edit gepostet.