Trojaner-Board - Rootkit Befall C:\Windows\Installer

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Rootkit Befall C:\Windows\Installer (https://www.trojaner-board.de/118677-rootkit-befall-c-windows-installer.html)

Rootkit Befall C:\Windows\Installer

Hallo hab leider auch ein Virus/Malware befall der sich nicht so einfach behebn lässt kommt leider immer wieder. Habe Trend Micro Worry Free Business Security. Habe wie beschrieben die Scans gemacht ich hoffe Ihr könnt mir weiter helfen wäre euch sehr verbunden! Vielen Dank

Malware Suchlauf

Code:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.07.06.05
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421
 
 

06.07.2012 10:16:14

mbam-log-2012-07-06 (10-16-14).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 282884

Laufzeit: 15 Minute(n), 54 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\Windows\Installer\{8e502152-de86-1bfc-007c-735ec5e0b309}\U\800000cb.@ (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

ESET Online Scanner

Code:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner64.ocx - registred OK

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=617a774777f55a499e50a80b2f7fe838

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-07-06 09:30:38

# local_time=2012-07-06 11:30:38 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=512 16777215 100 0 5190827 5190827 0 0

# compatibility_mode=5893 16776574 66 94 23757125 93193691 0 0

# compatibility_mode=8192 67108863 100 0 107 107 0 0

# scanned=413996

# found=1

# cleaned=0

# scan_time=3197

C:\Windows\Installer\{8e502152-de86-1bfc-007c-735ec5e0b309}\U\80000000.@        Win64/Sirefef.AL trojan (unable to clean)        00000000000000000000000000000000        I

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Hallo anbei die logs die ich gefunden habe!

Code:

2012/07/06 13:39:34 +0200        xxx        yyy        MESSAGE        Executing scheduled update:  Daily

2012/07/06 13:39:35 +0200        xxx        yyy        MESSAGE        Database already up-to-date

2012/07/06 13:39:35 +0200        xxx        yyy        MESSAGE        Starting protection

2012/07/06 13:39:36 +0200        xxx        yyy        MESSAGE        Protection started successfully

2012/07/06 13:39:39 +0200        xxx        yyy        MESSAGE        Starting IP protection

2012/07/06 13:39:39 +0200        xxx        yyy        ERROR        IP protection failed:  FwpmEngineOpen0 failed with error code 1753

2012/07/06 14:00:58 +0200        xxx        yyy        DETECTION        C:\Windows\Installer\{8e502152-de86-1bfc-007c-735ec5e0b309}\U\800000cb.@        Rootkit.0Access        QUARANTINE

2012/07/06 14:05:02 +0200        xxx        yyy        DETECTION        C:\Windows\Installer\{8e502152-de86-1bfc-007c-735ec5e0b309}\U\800000cb.@        Rootkit.0Access        DENY

Code:

2012/07/09 08:11:00 +0200        xxxx        yyyyyy        MESSAGE        Starting protection

2012/07/09 08:11:02 +0200        xxxx        yyyyyy        MESSAGE        Protection started successfully

2012/07/09 08:11:05 +0200        xxxx        yyyyyy        MESSAGE        Starting IP protection

2012/07/09 08:11:05 +0200        xxxx        yyyyyy        ERROR        IP protection failed:  FwpmEngineOpen0 failed with error code 1753

2012/07/09 08:25:23 +0200        xxxx        yyyyyy        DETECTION        C:\Users\yyyyyy\AppData\Local\Temp\992883.exe        RootKit.0Access        QUARANTINE

2012/07/09 08:50:02 +0200        xxxx        yyyyyy        MESSAGE        Starting protection

2012/07/09 08:50:04 +0200        xxxx        yyyyyy        MESSAGE        Protection started successfully

2012/07/09 08:50:07 +0200        xxxx        yyyyyy        MESSAGE        Starting IP protection

2012/07/09 08:50:07 +0200        xxxx        yyyyyy        ERROR        IP protection failed:  FwpmEngineOpen0 failed with error code 1753

Nur diese Protections-Logs oder auch normale Scanlogs?
Wie oft hast du Malwarebytes scannen lassen?

ja da waren nur diese Logs. Eigentlich hab ichs jetz des erste mal scannen lassen und seitdem Läuft es halt nebenbei mit.

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Zitat:

Zitat von cosinus (Beitrag 860197)

zu 1.
Ja Windows funktuniert einwandfrei mein Antivirus poppt nur all 10 min auf mit der Malware warnung
2. Im Startmenü scheint auch alles normal zu sein und sieht auch nicht so aus als würde etwas fehlen

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hier der Log!

OTL Logfile:

Code:

OTL logfile created on: 09.07.2012 16:36:25 - Run 3

OTL by OldTimer - Version 3.2.53.1     Folder = C:\Users\user\Desktop

64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

5,98 Gb Total Physical Memory | 4,49 Gb Available Physical Memory | 75,07% Memory free

11,96 Gb Paging File | 10,45 Gb Available in Paging File | 87,39% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 107,13 Gb Total Space | 52,33 Gb Free Space | 48,85% Space Free | Partition Type: NTFS

Drive D: | 465,76 Gb Total Space | 401,87 Gb Free Space | 86,28% Space Free | Partition Type: NTFS

Drive K: | 2793,81 Gb Total Space | 972,33 Gb Free Space | 34,80% Space Free | Partition Type: NTFS

Drive L: | 2793,81 Gb Total Space | 972,33 Gb Free Space | 34,80% Space Free | Partition Type: NTFS

Drive M: | 2793,81 Gb Total Space | 972,33 Gb Free Space | 34,80% Space Free | Partition Type: NTFS

Drive P: | 2793,81 Gb Total Space | 972,33 Gb Free Space | 34,80% Space Free | Partition Type: NTFS

Drive R: | 2793,81 Gb Total Space | 972,33 Gb Free Space | 34,80% Space Free | Partition Type: NTFS

Drive S: | 2793,81 Gb Total Space | 972,33 Gb Free Space | 34,80% Space Free | Partition Type: NTFS

Drive X: | 48,83 Gb Total Space | 7,70 Gb Free Space | 15,78% Space Free | Partition Type: NTFS

 

Computer Name: PCUSER | User Name: user | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\user\AppData\Local\Temp\DAT1BE9.tmp.exe (HLBS Tech (P) Limited)

PRC - C:\Users\user\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe ()

PRC - C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe (VMware, Inc.)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Windows\SysWOW64\DV4TS.EXE (Tobit.Software)

PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)

PRC - C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)

PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

PRC - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\2574fd89f1960bc08f0258723970a23b\IAStorUtil.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\d89ee849317b4d93ea78842dd78f79c0\IAStorCommon.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\90555968565afd59bce4b0974e9903bd\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\69f6e582cb79f107c61308b468c1a215\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (Amsp) -- C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found

SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)

SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SRV - (ctietfjaipsz) -- C:\Users\user\AppData\Local\Temp\DAT1BE9.tmp.exe (HLBS Tech (P) Limited)

SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (VMnetDHCP) -- C:\Windows\SysWOW64\vmnetdhcp.exe (VMware, Inc.)

SRV - (VMware NAT Service) -- C:\Windows\SysWOW64\vmnat.exe (VMware, Inc.)

SRV - (VMwareHostd) -- C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe ()

SRV - (VMAuthdService) -- C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe (VMware, Inc.)

SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (VMUSBArbService) -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe (VMware, Inc.)

SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

SRV - (IAStorDataMgrSvc) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

SRV - (TmListen) -- C:\Programme\Trend Micro\Security Agent\TmListen.exe (Trend Micro Inc.)

SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe (TuneUp Software)

SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)

SRV - (TeamViewer5) -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)

SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)

SRV - (HPSLPSVC) -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)

SRV - (PSI_SVC_2) -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (tdrpman258) Acronis Try&Decide and Restore Points filter (build 258) -- C:\Windows\SysNative\drivers\tdrpm258.sys (Acronis)

DRV:64bit: - (afcdp) -- C:\Windows\SysNative\drivers\afcdp.sys (Acronis)

DRV:64bit: - (vmx86) -- C:\Windows\SysNative\drivers\vmx86.sys (VMware, Inc.)

DRV:64bit: - (VMnetuserif) -- C:\Windows\SysNative\drivers\vmnetuserif.sys (VMware, Inc.)

DRV:64bit: - (VMnetBridge) -- C:\Windows\SysNative\drivers\vmnetbridge.sys (VMware, Inc.)

DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV:64bit: - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))

DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)

DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Rovi Corporation)

DRV:64bit: - (hcmon) -- C:\Windows\SysNative\drivers\hcmon.sys (VMware, Inc.)

DRV:64bit: - (vmci) -- C:\Windows\SysNative\drivers\vmci.sys (VMware, Inc.)

DRV:64bit: - (mv91xx) -- C:\Windows\SysNative\drivers\mv91xx.sys (Marvell Semiconductor, Inc.)

DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (tmactmon) -- C:\Windows\SysNative\drivers\tmactmon.sys (Trend Micro Inc.)

DRV:64bit: - (tmcomm) -- C:\Windows\SysNative\drivers\tmcomm.sys (Trend Micro Inc.)

DRV:64bit: - (tmevtmgr) -- C:\Windows\SysNative\drivers\tmevtmgr.sys (Trend Micro Inc.)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV:64bit: - (asmtxhci) -- C:\Windows\SysNative\drivers\asmtxhci.sys (ASMedia Technology Inc)

DRV:64bit: - (asmthub3) -- C:\Windows\SysNative\drivers\asmthub3.sys (ASMedia Technology Inc)

DRV:64bit: - (MEIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)

DRV:64bit: - (tmtdi) -- C:\Windows\SysNative\drivers\tmtdi.sys (Trend Micro Inc.)

DRV:64bit: - (silabser) -- C:\Windows\SysNative\drivers\silabser.sys (Silicon Laboratories)

DRV:64bit: - (silabenm) -- C:\Windows\SysNative\drivers\silabenm.sys (Silicon Laboratories, Inc.)

DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.)

DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)

DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)

DRV:64bit: - (MEMSWEEP2) -- C:\Windows\SysNative\738.tmp (Sophos Plc)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (adfs) -- C:\Windows\SysNative\drivers\adfs.sys (Adobe Systems, Inc.)

DRV:64bit: - (teamviewervpn) -- C:\Windows\SysNative\drivers\teamviewervpn.sys (TeamViewer GmbH)

DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys (TuneUp Software)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

DRV - (SAVRKBootTasks) -- C:\Windows\SysWOW64\SAVRKBootTasks.sys (Sophos Plc)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-4097306890-2138770997-1041978500-1118\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKU\S-1-5-21-4097306890-2138770997-1041978500-1118\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-4097306890-2138770997-1041978500-1118\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKU\S-1-5-21-4097306890-2138770997-1041978500-1118\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 20 54 DF E4 50 5B CD 01  [binary data]

IE - HKU\S-1-5-21-4097306890-2138770997-1041978500-1118\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-4097306890-2138770997-1041978500-1118\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-4097306890-2138770997-1041978500-1118\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.suggest.enabled: false

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:2.0.2

FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.1.0

FF - prefs.js..extensions.enabledItems: {3e9bb2a7-62ca-4efa-a4e6-f6f6168a652d}:0.8.19

FF - prefs.js..extensions.enabledItems: {6AC85730-7D0F-4de0-B3FA-21142DD85326}:2.2.2

FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.9.8

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.3

FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3

FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7.2

FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.1

FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.98

FF - prefs.js..network.proxy.autoconfig_url: "hxxp://sbox/wpad.dat"

FF - prefs.js..network.proxy.backup.ftp: "192.168.13.211"

FF - prefs.js..network.proxy.backup.ftp_port: 800

FF - prefs.js..network.proxy.backup.gopher: "192.168.13.211"

FF - prefs.js..network.proxy.backup.gopher_port: 800

FF - prefs.js..network.proxy.backup.socks: "192.168.13.211"

FF - prefs.js..network.proxy.backup.socks_port: 800

FF - prefs.js..network.proxy.backup.ssl: "192.168.13.211"

FF - prefs.js..network.proxy.backup.ssl_port: 800

FF - prefs.js..network.proxy.ftp: "192.168.13.211"

FF - prefs.js..network.proxy.ftp_port: 800

FF - prefs.js..network.proxy.gopher: "192.168.13.211"

FF - prefs.js..network.proxy.gopher_port: 800

FF - prefs.js..network.proxy.http: "192.168.13.211"

FF - prefs.js..network.proxy.http_port: 800

FF - prefs.js..network.proxy.share_proxy_settings: true

FF - prefs.js..network.proxy.socks: "192.168.13.211"

FF - prefs.js..network.proxy.socks_port: 800

FF - prefs.js..network.proxy.ssl: "192.168.13.211"

FF - prefs.js..network.proxy.ssl_port: 800

 

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_257.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012.04.16 10:03:42 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox [2011.11.16 15:25:33 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1165\6.6.1081\firefoxextension\ [2012.06.14 13:32:49 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.19 09:44:20 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.16 10:03:44 | 000,000,000 | ---D | M]

 

[2012.06.22 08:49:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Extensions

[2012.07.09 08:23:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\bw8mt4vh.default\extensions

[2012.07.02 08:57:05 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\bw8mt4vh.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}

[2012.07.09 08:23:06 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\bw8mt4vh.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}

[2012.06.22 08:55:21 | 000,000,000 | ---D | M] (ColorZilla) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\bw8mt4vh.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}

[2012.06.22 08:55:21 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\bw8mt4vh.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}

[2012.07.02 08:10:32 | 000,001,508 | ---- | M] () -- C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bw8mt4vh.default\searchplugins\actebispeacock.xml

[2012.07.06 08:15:16 | 000,002,125 | ---- | M] () -- C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bw8mt4vh.default\searchplugins\flickr-tags.xml

[2011.11.16 15:55:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.04.16 10:03:42 | 000,000,000 | ---D | M] (Adobe Acrobat - Create PDF) -- C:\PROGRAM FILES (X86)\ADOBE\ACROBAT 10.0\ACROBAT\BROWSER\WCFIREFOXEXTN

[2012.06.20 08:26:29 | 000,048,892 | ---- | M] () (No name found) -- C:\USERS\user\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BW8MT4VH.DEFAULT\EXTENSIONS\{3E9BB2A7-62CA-4EFA-A4E6-F6F6168A652D}.XPI

[2012.07.06 08:32:16 | 000,525,311 | ---- | M] () (No name found) -- C:\USERS\user\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BW8MT4VH.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI

[2011.10.31 09:40:59 | 000,434,392 | ---- | M] () (No name found) -- C:\USERS\user\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BW8MT4VH.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI

[2012.06.19 09:44:20 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2012.02.03 09:44:01 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.03 09:44:01 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.02.03 09:44:01 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.03 09:44:01 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.03 09:44:01 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.02.03 09:44:01 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2012.04.20 10:29:23 | 000,001,382 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Programme\Trend Micro\AMSP\module\20004\1.6.1165\6.6.1081\TmIEPlg.dll (Trend Micro Inc.)

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Programme\Trend Micro\AMSP\module\20004\1.6.1165\6.6.1081\TmIEPlg32.dll (Trend Micro Inc.)

O2 - BHO: (Reg Error: Value error.) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)

O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKU\S-1-5-21-4097306890-2138770997-1041978500-1118\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKU\S-1-5-21-4097306890-2138770997-1041978500-1118\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [DV4TS.EXE] C:\Windows\SysWOW64\DV4TS.EXE (Tobit.Software)

O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-4097306890-2138770997-1041978500-1118..\Run: [RoboForm] C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)

O4 - HKU\S-1-5-21-4097306890-2138770997-1041978500-1118..\Run: [Second Copy] C:\Program Files (x86)\SecCopy\SecCopy.exe (Centered Systems)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1

O7 - HKU\S-1-5-21-4097306890-2138770997-1041978500-1118\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 File not found

O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found

O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)

O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.de/common/asusTek_sys_ctrl.cab (asusTek_sysctrl Class)

O16 - DPF: {5DA9D8E0-5A57-11CF-9E36-00C0930198C0} hxxp://192.168.13.150/LNetCam.cab (Pegasus ImagN' 32-bit (Windowed) ActiveX Control v4.00)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.13.10

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{882EAB88-FAFF-4FAE-A237-85C558CA7836}: DhcpNameServer = 192.168.13.10

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FD941A2F-9840-4B86-9549-F3735F0D335E}: DhcpNameServer = 192.168.1.1

O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Programme\Trend Micro\AMSP\module\20004\1.6.1165\6.6.1081\TmIEPlg.dll (Trend Micro Inc.)

O18:64bit: - Protocol\Handler\tmtbim - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Programme\Trend Micro\AMSP\module\20004\1.6.1165\6.6.1081\TmIEPlg32.dll (Trend Micro Inc.)

O18 - Protocol\Handler\tmtbim {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Programme\Trend Micro\Security Agent\UIFrameWork\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010.10.20 09:06:04 | 026,980,816 | ---- | M] (Memeo) - P:\autobackupinternational.exe -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O34 - HKLM BootExecute: (MACHINE BootExecut)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

 

MsConfig:64bit - StartUpReg: AdobeAAMUpdater-1.0 - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)

MsConfig:64bit - StartUpReg: AdobeCS6ServiceManager - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)

MsConfig:64bit - StartUpReg: SwitchBoard - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)

MsConfig:64bit - State: "bootini" - Reg Error: Key error.

 

SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WinDefend - Service

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: WinDefend - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: BFE - Service

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: MPSSvc - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WinDefend - Service

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: Base - Driver Group

SafeBootNet: BFE - Service

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: MPSSvc - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WinDefend - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

Drivers32: VIDC.VMnc - C:\Windows\SysWow64\vmnc.dll (VMware, Inc.)

Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

System Restore Service not available.

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.07.09 14:11:15 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JPEG Recovery Pro

[2012.07.09 14:11:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\JPEG Recovery Pro

[2012.07.09 14:10:27 | 005,918,364 | ---- | C] (e.World Technology Limited) -- C:\Users\user\Desktop\jpegrec.exe

[2012.07.09 14:09:40 | 000,463,080 | ---- | C] (CNET Download.com) -- C:\Users\user\Desktop\cnet_jpegrec_exe.exe

[2012.07.09 14:01:23 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\JPEGsnoop

[2012.07.09 14:01:17 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\JPEGsnoop_v1_6_0

[2012.07.09 10:59:01 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Samsung

[2012.07.09 09:45:25 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1

[2012.07.06 14:46:54 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\MigWiz

[2012.07.06 13:55:27 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe

[2012.07.06 10:15:41 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Malwarebytes

[2012.07.06 10:15:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.07.06 10:15:18 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.07.06 10:15:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.07.05 14:42:29 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\ATI

[2012.07.05 14:42:29 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\ATI

[2012.07.04 17:09:14 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\LENOVO

[2012.07.04 15:10:57 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Corel

[2012.07.02 09:28:40 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\AGFEO

[2012.06.27 11:30:51 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DreamBoxEdit

[2012.06.27 08:41:56 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Audacity

[2012.06.27 08:41:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audacity

[2012.06.27 08:40:28 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\dvdcss

[2012.06.27 08:40:03 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\vlc

[2012.06.22 12:58:26 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\ACD Systems

[2012.06.22 12:58:26 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\ACD Systems

[2012.06.22 12:51:18 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\KeePass

[2012.06.22 09:11:57 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\WinRAR

[2012.06.22 09:11:08 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\IDMComp

[2012.06.22 09:07:28 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Centered Systems

[2012.06.22 09:06:05 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\NUUO

[2012.06.22 09:05:02 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Adobe

[2012.06.22 08:57:52 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\TeamViewer

[2012.06.22 08:52:27 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Macromedia

[2012.06.22 08:50:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MozBackup

[2012.06.22 08:49:12 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Mozilla

[2012.06.22 08:49:12 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Mozilla

[2012.06.22 08:46:30 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Adobe

[2012.06.22 08:46:28 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\My RoboForm Data

[2012.06.22 08:42:22 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Tobit

[2012.06.22 08:39:23 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\TuneUp Software

[2012.06.22 08:38:48 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\AGFEO

[2012.06.22 08:38:26 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Intel Corporation

[2012.06.22 08:38:23 | 000,000,000 | R--D | C] -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

[2012.06.22 08:38:23 | 000,000,000 | R--D | C] -- C:\Users\user\Searches

[2012.06.22 08:38:23 | 000,000,000 | R--D | C] -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

[2012.06.22 08:38:17 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Identities

[2012.06.22 08:38:16 | 000,000,000 | R--D | C] -- C:\Users\user\Contacts

[2012.06.22 08:38:13 | 000,000,000 | --SD | C] -- C:\Users\user\AppData\Roaming\Microsoft

[2012.06.22 08:38:13 | 000,000,000 | R--D | C] -- C:\Users\user\Videos

[2012.06.22 08:38:13 | 000,000,000 | R--D | C] -- C:\Users\user\Saved Games

[2012.06.22 08:38:13 | 000,000,000 | R--D | C] -- C:\Users\user\Pictures

[2012.06.22 08:38:13 | 000,000,000 | R--D | C] -- C:\Users\user\Music

[2012.06.22 08:38:13 | 000,000,000 | R--D | C] -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

[2012.06.22 08:38:13 | 000,000,000 | R--D | C] -- C:\Users\user\Links

[2012.06.22 08:38:13 | 000,000,000 | R--D | C] -- C:\Users\user\Favorites

[2012.06.22 08:38:13 | 000,000,000 | R--D | C] -- C:\Users\user\Downloads

[2012.06.22 08:38:13 | 000,000,000 | R--D | C] -- C:\Users\user\Documents

[2012.06.22 08:38:13 | 000,000,000 | R--D | C] -- C:\Users\user\Desktop

[2012.06.22 08:38:13 | 000,000,000 | R--D | C] -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\Vorlagen

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\AppData\Local\Verlauf

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\AppData\Local\Temporary Internet Files

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\Startmenü

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\SendTo

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\Recent

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\Netzwerkumgebung

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\Lokale Einstellungen

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\Documents\Eigene Videos

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\Documents\Eigene Musik

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\Eigene Dateien

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\Documents\Eigene Bilder

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\Druckumgebung

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\Cookies

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\AppData\Local\Anwendungsdaten

[2012.06.22 08:38:13 | 000,000,000 | -HSD | C] -- C:\Users\user\Anwendungsdaten

[2012.06.22 08:38:13 | 000,000,000 | -H-D | C] -- C:\Users\user\AppData

[2012.06.22 08:38:13 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\Visual Studio 2008

[2012.06.22 08:38:13 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Temp

[2012.06.22 08:38:13 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Microsoft Help

[2012.06.22 08:38:13 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Microsoft

[2012.06.22 08:38:13 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Media Center Programs

[2012.06.22 08:38:13 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Macromedia

[2012.06.22 08:25:21 | 000,000,000 | -H-D | C] -- C:\Users\user\Desktop\[Originaldateien]

[2012.06.22 08:25:19 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\TOOOLS

[2012.06.22 08:25:19 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\lynx-283rel1

[2012.06.22 08:25:18 | 000,454,656 | ---- | C] (Simon Tatham) -- C:\Users\user\Desktop\putty.exe

[2012.06.22 08:25:18 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Free-HTML5-Design-Company-Website-Template

[2012.06.22 08:25:18 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Fahrtenbuch

[2012.06.22 08:25:18 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\BG

[2012.06.22 08:25:18 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Autoruns

[2012.06.22 08:25:18 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\73Wartung

[2012.06.20 09:44:27 | 000,018,816 | ---- | C] (Sophos Plc) -- C:\Windows\SysWow64\SAVRKBootTasks.sys

[2012.06.19 10:25:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\KeePass Password Safe 2

[2012.06.15 09:15:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos

[2012.06.15 09:15:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sophos

[2012.06.12 16:41:35 | 000,000,000 | ---D | C] -- C:\ProgramData\IObit

[2012.06.12 16:41:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IObit

[6 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.07.09 16:36:22 | 000,024,496 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.07.09 16:36:22 | 000,024,496 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.07.09 16:36:14 | 000,000,678 | ---- | M] () -- C:\Windows\Tobit.ini

[2012.07.09 16:29:20 | 000,002,878 | RHS- | M] () -- C:\ProgramData\ntuser.pol

[2012.07.09 16:29:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.07.09 16:29:14 | 522,100,735 | -HS- | M] () -- C:\hiberfil.sys

[2012.07.09 14:11:15 | 000,001,982 | ---- | M] () -- C:\Users\user\Desktop\JPEG Recovery Pro 5.lnk

[2012.07.09 14:11:01 | 005,918,364 | ---- | M] (e.World Technology Limited) -- C:\Users\user\Desktop\jpegrec.exe

[2012.07.09 14:09:46 | 000,001,211 | ---- | M] () -- C:\Users\user\Desktop\Install JPEG Recovery Pro.lnk

[2012.07.09 14:09:41 | 000,463,080 | ---- | M] (CNET Download.com) -- C:\Users\user\Desktop\cnet_jpegrec_exe.exe

[2012.07.09 14:01:20 | 000,000,600 | ---- | M] () -- C:\Users\user\AppData\Roaming\winscp.rnd

[2012.07.09 14:01:11 | 000,557,831 | ---- | M] () -- C:\Users\user\Desktop\JPEGsnoop_v1_6_0.zip

[2012.07.09 09:01:43 | 000,001,456 | ---- | M] () -- C:\Users\user\AppData\Local\Adobe Save for Web 13.0 Prefs

[2012.07.09 08:47:12 | 000,000,020 | ---- | M] () -- C:\Users\user\defogger_reenable

[2012.07.09 08:46:31 | 000,050,477 | ---- | M] () -- C:\Users\user\Desktop\Defogger.exe

[2012.07.09 08:41:28 | 000,002,122 | -H-- | M] () -- C:\Users\user\Documents\Default.rdp

[2012.07.09 08:25:20 | 000,140,832 | ---- | M] () -- C:\Windows\SysWow64\drivers\str.sys

[2012.07.06 13:55:27 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe

[2012.07.06 10:15:19 | 000,001,135 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.07.05 14:51:02 | 000,000,492 | RHS- | M] () -- C:\Users\user\ntuser.pol

[2012.07.05 14:38:44 | 000,207,152 | ---- | M] () -- C:\Users\user\Desktop\Schaufenster_Leistungen.jpg

[2012.07.04 15:24:01 | 000,049,207 | ---- | M] () -- C:\Users\user\Desktop\EXTRAVAGANZA Schaufenster.jpg

[2012.07.04 14:12:49 | 004,365,147 | ---- | M] () -- C:\Users\user\Desktop\EH-Control.pdf

[2012.07.03 11:03:59 | 000,128,512 | ---- | M] () -- C:\Windows\RegBootClean64.exe

[2012.07.02 10:43:23 | 000,998,856 | ---- | M] () -- C:\Users\user\Desktop\HM12HII.zip

[2012.06.22 09:15:30 | 000,034,308 | ---- | M] () -- C:\Windows\SysWow64\bassmod.dll

[2012.06.21 16:16:56 | 004,354,048 | ---- | M] (Tobit.Software) -- C:\Windows\DVAPI32.DLL

[2012.06.21 15:09:12 | 001,791,702 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.06.21 15:09:12 | 000,761,080 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.06.21 15:09:12 | 000,715,792 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.06.21 15:09:12 | 000,171,376 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.06.21 15:09:12 | 000,144,164 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.06.20 13:36:55 | 000,748,170 | ---- | M] () -- C:\Users\user\Desktop\lynx-283rel1.zip

[2012.06.20 09:16:27 | 000,012,800 | ---- | M] () -- C:\Windows\DCEBoot64.exe

[2012.06.20 09:16:27 | 000,002,388 | ---- | M] () -- C:\Windows\DCEBOOT.CFG

[2012.06.18 16:56:12 | 009,611,264 | ---- | M] () -- C:\Windows\TOBITCLT.DLL

[6 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.07.09 14:11:15 | 000,001,982 | ---- | C] () -- C:\Users\user\Desktop\JPEG Recovery Pro 5.lnk

[2012.07.09 14:09:46 | 000,001,211 | ---- | C] () -- C:\Users\user\Desktop\Install JPEG Recovery Pro.lnk

[2012.07.09 14:01:11 | 000,557,831 | ---- | C] () -- C:\Users\user\Desktop\JPEGsnoop_v1_6_0.zip

[2012.07.09 13:22:08 | 000,022,016 | ---- | C] () -- C:\Windows\Installer\{8e502152-de86-1bfc-007c-735ec5e0b309}\U\800000cb.@

[2012.07.09 08:47:12 | 000,000,020 | ---- | C] () -- C:\Users\user\defogger_reenable

[2012.07.09 08:46:31 | 000,050,477 | ---- | C] () -- C:\Users\user\Desktop\Defogger.exe

[2012.07.09 08:25:18 | 000,140,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\str.sys

[2012.07.06 10:15:19 | 000,001,135 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.07.05 14:48:15 | 000,000,492 | RHS- | C] () -- C:\Users\user\ntuser.pol

[2012.07.05 14:35:18 | 000,207,152 | ---- | C] () -- C:\Users\user\Desktop\Schaufenster_Leistungen.jpg

[2012.07.04 15:22:05 | 000,049,207 | ---- | C] () -- C:\Users\user\Desktop\EXTRAVAGANZA Schaufenster.jpg

[2012.07.04 14:12:49 | 004,365,147 | ---- | C] () -- C:\Users\user\Desktop\EH-Control.pdf

[2012.07.02 10:43:23 | 000,998,856 | ---- | C] () -- C:\Users\user\Desktop\HM12HII.zip

[2012.06.27 08:41:52 | 000,001,027 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk

[2012.06.22 12:59:37 | 000,001,456 | ---- | C] () -- C:\Users\user\AppData\Local\Adobe Save for Web 13.0 Prefs

[2012.06.22 10:47:19 | 000,000,600 | ---- | C] () -- C:\Users\user\AppData\Roaming\winscp.rnd

[2012.06.22 09:15:30 | 000,034,308 | ---- | C] () -- C:\Windows\SysWow64\bassmod.dll

[2012.06.22 08:38:25 | 000,001,413 | ---- | C] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk

[2012.06.22 08:38:23 | 000,001,447 | ---- | C] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

[2012.06.22 08:26:01 | 006,959,015 | ---- | C] () -- C:\Users\user\Documents\LoaderBackup-(2010-05-05).cab

[2012.06.22 08:25:21 | 000,212,692 | ---- | C] () -- C:\Users\user\Documents\cc_20111116_145111.reg

[2012.06.22 08:25:21 | 000,065,536 | ---- | C] () -- C:\Users\user\Documents\Book 1.indb

[2012.06.22 08:25:21 | 000,048,680 | ---- | C] () -- C:\Users\user\Documents\cc_20120514_121515.reg

[2012.06.22 08:25:21 | 000,022,276 | ---- | C] () -- C:\Users\user\Documents\cc_20111116_145546.reg

[2012.06.22 08:25:21 | 000,002,122 | -H-- | C] () -- C:\Users\user\Documents\Default.rdp

[2012.06.22 08:25:18 | 000,748,170 | ---- | C] () -- C:\Users\user\Desktop\lynx-283rel1.zip

[2012.06.22 08:25:18 | 000,003,025 | ---- | C] () -- C:\Users\user\Desktop\HiJackThis.lnk

[2012.06.22 08:25:18 | 000,002,225 | ---- | C] () -- C:\Users\user\Desktop\NUUO Remote Live Viewer.lnk

[2012.06.22 08:25:18 | 000,001,797 | ---- | C] () -- C:\Users\user\Desktop\WinSCP.lnk

[2012.06.22 08:25:18 | 000,001,122 | ---- | C] () -- C:\Users\user\Desktop\Fahrtenbuch.lnk

[2012.06.22 08:25:18 | 000,000,640 | ---- | C] () -- C:\Users\user\Desktop\WALLLL.lnk

[2012.06.19 10:25:14 | 000,001,139 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass 2.lnk

[2012.06.04 15:43:32 | 000,012,800 | ---- | C] () -- C:\Windows\DCEBoot64.exe

[2012.05.14 11:53:31 | 000,128,512 | ---- | C] () -- C:\Windows\RegBootClean64.exe

[2012.05.14 11:53:29 | 000,002,048 | -HS- | C] () -- C:\Windows\assembly\temp\@

[2012.01.11 17:48:06 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{8e502152-de86-1bfc-007c-735ec5e0b309}\@

[2012.01.11 17:48:06 | 000,002,048 | -HS- | C] () -- C:\Users\user\AppData\Local\{8e502152-de86-1bfc-007c-735ec5e0b309}\@

[2011.11.29 18:46:04 | 000,000,024 | ---- | C] () -- C:\Windows\DVMAILER.INI

[2011.11.10 10:02:29 | 000,158,284 | ---- | C] () -- C:\Windows\hpwins05.dat

[2011.11.10 10:02:29 | 000,002,384 | ---- | C] () -- C:\Windows\hpwmdl05.dat

[2011.11.10 09:46:23 | 000,228,289 | ---- | C] () -- C:\Windows\hpwins05.dat.temp

[2011.11.10 09:46:23 | 000,003,111 | ---- | C] () -- C:\Windows\hpwmdl05.dat.temp

[2011.10.31 12:22:42 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe

[2011.10.31 12:22:40 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll

[2011.10.31 12:22:40 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll

[2011.10.31 12:22:40 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll

[2011.10.31 12:22:38 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll

[2011.10.18 14:39:34 | 000,456,192 | ---- | C] () -- C:\Windows\SetACL.exe

[2011.10.05 13:30:06 | 001,811,530 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011.10.05 11:11:58 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.07.20 09:17:06 | 000,000,162 | ---- | C] () -- C:\Windows\ODBC.INI

[2011.06.22 19:54:18 | 000,000,021 | ---- | C] () -- C:\Windows\SurCode.INI

[2011.06.15 20:34:47 | 000,000,000 | ---- | C] () -- C:\Windows\DVEXTINF.INI

[2011.05.25 14:14:10 | 000,000,394 | ---- | C] () -- C:\Windows\capture.ini

[2011.04.26 15:31:08 | 000,033,404 | ---- | C] () -- C:\Windows\Ascd_log.ini

[2011.04.26 15:30:24 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

[2011.04.26 15:30:21 | 000,023,042 | ---- | C] () -- C:\Windows\Ascd_tmp.ini

[2011.03.03 11:31:06 | 000,102,400 | ---- | C] () -- C:\Windows\RegBootClean.exe

[2011.03.02 11:00:48 | 000,185,344 | ---- | C] () -- C:\Windows\DVGRF.DLL

[2011.03.02 11:00:01 | 000,000,023 | ---- | C] () -- C:\Windows\AVFD.INI

[2011.03.02 10:59:49 | 009,611,264 | ---- | C] () -- C:\Windows\TOBITCLT.DLL

[2011.03.02 10:59:06 | 000,000,678 | ---- | C] () -- C:\Windows\Tobit.ini

[2010.02.12 12:59:30 | 000,002,878 | RHS- | C] () -- C:\ProgramData\ntuser.pol

 
 ========== LOP Check ==========

 

[2012.06.22 12:58:26 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\ACD Systems

[2012.06.22 08:38:48 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\AGFEO

[2012.06.27 09:08:28 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Audacity

[2012.07.09 14:01:23 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\JPEGsnoop

[2012.06.26 08:31:10 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\KeePass

[2012.06.22 09:06:05 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\NUUO

[2012.07.09 10:59:01 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Samsung

[2012.07.09 09:45:25 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1

[2012.06.22 11:16:59 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\TeamViewer

[2012.06.22 08:42:24 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Tobit

[2012.06.22 08:39:23 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\TuneUp Software

[2012.06.21 15:17:55 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.06.22 12:58:26 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\ACD Systems

[2012.07.09 09:45:25 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Adobe

[2012.06.22 08:38:48 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\AGFEO

[2012.07.05 14:42:29 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\ATI

[2012.06.27 09:08:28 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Audacity

[2012.07.04 15:10:59 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Corel

[2012.06.27 08:40:28 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\dvdcss

[2012.06.22 08:38:17 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Identities

[2012.06.22 09:11:08 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\IDMComp

[2012.06.22 08:38:26 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Intel Corporation

[2012.07.09 14:01:23 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\JPEGsnoop

[2012.06.26 08:31:10 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\KeePass

[2011.10.05 11:23:48 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Macromedia

[2012.07.06 10:15:41 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Malwarebytes

[2010.11.21 09:00:36 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Media Center Programs

[2012.06.27 10:46:37 | 000,000,000 | --SD | M] -- C:\Users\user\AppData\Roaming\Microsoft

[2012.06.22 08:49:14 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Mozilla

[2012.06.22 09:06:05 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\NUUO

[2012.07.09 10:59:01 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Samsung

[2012.07.09 09:45:25 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1

[2012.06.22 11:16:59 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\TeamViewer

[2012.06.22 08:42:24 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Tobit

[2012.06.22 08:39:23 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\TuneUp Software

[2012.06.27 09:03:16 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\vlc

[2012.06.22 09:11:57 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\WinRAR

 
 < %APPDATA%\*.exe /s >

[2012.05.14 10:30:47 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\user\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2011.04.26 12:07:36 | 000,557,848 | ---- | M] (Intel Corporation) MD5=26CF4275034214ECEDD8EC17B0A18A99 -- C:\Windows\SysNative\drivers\iaStor.sys

[2011.04.26 12:07:36 | 000,557,848 | ---- | M] (Intel Corporation) MD5=26CF4275034214ECEDD8EC17B0A18A99 -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_16d1c1de1eca8452\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

[2012.07.09 08:25:20 | 000,140,832 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\str.sys

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

--- --- ---

[/CODE]

Ist das rein zufällig ein Büro-Rechner?
Hätte da ein paar Anhaltpunkte, die darauf hindeuten :pfeiff:

ja dass ist mein Büro Pc :)

aber es handelt sich hier um 1 mann unternehmen in meinem Keller falls es deine frage besser beantwortet :)

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O4 - HKLM..\Run: []  File not found

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1

O7 - HKU\S-1-5-21-4097306890-2138770997-1041978500-1118\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010.10.20 09:06:04 | 026,980,816 | ---- | M] (Memeo) - P:\autobackupinternational.exe -- [ NTFS ]

:Files

C:\Windows\DCEBoot64.exe

C:\Windows\RegBootClean64.exe

C:\Windows\assembly\temp\@

C:\Windows\assembly\temp\U

C:\Windows\assembly\temp\n

C:\Windows\Installer\{8e502152-de86-1bfc-007c-735ec5e0b309}\@

C:\Windows\Installer\{8e502152-de86-1bfc-007c-735ec5e0b309}\U

C:\Windows\Installer\{8e502152-de86-1bfc-007c-735ec5e0b309}\n

C:\Users\user\AppData\Local\{8e502152-de86-1bfc-007c-735ec5e0b309}\@

C:\Users\user\AppData\Local\{8e502152-de86-1bfc-007c-735ec5e0b309}\U

C:\Users\user\AppData\Local\{8e502152-de86-1bfc-007c-735ec5e0b309}\n

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Code:

All processes killed

========== OTL ==========

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\VerboseStatus deleted successfully.

Registry value HKEY_USERS\S-1-5-21-4097306890-2138770997-1041978500-1118\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

File P:\autobackupinternational.exe not found.

========== FILES ==========

C:\Windows\DCEBoot64.exe moved successfully.

C:\Windows\RegBootClean64.exe moved successfully.

C:\Windows\assembly\temp\@ moved successfully.

C:\Windows\assembly\temp\U folder moved successfully.

File\Folder C:\Windows\assembly\temp\n not found.

C:\Windows\Installer\{8e502152-de86-1bfc-007c-735ec5e0b309}\@ moved successfully.

C:\Windows\Installer\{8e502152-de86-1bfc-007c-735ec5e0b309}\U folder moved successfully.

File\Folder C:\Windows\Installer\{8e502152-de86-1bfc-007c-735ec5e0b309}\n not found.

C:\Users\user\AppData\Local\{8e502152-de86-1bfc-007c-735ec5e0b309}\@ moved successfully.

C:\Users\user\AppData\Local\{8e502152-de86-1bfc-007c-735ec5e0b309}\U folder moved successfully.

File\Folder C:\Users\user\AppData\Local\{8e502152-de86-1bfc-007c-735ec5e0b309}\n not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrator

->Temp folder emptied: 90158 bytes

->Temporary Internet Files folder emptied: 33173 bytes

->Flash cache emptied: 56475 bytes

 

User: All Users

 

User: user

->Temp folder emptied: 6483107 bytes

->Temporary Internet Files folder emptied: 12827467 bytes

->Java cache emptied: 207560 bytes

->FireFox cache emptied: 56754672 bytes

->Flash cache emptied: 56981 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33173 bytes

->Flash cache emptied: 56475 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 36864 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 3075029 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 57287384 bytes

RecycleBin emptied: 568129 bytes

 

Total Files Cleaned = 131,00 mb

 

 

[EMPTYFLASH]

 

User: Administrator

->Flash cache emptied: 0 bytes

 

User: All Users

 

User: user

->Flash cache emptied: 0 bytes

 

User: Default

->Flash cache emptied: 0 bytes

 

User: Default User

->Flash cache emptied: 0 bytes

 

User: Public

 

Total Flash Files Cleaned = 0,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.53.1 log created on 07102012_115950
 

Files\Folders moved on Reboot...

File move failed. C:\Users\user\AppData\Local\Temp\DAT1BE9.tmp.exe scheduled to be moved on reboot.

C:\Users\user\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

File move failed. C:\Windows\temp\vmware-SYSTEM\vmauthd.log scheduled to be moved on reboot.

C:\Windows\temp\vmware-SYSTEM\vmware-usbarb-SYSTEM-2352.log moved successfully.

C:\Windows\temp\10323.tmp moved successfully.

C:\Windows\temp\11460.tmp moved successfully.

C:\Windows\temp\11849.tmp moved successfully.

C:\Windows\temp\11855.tmp moved successfully.

C:\Windows\temp\14526.tmp moved successfully.

C:\Windows\temp\17213.tmp moved successfully.

C:\Windows\temp\20306.tmp moved successfully.

C:\Windows\temp\21133.tmp moved successfully.

C:\Windows\temp\21236.tmp moved successfully.

C:\Windows\temp\22170.tmp moved successfully.

C:\Windows\temp\22501.tmp moved successfully.

C:\Windows\temp\22910.tmp moved successfully.

C:\Windows\temp\23131.tmp moved successfully.

C:\Windows\temp\25048.tmp moved successfully.

C:\Windows\temp\25350.tmp moved successfully.

C:\Windows\temp\26327.tmp moved successfully.

C:\Windows\temp\27293.tmp moved successfully.

C:\Windows\temp\27702.tmp moved successfully.

C:\Windows\temp\27784.tmp moved successfully.

C:\Windows\temp\28216.tmp moved successfully.

C:\Windows\temp\30734.tmp moved successfully.

C:\Windows\temp\32884.tmp moved successfully.

C:\Windows\temp\33936.tmp moved successfully.

C:\Windows\temp\36109.tmp moved successfully.

C:\Windows\temp\38566.tmp moved successfully.

C:\Windows\temp\40229.tmp moved successfully.

C:\Windows\temp\41654.tmp moved successfully.

C:\Windows\temp\41756.tmp moved successfully.

C:\Windows\temp\42115.tmp moved successfully.

C:\Windows\temp\43211.tmp moved successfully.

C:\Windows\temp\43327.tmp moved successfully.

C:\Windows\temp\43995.tmp moved successfully.

C:\Windows\temp\44347.tmp moved successfully.

C:\Windows\temp\45436.tmp moved successfully.

C:\Windows\temp\46440.tmp moved successfully.

C:\Windows\temp\47716.tmp moved successfully.

C:\Windows\temp\48615.tmp moved successfully.

C:\Windows\temp\48687.tmp moved successfully.

C:\Windows\temp\48789.tmp moved successfully.

C:\Windows\temp\50477.tmp moved successfully.

C:\Windows\temp\54393.tmp moved successfully.

C:\Windows\temp\54626.tmp moved successfully.

C:\Windows\temp\54708.tmp moved successfully.

C:\Windows\temp\56789.tmp moved successfully.

C:\Windows\temp\57318.tmp moved successfully.

C:\Windows\temp\57660.tmp moved successfully.

C:\Windows\temp\58906.tmp moved successfully.

C:\Windows\temp\59003.tmp moved successfully.

C:\Windows\temp\59870.tmp moved successfully.

C:\Windows\temp\60506.tmp moved successfully.

C:\Windows\temp\60621.tmp moved successfully.

C:\Windows\temp\60828.tmp moved successfully.

C:\Windows\temp\61090.tmp moved successfully.

C:\Windows\temp\61219.tmp moved successfully.

C:\Windows\temp\61945.tmp moved successfully.

C:\Windows\temp\62124.tmp moved successfully.

C:\Windows\temp\63428.tmp moved successfully.

C:\Windows\temp\63614.tmp moved successfully.

C:\Windows\temp\64651.tmp moved successfully.

C:\Windows\temp\66224.tmp moved successfully.

C:\Windows\temp\67937.tmp moved successfully.

C:\Windows\temp\69608.tmp moved successfully.

C:\Windows\temp\70619.tmp moved successfully.

C:\Windows\temp\71782.tmp moved successfully.

C:\Windows\temp\73107.tmp moved successfully.

C:\Windows\temp\74239.tmp moved successfully.

C:\Windows\temp\75137.tmp moved successfully.

C:\Windows\temp\75661.tmp moved successfully.

C:\Windows\temp\76811.tmp moved successfully.

C:\Windows\temp\77369.tmp moved successfully.

C:\Windows\temp\78930.tmp moved successfully.

C:\Windows\temp\79508.tmp moved successfully.

C:\Windows\temp\79887.tmp moved successfully.

C:\Windows\temp\80758.tmp moved successfully.

C:\Windows\temp\80810.tmp moved successfully.

C:\Windows\temp\82957.tmp moved successfully.

C:\Windows\temp\83028.tmp moved successfully.

C:\Windows\temp\83190.tmp moved successfully.

C:\Windows\temp\84926.tmp moved successfully.

C:\Windows\temp\85052.tmp moved successfully.

C:\Windows\temp\85191.tmp moved successfully.

C:\Windows\temp\85478.tmp moved successfully.

C:\Windows\temp\87743.tmp moved successfully.

C:\Windows\temp\88417.tmp moved successfully.

C:\Windows\temp\88734.tmp moved successfully.

C:\Windows\temp\89010.tmp moved successfully.

C:\Windows\temp\89052.tmp moved successfully.

C:\Windows\temp\91380.tmp moved successfully.

C:\Windows\temp\91844.tmp moved successfully.

C:\Windows\temp\92340.tmp moved successfully.

C:\Windows\temp\92763.tmp moved successfully.

C:\Windows\temp\95000.tmp moved successfully.

C:\Windows\temp\95993.tmp moved successfully.

C:\Windows\temp\96690.tmp moved successfully.

C:\Windows\temp\97094.tmp moved successfully.
 

PendingFileRenameOperations files...

[2012.07.09 08:25:18 | 000,044,544 | ---- | M] (HLBS Tech (P) Limited) C:\Users\user\AppData\Local\Temp\DAT1BE9.tmp.exe : Unable to obtain MD5

File C:\Users\user\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

[2012.07.10 12:31:57 | 000,000,000 | ---- | M] () C:\Windows\temp\vmware-SYSTEM\vmauthd.log : Unable to obtain MD5

File C:\Windows\temp\vmware-SYSTEM\vmware-usbarb-SYSTEM-2352.log not found!

File C:\Windows\temp\10323.tmp not found!

File C:\Windows\temp\11460.tmp not found!

File C:\Windows\temp\11849.tmp not found!

File C:\Windows\temp\11855.tmp not found!

File C:\Windows\temp\14526.tmp not found!

File C:\Windows\temp\17213.tmp not found!

File C:\Windows\temp\20306.tmp not found!

File C:\Windows\temp\21133.tmp not found!

File C:\Windows\temp\21236.tmp not found!

File C:\Windows\temp\22170.tmp not found!

File C:\Windows\temp\22501.tmp not found!

File C:\Windows\temp\22910.tmp not found!

File C:\Windows\temp\23131.tmp not found!

File C:\Windows\temp\25048.tmp not found!

File C:\Windows\temp\25350.tmp not found!

File C:\Windows\temp\26327.tmp not found!

File C:\Windows\temp\27293.tmp not found!

File C:\Windows\temp\27702.tmp not found!

File C:\Windows\temp\27784.tmp not found!

File C:\Windows\temp\28216.tmp not found!

File C:\Windows\temp\30734.tmp not found!

File C:\Windows\temp\32884.tmp not found!

File C:\Windows\temp\33936.tmp not found!

File C:\Windows\temp\36109.tmp not found!

File C:\Windows\temp\38566.tmp not found!

File C:\Windows\temp\40229.tmp not found!

File C:\Windows\temp\41654.tmp not found!

File C:\Windows\temp\41756.tmp not found!

File C:\Windows\temp\42115.tmp not found!

File C:\Windows\temp\43211.tmp not found!

File C:\Windows\temp\43327.tmp not found!

File C:\Windows\temp\43995.tmp not found!

File C:\Windows\temp\44347.tmp not found!

File C:\Windows\temp\45436.tmp not found!

File C:\Windows\temp\46440.tmp not found!

File C:\Windows\temp\47716.tmp not found!

File C:\Windows\temp\48615.tmp not found!

File C:\Windows\temp\48687.tmp not found!

File C:\Windows\temp\48789.tmp not found!

File C:\Windows\temp\50477.tmp not found!

File C:\Windows\temp\54393.tmp not found!

File C:\Windows\temp\54626.tmp not found!

File C:\Windows\temp\54708.tmp not found!

File C:\Windows\temp\56789.tmp not found!

File C:\Windows\temp\57318.tmp not found!

File C:\Windows\temp\57660.tmp not found!

File C:\Windows\temp\58906.tmp not found!

File C:\Windows\temp\59003.tmp not found!

File C:\Windows\temp\59870.tmp not found!

File C:\Windows\temp\60506.tmp not found!

File C:\Windows\temp\60621.tmp not found!

File C:\Windows\temp\60828.tmp not found!

File C:\Windows\temp\61090.tmp not found!

File C:\Windows\temp\61219.tmp not found!

File C:\Windows\temp\61945.tmp not found!

File C:\Windows\temp\62124.tmp not found!

File C:\Windows\temp\63428.tmp not found!

File C:\Windows\temp\63614.tmp not found!

File C:\Windows\temp\64651.tmp not found!

File C:\Windows\temp\66224.tmp not found!

File C:\Windows\temp\67937.tmp not found!

File C:\Windows\temp\69608.tmp not found!

File C:\Windows\temp\70619.tmp not found!

File C:\Windows\temp\71782.tmp not found!

File C:\Windows\temp\73107.tmp not found!

File C:\Windows\temp\74239.tmp not found!

File C:\Windows\temp\75137.tmp not found!

File C:\Windows\temp\75661.tmp not found!

File C:\Windows\temp\76811.tmp not found!

File C:\Windows\temp\77369.tmp not found!

File C:\Windows\temp\78930.tmp not found!

File C:\Windows\temp\79508.tmp not found!

File C:\Windows\temp\79887.tmp not found!

File C:\Windows\temp\80758.tmp not found!

File C:\Windows\temp\80810.tmp not found!

File C:\Windows\temp\82957.tmp not found!

File C:\Windows\temp\83028.tmp not found!

File C:\Windows\temp\83190.tmp not found!

File C:\Windows\temp\84926.tmp not found!

File C:\Windows\temp\85052.tmp not found!

File C:\Windows\temp\85191.tmp not found!

File C:\Windows\temp\85478.tmp not found!

File C:\Windows\temp\87743.tmp not found!

File C:\Windows\temp\88417.tmp not found!

File C:\Windows\temp\88734.tmp not found!

File C:\Windows\temp\89010.tmp not found!

File C:\Windows\temp\89052.tmp not found!

File C:\Windows\temp\91380.tmp not found!

File C:\Windows\temp\91844.tmp not found!

File C:\Windows\temp\92340.tmp not found!

File C:\Windows\temp\92763.tmp not found!

File C:\Windows\temp\95000.tmp not found!

File C:\Windows\temp\95993.tmp not found!

File C:\Windows\temp\96690.tmp not found!

File C:\Windows\temp\97094.tmp not found!
 

Registry entries deleted on Reboot...

ich bekomme jetzt folgende meldung von meine Trend Micro angezeigt

http://i46.tinypic.com/2dm6td0.jpg

Hast du den Scanner VOR dem Fix abgestellt?

Ja hatt alles abgestellt und beendet soweit ich konnte

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Hier der Log

Code:

# AdwCleaner v1.701 - Logfile created 07/11/2012 at 08:28:05

# Updated 02/07/2012 by Xplode

# Operating system : Windows 7 Professional Service Pack 1 (64 bits)

# User : user - pcuser

# Running from : C:\Users\user\Desktop\adwcleaner.exe

# Option [Search]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 
 

***** [Registry] *****
 
 

***** [Registre - GUID] *****
 

Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}

[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v13.0.1 (de)
 

Profile name : default 

File : C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bw8mt4vh.default\prefs.js
 

[OK] File is clean.
 

*************************
 

AdwCleaner[R1].txt - [1222 octets] - [11/07/2012 08:28:05]
 

########## EOF - C:\AdwCleaner[R1].txt - [1350 octets] ##########

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Hier der Log vom TDSSKiller

Code:

14:05:00.0520 3000        TDSS rootkit removing tool 2.7.45.0 Jul  9 2012 12:46:35

14:05:00.0613 3000        ============================================================

14:05:00.0613 3000        Current date / time: 2012/07/11 14:05:00.0613

14:05:00.0613 3000        SystemInfo:

14:05:00.0613 3000        

14:05:00.0613 3000        OS Version: 6.1.7601 ServicePack: 1.0

14:05:00.0613 3000        Product type: Workstation

14:05:00.0613 3000        ComputerName: pcuser

14:05:00.0613 3000        UserName: user

14:05:00.0613 3000        Windows directory: C:\Windows

14:05:00.0613 3000        System windows directory: C:\Windows

14:05:00.0613 3000        Running under WOW64

14:05:00.0613 3000        Processor architecture: Intel x64

14:05:00.0613 3000        Number of processors: 4

14:05:00.0613 3000        Page size: 0x1000

14:05:00.0613 3000        Boot type: Normal boot

14:05:00.0613 3000        ============================================================

14:05:00.0754 3000        Drive \Device\Harddisk0\DR0 - Size: 0x1AC882A000 (107.13 Gb), SectorSize: 0x200, Cylinders: 0x3A0B, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040

14:05:00.0769 3000        Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

14:05:00.0785 3000        ============================================================

14:05:00.0785 3000        \Device\Harddisk0\DR0:

14:05:00.0785 3000        MBR partitions:

14:05:00.0785 3000        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xD642971

14:05:00.0785 3000        \Device\Harddisk1\DR1:

14:05:00.0785 3000        MBR partitions:

14:05:00.0785 3000        \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x3A384800

14:05:00.0785 3000        ============================================================

14:05:00.0785 3000        C: <-> \Device\Harddisk0\DR0\Partition0

14:05:00.0816 3000        D: <-> \Device\Harddisk1\DR1\Partition0

14:05:00.0816 3000        ============================================================

14:05:00.0816 3000        Initialize success

14:05:00.0816 3000        ============================================================

14:05:26.0946 3100        ============================================================

14:05:26.0946 3100        Scan started

14:05:26.0946 3100        Mode: Manual; SigCheck; TDLFS; 

14:05:26.0946 3100        ============================================================

14:05:27.0118 3100        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\DRIVERS\1394ohci.sys

14:05:27.0165 3100        1394ohci - ok

14:05:27.0180 3100        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys

14:05:27.0196 3100        ACPI - ok

14:05:27.0196 3100        AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys

14:05:27.0211 3100        AcpiPmi - ok

14:05:27.0211 3100        adfs            (2f0683fd2df1d92e891caca14b45a8c1) C:\Windows\system32\drivers\adfs.sys

14:05:27.0227 3100        adfs - ok

14:05:27.0243 3100        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

14:05:27.0243 3100        AdobeARMservice - ok

14:05:27.0258 3100        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys

14:05:27.0274 3100        adp94xx - ok

14:05:27.0289 3100        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys

14:05:27.0289 3100        adpahci - ok

14:05:27.0305 3100        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys

14:05:27.0305 3100        adpu320 - ok

14:05:27.0321 3100        AeLookupSvc     (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll

14:05:27.0336 3100        AeLookupSvc - ok

14:05:27.0352 3100        afcdp           (3f5fdc12ffa4794fc3a178a26d48e7cf) C:\Windows\system32\DRIVERS\afcdp.sys

14:05:27.0367 3100        afcdp - ok

14:05:27.0399 3100        AFD             (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys

14:05:27.0414 3100        AFD - ok

14:05:27.0414 3100        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys

14:05:27.0414 3100        agp440 - ok

14:05:27.0430 3100        ALG             (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe

14:05:27.0430 3100        ALG - ok

14:05:27.0430 3100        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys

14:05:27.0445 3100        aliide - ok

14:05:27.0461 3100        AMD External Events Utility (012365a0a24b4c875169ac05e7c79b7b) C:\Windows\system32\atiesrxx.exe

14:05:27.0461 3100        AMD External Events Utility - ok

14:05:27.0461 3100        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys

14:05:27.0477 3100        amdide - ok

14:05:27.0477 3100        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys

14:05:27.0477 3100        AmdK8 - ok

14:05:27.0695 3100        amdkmdag        (2c428ed33f53ff61a2e271d6b2bb7654) C:\Windows\system32\DRIVERS\atipmdag.sys

14:05:27.0757 3100        amdkmdag - ok

14:05:27.0789 3100        amdkmdap        (57c25e7c1220804e92483ae84c8e7734) C:\Windows\system32\DRIVERS\atikmpag.sys

14:05:27.0804 3100        amdkmdap - ok

14:05:27.0804 3100        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\drivers\amdppm.sys

14:05:27.0820 3100        AmdPPM - ok

14:05:27.0820 3100        amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys

14:05:27.0835 3100        amdsata - ok

14:05:27.0835 3100        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys

14:05:27.0851 3100        amdsbs - ok

14:05:27.0851 3100        amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys

14:05:27.0851 3100        amdxata - ok

14:05:27.0882 3100        Amsp            (25e9c505a8db1b5efe631e43718fdb22) C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe

14:05:27.0882 3100        Amsp - ok

14:05:27.0898 3100        AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys

14:05:27.0913 3100        AppID - ok

14:05:27.0913 3100        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll

14:05:27.0929 3100        AppIDSvc - ok

14:05:27.0945 3100        Appinfo         (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll

14:05:27.0960 3100        Appinfo - ok

14:05:27.0976 3100        AppMgmt         (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll

14:05:27.0976 3100        AppMgmt - ok

14:05:27.0991 3100        arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys

14:05:27.0991 3100        arc - ok

14:05:28.0007 3100        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys

14:05:28.0007 3100        arcsas - ok

14:05:28.0023 3100        asmthub3        (e3b9c89d2ed4a538ab2fc6ec76fa2b17) C:\Windows\system32\DRIVERS\asmthub3.sys

14:05:28.0023 3100        asmthub3 - ok

14:05:28.0054 3100        asmtxhci        (88ce83be5176020be39194a6369af2c2) C:\Windows\system32\DRIVERS\asmtxhci.sys

14:05:28.0054 3100        asmtxhci - ok

14:05:28.0069 3100        aspnet_state    (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

14:05:28.0069 3100        aspnet_state - ok

14:05:28.0085 3100        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

14:05:28.0101 3100        AsyncMac - ok

14:05:28.0101 3100        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys

14:05:28.0101 3100        atapi - ok

14:05:28.0116 3100        AtiHdmiService  (77c149e6d702737b2e372dee166faef8) C:\Windows\system32\drivers\AtiHdmi.sys

14:05:28.0116 3100        AtiHdmiService - ok

14:05:28.0179 3100        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

14:05:28.0194 3100        AudioEndpointBuilder - ok

14:05:28.0210 3100        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

14:05:28.0225 3100        AudioSrv - ok

14:05:28.0241 3100        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll

14:05:28.0241 3100        AxInstSV - ok

14:05:28.0272 3100        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys

14:05:28.0288 3100        b06bdrv - ok

14:05:28.0303 3100        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

14:05:28.0303 3100        b57nd60a - ok

14:05:28.0319 3100        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll

14:05:28.0319 3100        BDESVC - ok

14:05:28.0319 3100        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

14:05:28.0350 3100        Beep - ok

14:05:28.0350 3100        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

14:05:28.0350 3100        blbdrive - ok

14:05:28.0366 3100        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys

14:05:28.0366 3100        bowser - ok

14:05:28.0366 3100        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys

14:05:28.0381 3100        BrFiltLo - ok

14:05:28.0381 3100        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys

14:05:28.0397 3100        BrFiltUp - ok

14:05:28.0397 3100        Browser         (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll

14:05:28.0428 3100        Browser - ok

14:05:28.0444 3100        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

14:05:28.0444 3100        Brserid - ok

14:05:28.0459 3100        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

14:05:28.0459 3100        BrSerWdm - ok

14:05:28.0459 3100        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

14:05:28.0475 3100        BrUsbMdm - ok

14:05:28.0475 3100        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

14:05:28.0475 3100        BrUsbSer - ok

14:05:28.0491 3100        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\drivers\bthmodem.sys

14:05:28.0491 3100        BTHMODEM - ok

14:05:28.0506 3100        bthserv         (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll

14:05:28.0522 3100        bthserv - ok

14:05:28.0537 3100        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

14:05:28.0553 3100        cdfs - ok

14:05:28.0569 3100        cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys

14:05:28.0569 3100        cdrom - ok

14:05:28.0569 3100        CertPropSvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

14:05:28.0600 3100        CertPropSvc - ok

14:05:28.0600 3100        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys

14:05:28.0615 3100        circlass - ok

14:05:28.0631 3100        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

14:05:28.0647 3100        CLFS - ok

14:05:28.0662 3100        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

14:05:28.0662 3100        clr_optimization_v2.0.50727_32 - ok

14:05:28.0662 3100        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

14:05:28.0678 3100        clr_optimization_v2.0.50727_64 - ok

14:05:28.0693 3100        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

14:05:28.0693 3100        clr_optimization_v4.0.30319_32 - ok

14:05:28.0709 3100        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

14:05:28.0709 3100        clr_optimization_v4.0.30319_64 - ok

14:05:28.0709 3100        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\drivers\CmBatt.sys

14:05:28.0725 3100        CmBatt - ok

14:05:28.0725 3100        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys

14:05:28.0725 3100        cmdide - ok

14:05:28.0756 3100        CNG             (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys

14:05:28.0771 3100        CNG - ok

14:05:28.0771 3100        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\drivers\compbatt.sys

14:05:28.0771 3100        Compbatt - ok

14:05:28.0787 3100        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\DRIVERS\CompositeBus.sys

14:05:28.0787 3100        CompositeBus - ok

14:05:28.0787 3100        COMSysApp - ok

14:05:28.0803 3100        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys

14:05:28.0803 3100        crcdisk - ok

14:05:28.0818 3100        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll

14:05:28.0834 3100        CryptSvc - ok

14:05:28.0881 3100        CSC             (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys

14:05:28.0881 3100        CSC - ok

14:05:28.0912 3100        CscService      (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll

14:05:28.0927 3100        CscService - ok

14:05:28.0927 3100        ctietfjaipsz - ok

14:05:28.0959 3100        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

14:05:28.0990 3100        DcomLaunch - ok

14:05:29.0005 3100        defragsvc       (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll

14:05:29.0021 3100        defragsvc - ok

14:05:29.0037 3100        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys

14:05:29.0052 3100        DfsC - ok

14:05:29.0068 3100        dgderdrv - ok

14:05:29.0068 3100        dg_ssudbus      (113212d25d0c9bb8901a9833774da97f) C:\Windows\system32\DRIVERS\ssudbus.sys

14:05:29.0068 3100        dg_ssudbus - ok

14:05:29.0099 3100        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll

14:05:29.0115 3100        Dhcp - ok

14:05:29.0115 3100        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

14:05:29.0146 3100        discache - ok

14:05:29.0146 3100        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys

14:05:29.0146 3100        Disk - ok

14:05:29.0161 3100        dmvsc           (5db085a8a6600be6401f2b24eecb5415) C:\Windows\system32\drivers\dmvsc.sys

14:05:29.0161 3100        dmvsc - ok

14:05:29.0177 3100        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll

14:05:29.0193 3100        Dnscache - ok

14:05:29.0208 3100        dot3svc         (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll

14:05:29.0224 3100        dot3svc - ok

14:05:29.0239 3100        DPS             (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll

14:05:29.0255 3100        DPS - ok

14:05:29.0271 3100        drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

14:05:29.0271 3100        drmkaud - ok

14:05:29.0286 3100        dtsoftbus01     (46571ed73ae84469dca53081d33cf3c8) C:\Windows\system32\DRIVERS\dtsoftbus01.sys

14:05:29.0302 3100        dtsoftbus01 - ok

14:05:29.0364 3100        DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys

14:05:29.0380 3100        DXGKrnl - ok

14:05:29.0395 3100        EapHost         (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll

14:05:29.0411 3100        EapHost - ok

14:05:29.0520 3100        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys

14:05:29.0551 3100        ebdrv - ok

14:05:29.0583 3100        EFS             (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe

14:05:29.0583 3100        EFS - ok

14:05:29.0614 3100        ehRecvr         (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe

14:05:29.0629 3100        ehRecvr - ok

14:05:29.0645 3100        ehSched         (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe

14:05:29.0645 3100        ehSched - ok

14:05:29.0676 3100        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys

14:05:29.0692 3100        elxstor - ok

14:05:29.0692 3100        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys

14:05:29.0707 3100        ErrDev - ok

14:05:29.0739 3100        EventSystem     (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll

14:05:29.0754 3100        EventSystem - ok

14:05:29.0770 3100        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

14:05:29.0801 3100        exfat - ok

14:05:29.0801 3100        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

14:05:29.0832 3100        fastfat - ok

14:05:29.0879 3100        Fax             (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe

14:05:29.0895 3100        Fax - ok

14:05:29.0895 3100        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys

14:05:29.0895 3100        fdc - ok

14:05:29.0895 3100        fdPHost         (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll

14:05:29.0926 3100        fdPHost - ok

14:05:29.0926 3100        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll

14:05:29.0941 3100        FDResPub - ok

14:05:29.0957 3100        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

14:05:29.0957 3100        FileInfo - ok

14:05:29.0957 3100        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

14:05:29.0973 3100        Filetrace - ok

14:05:30.0004 3100        FLEXnet Licensing Service (bb0667b0171b632b97ea759515476f07) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

14:05:30.0019 3100        FLEXnet Licensing Service - ok

14:05:30.0019 3100        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys

14:05:30.0035 3100        flpydisk - ok

14:05:30.0051 3100        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys

14:05:30.0051 3100        FltMgr - ok

14:05:30.0129 3100        FontCache       (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll

14:05:30.0144 3100        FontCache - ok

14:05:30.0144 3100        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

14:05:30.0144 3100        FontCache3.0.0.0 - ok

14:05:30.0160 3100        FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

14:05:30.0160 3100        FsDepends - ok

14:05:30.0175 3100        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys

14:05:30.0175 3100        Fs_Rec - ok

14:05:30.0191 3100        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys

14:05:30.0207 3100        fvevol - ok

14:05:30.0207 3100        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys

14:05:30.0207 3100        gagp30kx - ok

14:05:30.0269 3100        gpsvc           (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll

14:05:30.0300 3100        gpsvc - ok

14:05:30.0300 3100        hcmon           (adb4348da1345877b04e22203afc8993) C:\Windows\system32\drivers\hcmon.sys

14:05:30.0300 3100        hcmon - ok

14:05:30.0300 3100        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

14:05:30.0316 3100        hcw85cir - ok

14:05:30.0331 3100        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\DRIVERS\HDAudBus.sys

14:05:30.0331 3100        HDAudBus - ok

14:05:30.0331 3100        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys

14:05:30.0347 3100        HidBatt - ok

14:05:30.0347 3100        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys

14:05:30.0363 3100        HidBth - ok

14:05:30.0363 3100        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys

14:05:30.0378 3100        HidIr - ok

14:05:30.0378 3100        hidserv         (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll

14:05:30.0394 3100        hidserv - ok

14:05:30.0409 3100        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys

14:05:30.0409 3100        HidUsb - ok

14:05:30.0409 3100        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll

14:05:30.0441 3100        hkmsvc - ok

14:05:30.0456 3100        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll

14:05:30.0456 3100        HomeGroupListener - ok

14:05:30.0472 3100        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll

14:05:30.0487 3100        HomeGroupProvider - ok

14:05:30.0487 3100        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys

14:05:30.0503 3100        HpSAMD - ok

14:05:30.0550 3100        HPSLPSVC        (2adf33f93991c4e24e86ffa5f906417b) C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL

14:05:30.0565 3100        HPSLPSVC ( UnsignedFile.Multi.Generic ) - warning

14:05:30.0565 3100        HPSLPSVC - detected UnsignedFile.Multi.Generic (1)

14:05:30.0612 3100        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys

14:05:30.0643 3100        HTTP - ok

14:05:30.0643 3100        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys

14:05:30.0643 3100        hwpolicy - ok

14:05:30.0659 3100        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys

14:05:30.0659 3100        i8042prt - ok

14:05:30.0690 3100        iaStor          (26cf4275034214ecedd8ec17b0a18a99) C:\Windows\system32\DRIVERS\iaStor.sys

14:05:30.0706 3100        iaStor - ok

14:05:30.0721 3100        IAStorDataMgrSvc (e79a8e33bd136d14bae1fa20eb2ef124) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

14:05:30.0721 3100        IAStorDataMgrSvc - ok

14:05:30.0737 3100        iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys

14:05:30.0753 3100        iaStorV - ok

14:05:30.0784 3100        idsvc           (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

14:05:30.0799 3100        idsvc - ok

14:05:30.0799 3100        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys

14:05:30.0815 3100        iirsp - ok

14:05:30.0846 3100        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll

14:05:30.0877 3100        IKEEXT - ok

14:05:30.0987 3100        IntcAzAudAddService (589b94a9b73a0e819ff873743a480834) C:\Windows\system32\drivers\RTKVHD64.sys

14:05:31.0018 3100        IntcAzAudAddService - ok

14:05:31.0049 3100        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys

14:05:31.0065 3100        intelide - ok

14:05:31.0065 3100        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

14:05:31.0080 3100        intelppm - ok

14:05:31.0080 3100        IPBusEnum       (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll

14:05:31.0096 3100        IPBusEnum - ok

14:05:31.0111 3100        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys

14:05:31.0127 3100        IpFilterDriver - ok

14:05:31.0127 3100        IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys

14:05:31.0143 3100        IPMIDRV - ok

14:05:31.0143 3100        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

14:05:31.0174 3100        IPNAT - ok

14:05:31.0174 3100        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

14:05:31.0174 3100        IRENUM - ok

14:05:31.0189 3100        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys

14:05:31.0189 3100        isapnp - ok

14:05:31.0205 3100        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys

14:05:31.0221 3100        iScsiPrt - ok

14:05:31.0221 3100        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys

14:05:31.0236 3100        kbdclass - ok

14:05:31.0236 3100        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys

14:05:31.0236 3100        kbdhid - ok

14:05:31.0252 3100        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

14:05:31.0252 3100        KeyIso - ok

14:05:31.0252 3100        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys

14:05:31.0267 3100        KSecDD - ok

14:05:31.0283 3100        KSecPkg         (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys

14:05:31.0283 3100        KSecPkg - ok

14:05:31.0283 3100        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

14:05:31.0314 3100        ksthunk - ok

14:05:31.0330 3100        KtmRm           (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll

14:05:31.0361 3100        KtmRm - ok

14:05:31.0377 3100        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll

14:05:31.0392 3100        LanmanServer - ok

14:05:31.0408 3100        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll

14:05:31.0423 3100        LanmanWorkstation - ok

14:05:31.0439 3100        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

14:05:31.0455 3100        lltdio - ok

14:05:31.0470 3100        lltdsvc         (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll

14:05:31.0501 3100        lltdsvc - ok

14:05:31.0501 3100        lmhosts         (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll

14:05:31.0517 3100        lmhosts - ok

14:05:31.0533 3100        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys

14:05:31.0533 3100        LSI_FC - ok

14:05:31.0548 3100        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys

14:05:31.0548 3100        LSI_SAS - ok

14:05:31.0548 3100        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys

14:05:31.0564 3100        LSI_SAS2 - ok

14:05:31.0564 3100        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys

14:05:31.0579 3100        LSI_SCSI - ok

14:05:31.0579 3100        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

14:05:31.0611 3100        luafv - ok

14:05:31.0611 3100        MBAMProtector   (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys

14:05:31.0611 3100        MBAMProtector - ok

14:05:31.0657 3100        MBAMService     (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

14:05:31.0673 3100        MBAMService - ok

14:05:31.0673 3100        Mcx2Svc         (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll

14:05:31.0689 3100        Mcx2Svc - ok

14:05:31.0704 3100        MDM             (7cf1b716372b89568ae4c0fe769f5869) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

14:05:31.0720 3100        MDM ( UnsignedFile.Multi.Generic ) - warning

14:05:31.0720 3100        MDM - detected UnsignedFile.Multi.Generic (1)

14:05:31.0720 3100        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys

14:05:31.0720 3100        megasas - ok

14:05:31.0751 3100        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys

14:05:31.0751 3100        MegaSR - ok

14:05:31.0767 3100        MEIx64          (a6518dcc42f7a6e999bb3bea8fd87567) C:\Windows\system32\DRIVERS\HECIx64.sys

14:05:31.0767 3100        MEIx64 - ok

14:05:31.0767 3100        MEMSWEEP2 - ok

14:05:31.0782 3100        Microsoft Office Groove Audit Service (7c4c76b39d5525c4a465e0be32528e19) C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe

14:05:31.0782 3100        Microsoft Office Groove Audit Service - ok

14:05:31.0782 3100        MMCSS           (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

14:05:31.0813 3100        MMCSS - ok

14:05:31.0813 3100        Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

14:05:31.0829 3100        Modem - ok

14:05:31.0829 3100        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

14:05:31.0845 3100        monitor - ok

14:05:31.0845 3100        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys

14:05:31.0860 3100        mouclass - ok

14:05:31.0860 3100        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\drivers\mouhid.sys

14:05:31.0860 3100        mouhid - ok

14:05:31.0876 3100        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys

14:05:31.0876 3100        mountmgr - ok

14:05:31.0891 3100        MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

14:05:31.0891 3100        MozillaMaintenance - ok

14:05:31.0907 3100        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys

14:05:31.0907 3100        mpio - ok

14:05:31.0923 3100        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

14:05:31.0938 3100        mpsdrv - ok

14:05:31.0954 3100        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys

14:05:31.0954 3100        MRxDAV - ok

14:05:31.0969 3100        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys

14:05:31.0969 3100        mrxsmb - ok

14:05:32.0001 3100        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys

14:05:32.0001 3100        mrxsmb10 - ok

14:05:32.0016 3100        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

14:05:32.0016 3100        mrxsmb20 - ok

14:05:32.0032 3100        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys

14:05:32.0032 3100        msahci - ok

14:05:32.0032 3100        msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys

14:05:32.0047 3100        msdsm - ok

14:05:32.0063 3100        MSDTC           (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe

14:05:32.0063 3100        MSDTC - ok

14:05:32.0063 3100        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

14:05:32.0094 3100        Msfs - ok

14:05:32.0094 3100        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

14:05:32.0110 3100        mshidkmdf - ok

14:05:32.0110 3100        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys

14:05:32.0110 3100        msisadrv - ok

14:05:32.0125 3100        MSiSCSI         (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll

14:05:32.0157 3100        MSiSCSI - ok

14:05:32.0157 3100        msiserver - ok

14:05:32.0157 3100        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

14:05:32.0172 3100        MSKSSRV - ok

14:05:32.0172 3100        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

14:05:32.0188 3100        MSPCLOCK - ok

14:05:32.0203 3100        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

14:05:32.0219 3100        MSPQM - ok

14:05:32.0250 3100        MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys

14:05:32.0250 3100        MsRPC - ok

14:05:32.0250 3100        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys

14:05:32.0266 3100        mssmbios - ok

14:05:32.0266 3100        MSSQL$DAVID - ok

14:05:32.0266 3100        MSSQLServerADHelper (c06ea83f6fc2959e897c117255b6b1d5) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqladhlp90.exe

14:05:32.0281 3100        MSSQLServerADHelper - ok

14:05:32.0281 3100        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

14:05:32.0297 3100        MSTEE - ok

14:05:32.0297 3100        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys

14:05:32.0313 3100        MTConfig - ok

14:05:32.0313 3100        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

14:05:32.0313 3100        Mup - ok

14:05:32.0344 3100        mv91xx          (38b4c95e821528fb91df16a78e04450f) C:\Windows\system32\drivers\mv91xx.sys

14:05:32.0344 3100        mv91xx - ok

14:05:32.0375 3100        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll

14:05:32.0406 3100        napagent - ok

14:05:32.0422 3100        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

14:05:32.0437 3100        NativeWifiP - ok

14:05:32.0500 3100        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys

14:05:32.0515 3100        NDIS - ok

14:05:32.0515 3100        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

14:05:32.0547 3100        NdisCap - ok

14:05:32.0547 3100        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

14:05:32.0562 3100        NdisTapi - ok

14:05:32.0578 3100        Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys

14:05:32.0593 3100        Ndisuio - ok

14:05:32.0609 3100        NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys

14:05:32.0625 3100        NdisWan - ok

14:05:32.0625 3100        NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys

14:05:32.0640 3100        NDProxy - ok

14:05:32.0656 3100        Net Driver HPZ12 (dc6530a291d4bdf6df399f1f128e7f8f) C:\Windows\system32\HPZinw12.dll

14:05:32.0656 3100        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning

14:05:32.0656 3100        Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)

14:05:32.0656 3100        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

14:05:32.0671 3100        NetBIOS - ok

14:05:32.0703 3100        NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys

14:05:32.0718 3100        NetBT - ok

14:05:32.0718 3100        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

14:05:32.0734 3100        Netlogon - ok

14:05:32.0749 3100        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll

14:05:32.0781 3100        Netman - ok

14:05:32.0796 3100        NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

14:05:32.0796 3100        NetMsmqActivator - ok

14:05:32.0796 3100        NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

14:05:32.0812 3100        NetPipeActivator - ok

14:05:32.0843 3100        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll

14:05:32.0859 3100        netprofm - ok

14:05:32.0859 3100        NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

14:05:32.0874 3100        NetTcpActivator - ok

14:05:32.0874 3100        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

14:05:32.0874 3100        NetTcpPortSharing - ok

14:05:32.0890 3100        nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys

14:05:32.0890 3100        nfrd960 - ok

14:05:32.0905 3100        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll

14:05:32.0937 3100        NlaSvc - ok

14:05:32.0937 3100        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

14:05:32.0952 3100        Npfs - ok

14:05:32.0968 3100        nsi             (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll

14:05:32.0983 3100        nsi - ok

14:05:32.0983 3100        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

14:05:32.0999 3100        nsiproxy - ok

14:05:33.0108 3100        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys

14:05:33.0139 3100        Ntfs - ok

14:05:33.0171 3100        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

14:05:33.0202 3100        Null - ok

14:05:33.0202 3100        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys

14:05:33.0217 3100        nvraid - ok

14:05:33.0233 3100        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys

14:05:33.0233 3100        nvstor - ok

14:05:33.0249 3100        nvsvc           (97f1a24ac0255c6e0a075c9cc772784a) C:\Windows\system32\nvvsvc.exe

14:05:33.0249 3100        nvsvc - ok

14:05:33.0264 3100        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys

14:05:33.0264 3100        nv_agp - ok

14:05:33.0295 3100        odserv          (1f0e05dff4f5a833168e49be1256f002) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

14:05:33.0311 3100        odserv - ok

14:05:33.0311 3100        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys

14:05:33.0327 3100        ohci1394 - ok

14:05:33.0342 3100        ose             (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

14:05:33.0342 3100        ose - ok

14:05:33.0545 3100        osppsvc         (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

14:05:33.0623 3100        osppsvc - ok

14:05:33.0670 3100        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

14:05:33.0670 3100        p2pimsvc - ok

14:05:33.0701 3100        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll

14:05:33.0717 3100        p2psvc - ok

14:05:33.0717 3100        Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys

14:05:33.0732 3100        Parport - ok

14:05:33.0732 3100        partmgr         (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys

14:05:33.0732 3100        partmgr - ok

14:05:33.0748 3100        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll

14:05:33.0763 3100        PcaSvc - ok

14:05:33.0779 3100        pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys

14:05:33.0795 3100        pci - ok

14:05:33.0795 3100        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys

14:05:33.0795 3100        pciide - ok

14:05:33.0810 3100        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys

14:05:33.0810 3100        pcmcia - ok

14:05:33.0826 3100        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

14:05:33.0826 3100        pcw - ok

14:05:33.0873 3100        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

14:05:33.0904 3100        PEAUTH - ok

14:05:33.0951 3100        PeerDistSvc     (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll

14:05:33.0982 3100        PeerDistSvc - ok

14:05:34.0013 3100        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe

14:05:34.0013 3100        PerfHost - ok

14:05:34.0138 3100        pla             (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll

14:05:34.0169 3100        pla - ok

14:05:34.0200 3100        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll

14:05:34.0200 3100        PlugPlay - ok

14:05:34.0216 3100        Pml Driver HPZ12 (71f62c51dfdfbc04c83c5c64b2b8058e) C:\Windows\system32\HPZipm12.dll

14:05:34.0216 3100        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning

14:05:34.0216 3100        Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)

14:05:34.0216 3100        PNRPAutoReg     (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll

14:05:34.0231 3100        PNRPAutoReg - ok

14:05:34.0247 3100        PNRPsvc         (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

14:05:34.0263 3100        PNRPsvc - ok

14:05:34.0278 3100        PolicyAgent     (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll

14:05:34.0309 3100        PolicyAgent - ok

14:05:34.0325 3100        Power           (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll

14:05:34.0341 3100        Power - ok

14:05:34.0356 3100        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys

14:05:34.0372 3100        PptpMiniport - ok

14:05:34.0387 3100        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys

14:05:34.0387 3100        Processor - ok

14:05:34.0403 3100        ProfSvc         (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll

14:05:34.0419 3100        ProfSvc - ok

14:05:34.0434 3100        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

14:05:34.0434 3100        ProtectedStorage - ok

14:05:34.0450 3100        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys

14:05:34.0465 3100        Psched - ok

14:05:34.0481 3100        PSI_SVC_2       (0b6dea0a1662cab8f2bf339dc0752ef4) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

14:05:34.0497 3100        PSI_SVC_2 - ok

14:05:34.0497 3100        PxHlpa64        (bc08f7f3c53cbee68670ed1314e290fd) C:\Windows\system32\Drivers\PxHlpa64.sys

14:05:34.0497 3100        PxHlpa64 - ok

14:05:34.0559 3100        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys

14:05:34.0575 3100        ql2300 - ok

14:05:34.0621 3100        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys

14:05:34.0621 3100        ql40xx - ok

14:05:34.0637 3100        QWAVE           (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll

14:05:34.0653 3100        QWAVE - ok

14:05:34.0653 3100        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

14:05:34.0668 3100        QWAVEdrv - ok

14:05:34.0668 3100        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

14:05:34.0684 3100        RasAcd - ok

14:05:34.0699 3100        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

14:05:34.0715 3100        RasAgileVpn - ok

14:05:34.0715 3100        RasAuto         (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll

14:05:34.0746 3100        RasAuto - ok

14:05:34.0762 3100        Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys

14:05:34.0777 3100        Rasl2tp - ok

14:05:34.0793 3100        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll

14:05:34.0809 3100        RasMan - ok

14:05:34.0824 3100        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

14:05:34.0840 3100        RasPppoe - ok

14:05:34.0855 3100        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

14:05:34.0871 3100        RasSstp - ok

14:05:34.0887 3100        rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys

14:05:34.0918 3100        rdbss - ok

14:05:34.0918 3100        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

14:05:34.0918 3100        rdpbus - ok

14:05:34.0933 3100        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

14:05:34.0949 3100        RDPCDD - ok

14:05:34.0965 3100        RDPDR           (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys

14:05:34.0965 3100        RDPDR - ok

14:05:34.0965 3100        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

14:05:34.0996 3100        RDPENCDD - ok

14:05:34.0996 3100        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

14:05:35.0011 3100        RDPREFMP - ok

14:05:35.0027 3100        RDPWD           (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys

14:05:35.0027 3100        RDPWD - ok

14:05:35.0043 3100        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys

14:05:35.0058 3100        rdyboost - ok

14:05:35.0058 3100        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll

14:05:35.0089 3100        RemoteAccess - ok

14:05:35.0105 3100        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll

14:05:35.0121 3100        RemoteRegistry - ok

14:05:35.0121 3100        RimUsb - ok

14:05:35.0121 3100        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll

14:05:35.0152 3100        RpcEptMapper - ok

14:05:35.0152 3100        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe

14:05:35.0152 3100        RpcLocator - ok

14:05:35.0183 3100        RpcSs           (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

14:05:35.0199 3100        RpcSs - ok

14:05:35.0199 3100        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

14:05:35.0230 3100        rspndr - ok

14:05:35.0261 3100        RTL8167         (afc12dfa4c7b089673ad67402ca19edb) C:\Windows\system32\DRIVERS\Rt64win7.sys

14:05:35.0261 3100        RTL8167 - ok

14:05:35.0261 3100        s3cap           (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys

14:05:35.0277 3100        s3cap - ok

14:05:35.0277 3100        SamSs           (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

14:05:35.0277 3100        SamSs - ok

14:05:35.0277 3100        SAVRKBootTasks - ok

14:05:35.0292 3100        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys

14:05:35.0292 3100        sbp2port - ok

14:05:35.0308 3100        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll

14:05:35.0323 3100        SCardSvr - ok

14:05:35.0339 3100        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys

14:05:35.0355 3100        scfilter - ok

14:05:35.0417 3100        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll

14:05:35.0448 3100        Schedule - ok

14:05:35.0464 3100        SCPolicySvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

14:05:35.0479 3100        SCPolicySvc - ok

14:05:35.0495 3100        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll

14:05:35.0495 3100        SDRSVC - ok

14:05:35.0511 3100        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

14:05:35.0526 3100        secdrv - ok

14:05:35.0526 3100        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll

14:05:35.0542 3100        seclogon - ok

14:05:35.0557 3100        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll

14:05:35.0573 3100        SENS - ok

14:05:35.0573 3100        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll

14:05:35.0589 3100        SensrSvc - ok

14:05:35.0589 3100        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

14:05:35.0589 3100        Serenum - ok

14:05:35.0604 3100        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

14:05:35.0604 3100        Serial - ok

14:05:35.0620 3100        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys

14:05:35.0620 3100        sermouse - ok

14:05:35.0635 3100        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll

14:05:35.0651 3100        SessionEnv - ok

14:05:35.0651 3100        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys

14:05:35.0667 3100        sffdisk - ok

14:05:35.0667 3100        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys

14:05:35.0667 3100        sffp_mmc - ok

14:05:35.0667 3100        sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys

14:05:35.0682 3100        sffp_sd - ok

14:05:35.0682 3100        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys

14:05:35.0682 3100        sfloppy - ok

14:05:35.0713 3100        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll

14:05:35.0729 3100        ShellHWDetection - ok

14:05:35.0745 3100        silabenm        (75f3c451d41b35089e92d368ee190aca) C:\Windows\system32\DRIVERS\silabenm.sys

14:05:35.0745 3100        silabenm - ok

14:05:35.0745 3100        silabser        (b816d865910e8f5b7e12d593ec584d91) C:\Windows\system32\DRIVERS\silabser.sys

14:05:35.0760 3100        silabser - ok

14:05:35.0760 3100        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys

14:05:35.0760 3100        SiSRaid2 - ok

14:05:35.0776 3100        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys

14:05:35.0776 3100        SiSRaid4 - ok

14:05:35.0791 3100        SkypeUpdate     (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files (x86)\Skype\Updater\Updater.exe

14:05:35.0807 3100        SkypeUpdate - ok

14:05:35.0807 3100        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

14:05:35.0823 3100        Smb - ok

14:05:35.0838 3100        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe

14:05:35.0838 3100        SNMPTRAP - ok

14:05:35.0838 3100        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

14:05:35.0854 3100        spldr - ok

14:05:35.0885 3100        Spooler         (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe

14:05:35.0916 3100        Spooler - ok

14:05:36.0135 3100        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe

14:05:36.0181 3100        sppsvc - ok

14:05:36.0213 3100        sppuinotify     (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll

14:05:36.0244 3100        sppuinotify - ok

14:05:36.0244 3100        sptd - ok

14:05:36.0259 3100        SQLBrowser      (b2ec3e1deac5f0a764bd3486d213a0af) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe

14:05:36.0259 3100        SQLBrowser - ok

14:05:36.0291 3100        srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys

14:05:36.0306 3100        srv - ok

14:05:36.0322 3100        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys

14:05:36.0337 3100        srv2 - ok

14:05:36.0353 3100        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys

14:05:36.0353 3100        srvnet - ok

14:05:36.0369 3100        SSDPSRV         (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll

14:05:36.0384 3100        SSDPSRV - ok

14:05:36.0400 3100        SstpSvc         (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll

14:05:36.0415 3100        SstpSvc - ok

14:05:36.0431 3100        ssudmdm         (78cd64791f8634cf7b582fd085e57c4b) C:\Windows\system32\DRIVERS\ssudmdm.sys

14:05:36.0431 3100        ssudmdm - ok

14:05:36.0447 3100        Stereo Service  (6a36a1ce6e6c71559569a965183ff612) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

14:05:36.0447 3100        Stereo Service - ok

14:05:36.0462 3100        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys

14:05:36.0462 3100        stexstor - ok

14:05:36.0462 3100        StillCam        (decacb6921ded1a38642642685d77dac) C:\Windows\system32\DRIVERS\serscan.sys

14:05:36.0478 3100        StillCam - ok

14:05:36.0493 3100        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll

14:05:36.0509 3100        stisvc - ok

14:05:36.0525 3100        storflt         (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys

14:05:36.0525 3100        storflt - ok

14:05:36.0525 3100        StorSvc         (c40841817ef57d491f22eb103da587cc) C:\Windows\system32\storsvc.dll

14:05:36.0540 3100        StorSvc - ok

14:05:36.0540 3100        storvsc         (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys

14:05:36.0540 3100        storvsc - ok

14:05:36.0540 3100        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys

14:05:36.0556 3100        swenum - ok

14:05:36.0571 3100        SwitchBoard     (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

14:05:36.0587 3100        SwitchBoard ( UnsignedFile.Multi.Generic ) - warning

14:05:36.0587 3100        SwitchBoard - detected UnsignedFile.Multi.Generic (1)

14:05:36.0603 3100        swprv           (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll

14:05:36.0665 3100        swprv - ok

14:05:36.0759 3100        SysMain         (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll

14:05:36.0790 3100        SysMain - ok

14:05:36.0837 3100        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll

14:05:36.0837 3100        TabletInputService - ok

14:05:36.0852 3100        TapiSrv         (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll

14:05:36.0883 3100        TapiSrv - ok

14:05:36.0883 3100        TBS             (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll

14:05:36.0915 3100        TBS - ok

14:05:36.0977 3100        Tcpip           (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys

14:05:37.0008 3100        Tcpip - ok

14:05:37.0102 3100        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys

14:05:37.0117 3100        TCPIP6 - ok

14:05:37.0149 3100        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys

14:05:37.0164 3100        tcpipreg - ok

14:05:37.0180 3100        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

14:05:37.0180 3100        TDPIPE - ok

14:05:37.0242 3100        tdrpman258      (bf7ac81df6fbe09438d9dc7188178ea9) C:\Windows\system32\DRIVERS\tdrpm258.sys

14:05:37.0258 3100        tdrpman258 - ok

14:05:37.0289 3100        TDTCP           (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys

14:05:37.0289 3100        TDTCP - ok

14:05:37.0305 3100        tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys

14:05:37.0320 3100        tdx - ok

14:05:37.0336 3100        TeamViewer5     (213723e1a736910c644b457de6d095e2) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe

14:05:37.0351 3100        TeamViewer5 - ok

14:05:37.0351 3100        teamviewervpn   (f5520dbb47c60ee83024b38720abda24) C:\Windows\system32\DRIVERS\teamviewervpn.sys

14:05:37.0351 3100        teamviewervpn - ok

14:05:37.0367 3100        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\DRIVERS\termdd.sys

14:05:37.0367 3100        TermDD - ok

14:05:37.0398 3100        TermService     (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll

14:05:37.0414 3100        TermService - ok

14:05:37.0429 3100        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll

14:05:37.0429 3100        Themes - ok

14:05:37.0445 3100        THREADORDER     (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

14:05:37.0461 3100        THREADORDER - ok

14:05:37.0461 3100        tmactmon        (ba4030f56aacecd0e6d413565b4aed75) C:\Windows\system32\DRIVERS\tmactmon.sys

14:05:37.0476 3100        tmactmon - ok

14:05:37.0492 3100        tmcomm          (ed866799ca62626341632da9edecfd04) C:\Windows\system32\DRIVERS\tmcomm.sys

14:05:37.0492 3100        tmcomm - ok

14:05:37.0492 3100        tmevtmgr        (84fb4b5c8dcd78163c440431fef3e096) C:\Windows\system32\DRIVERS\tmevtmgr.sys

14:05:37.0507 3100        tmevtmgr - ok

14:05:37.0539 3100        TmListen        (14aad1604c9386899485758c05a1757e) C:\Program Files\Trend Micro\Security Agent\tmlisten.exe

14:05:37.0554 3100        TmListen - ok

14:05:37.0570 3100        tmtdi           (77b9bebb0769f45ef770297196ef3506) C:\Windows\system32\DRIVERS\tmtdi.sys

14:05:37.0570 3100        tmtdi - ok

14:05:37.0585 3100        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll

14:05:37.0601 3100        TrkWks - ok

14:05:37.0617 3100        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe

14:05:37.0632 3100        TrustedInstaller - ok

14:05:37.0648 3100        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys

14:05:37.0663 3100        tssecsrv - ok

14:05:37.0663 3100        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys

14:05:37.0679 3100        TsUsbFlt - ok

14:05:37.0679 3100        TsUsbGD         (9cc2ccae8a84820eaecb886d477cbcb8) C:\Windows\system32\drivers\TsUsbGD.sys

14:05:37.0679 3100        TsUsbGD - ok

14:05:37.0819 3100        TuneUp.UtilitiesSvc (6ad9517c083d88bde53dc9f5ead8a0d9) C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe

14:05:37.0835 3100        TuneUp.UtilitiesSvc - ok

14:05:37.0851 3100        TuneUpUtilitiesDrv (dcc94c51d27c7ec0dadeca8f64c94fcf) C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys

14:05:37.0851 3100        TuneUpUtilitiesDrv - ok

14:05:37.0897 3100        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys

14:05:37.0913 3100        tunnel - ok

14:05:37.0913 3100        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys

14:05:37.0929 3100        uagp35 - ok

14:05:37.0944 3100        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys

14:05:37.0960 3100        udfs - ok

14:05:37.0975 3100        UI0Detect       (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe

14:05:37.0975 3100        UI0Detect - ok

14:05:37.0991 3100        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys

14:05:37.0991 3100        uliagpkx - ok

14:05:37.0991 3100        umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys

14:05:38.0007 3100        umbus - ok

14:05:38.0007 3100        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys

14:05:38.0007 3100        UmPass - ok

14:05:38.0022 3100        UmRdpService    (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll

14:05:38.0038 3100        UmRdpService - ok

14:05:38.0053 3100        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll

14:05:38.0069 3100        upnphost - ok

14:05:38.0085 3100        usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys

14:05:38.0085 3100        usbccgp - ok

14:05:38.0100 3100        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys

14:05:38.0100 3100        usbcir - ok

14:05:38.0116 3100        usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys

14:05:38.0116 3100        usbehci - ok

14:05:38.0131 3100        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys

14:05:38.0147 3100        usbhub - ok

14:05:38.0147 3100        usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys

14:05:38.0163 3100        usbohci - ok

14:05:38.0163 3100        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\drivers\usbprint.sys

14:05:38.0163 3100        usbprint - ok

14:05:38.0178 3100        USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS

14:05:38.0178 3100        USBSTOR - ok

14:05:38.0194 3100        usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys

14:05:38.0194 3100        usbuhci - ok

14:05:38.0194 3100        UxSms           (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll

14:05:38.0209 3100        UxSms - ok

14:05:38.0225 3100        UxTuneUp        (69af1428fe0e790f31cc2f10483b40c9) C:\Windows\System32\uxtuneup.dll

14:05:38.0225 3100        UxTuneUp - ok

14:05:38.0225 3100        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

14:05:38.0241 3100        VaultSvc - ok

14:05:38.0241 3100        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys

14:05:38.0241 3100        vdrvroot - ok

14:05:38.0256 3100        vds             (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe

14:05:38.0287 3100        vds - ok

14:05:38.0287 3100        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

14:05:38.0303 3100        vga - ok

14:05:38.0303 3100        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

14:05:38.0319 3100        VgaSave - ok

14:05:38.0334 3100        vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys

14:05:38.0350 3100        vhdmp - ok

14:05:38.0350 3100        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys

14:05:38.0350 3100        viaide - ok

14:05:38.0365 3100        VMAuthdService  (94cf2d157c8fd9089afa5da78aa64c65) C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe

14:05:38.0365 3100        VMAuthdService ( UnsignedFile.Multi.Generic ) - warning

14:05:38.0365 3100        VMAuthdService - detected UnsignedFile.Multi.Generic (1)

14:05:38.0381 3100        vmbus           (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys

14:05:38.0381 3100        vmbus - ok

14:05:38.0397 3100        VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys

14:05:38.0397 3100        VMBusHID - ok

14:05:38.0412 3100        vmci            (87fc1dd880e8cac4faebb84af61a87c4) C:\Windows\system32\DRIVERS\vmci.sys

14:05:38.0412 3100        vmci - ok

14:05:38.0412 3100        VMnetAdapter - ok

14:05:38.0412 3100        VMnetBridge     (dec4ce720ffeda939cf1ba315cfbd993) C:\Windows\system32\DRIVERS\vmnetbridge.sys

14:05:38.0428 3100        VMnetBridge - ok

14:05:38.0428 3100        VMnetDHCP - ok

14:05:38.0428 3100        VMnetuserif     (ec9456d3e0e194d67d7430c7ab4eab2c) C:\Windows\system32\drivers\vmnetuserif.sys

14:05:38.0428 3100        VMnetuserif - ok

14:05:38.0475 3100        VMUSBArbService (18903ca7936912c337c9d28858880cf2) C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe

14:05:38.0490 3100        VMUSBArbService - ok

14:05:38.0490 3100        VMware NAT Service - ok

14:05:38.0865 3100        VMwareHostd     (8c01ae115e9e6806a25a9b5136fd6fc0) C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe

14:05:38.0958 3100        VMwareHostd ( UnsignedFile.Multi.Generic ) - warning

14:05:38.0958 3100        VMwareHostd - detected UnsignedFile.Multi.Generic (1)

14:05:38.0989 3100        vmx86           (940933def15495d50dc1232e28c70b48) C:\Windows\system32\drivers\vmx86.sys

14:05:38.0989 3100        vmx86 - ok

14:05:38.0989 3100        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys

14:05:39.0005 3100        volmgr - ok

14:05:39.0036 3100        volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys

14:05:39.0036 3100        volmgrx - ok

14:05:39.0067 3100        volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys

14:05:39.0067 3100        volsnap - ok

14:05:39.0083 3100        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys

14:05:39.0083 3100        vsmraid - ok

14:05:39.0145 3100        VSS             (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe

14:05:39.0177 3100        VSS - ok

14:05:39.0208 3100        vstor2-mntapi10-shared (6107e33a30c0b923f31c872e1980d2d1) C:\Windows\syswow64\drivers\vstor2-mntapi10-shared.sys

14:05:39.0223 3100        vstor2-mntapi10-shared - ok

14:05:39.0255 3100        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys

14:05:39.0255 3100        vwifibus - ok

14:05:39.0286 3100        W32Time         (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll

14:05:39.0317 3100        W32Time - ok

14:05:39.0317 3100        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys

14:05:39.0333 3100        WacomPen - ok

14:05:39.0333 3100        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

14:05:39.0348 3100        WANARP - ok

14:05:39.0364 3100        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

14:05:39.0379 3100        Wanarpv6 - ok

14:05:39.0426 3100        WatAdminSvc     (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe

14:05:39.0457 3100        WatAdminSvc - ok

14:05:39.0520 3100        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe

14:05:39.0535 3100        wbengine - ok

14:05:39.0582 3100        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll

14:05:39.0582 3100        WbioSrvc - ok

14:05:39.0598 3100        wcncsvc         (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll

14:05:39.0613 3100        wcncsvc - ok

14:05:39.0629 3100        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll

14:05:39.0629 3100        WcsPlugInService - ok

14:05:39.0645 3100        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys

14:05:39.0645 3100        Wd - ok

14:05:39.0691 3100        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

14:05:39.0707 3100        Wdf01000 - ok

14:05:39.0707 3100        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

14:05:39.0723 3100        WdiServiceHost - ok

14:05:39.0723 3100        WdiSystemHost   (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

14:05:39.0738 3100        WdiSystemHost - ok

14:05:39.0754 3100        WebClient       (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll

14:05:39.0769 3100        WebClient - ok

14:05:39.0769 3100        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll

14:05:39.0801 3100        Wecsvc - ok

14:05:39.0801 3100        wercplsupport   (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll

14:05:39.0832 3100        wercplsupport - ok

14:05:39.0832 3100        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll

14:05:39.0847 3100        WerSvc - ok

14:05:39.0863 3100        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

14:05:39.0879 3100        WfpLwf - ok

14:05:39.0879 3100        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

14:05:39.0894 3100        WIMMount - ok

14:05:39.0910 3100        Winmgmt         (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll

14:05:39.0941 3100        Winmgmt - ok

14:05:40.0035 3100        WinRM           (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll

14:05:40.0066 3100        WinRM - ok

14:05:40.0113 3100        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys

14:05:40.0128 3100        WinUsb - ok

14:05:40.0175 3100        Wlansvc         (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll

14:05:40.0191 3100        Wlansvc - ok

14:05:40.0191 3100        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys

14:05:40.0191 3100        WmiAcpi - ok

14:05:40.0222 3100        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe

14:05:40.0222 3100        wmiApSrv - ok

14:05:40.0237 3100        WMPNetworkSvc - ok

14:05:40.0237 3100        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll

14:05:40.0237 3100        WPCSvc - ok

14:05:40.0253 3100        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll

14:05:40.0253 3100        WPDBusEnum - ok

14:05:40.0253 3100        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

14:05:40.0284 3100        ws2ifsl - ok

14:05:40.0284 3100        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\system32\wscsvc.dll

14:05:40.0300 3100        wscsvc - ok

14:05:40.0300 3100        WSearch - ok

14:05:40.0315 3100        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys

14:05:40.0331 3100        WudfPf - ok

14:05:40.0347 3100        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys

14:05:40.0362 3100        WUDFRd - ok

14:05:40.0362 3100        wudfsvc         (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll

14:05:40.0393 3100        wudfsvc - ok

14:05:40.0409 3100        WwanSvc         (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll

14:05:40.0425 3100        WwanSvc - ok

14:05:40.0425 3100        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

14:05:40.0534 3100        \Device\Harddisk0\DR0 - ok

14:05:40.0534 3100        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk1\DR1

14:05:40.0643 3100        \Device\Harddisk1\DR1 - ok

14:05:40.0643 3100        Boot (0x1200)   (14b71b7dadc4d16655b2d5af1bee8784) \Device\Harddisk0\DR0\Partition0

14:05:40.0643 3100        \Device\Harddisk0\DR0\Partition0 - ok

14:05:40.0643 3100        Boot (0x1200)   (2f83157ee79d0d973fabfdadfb5e14d5) \Device\Harddisk1\DR1\Partition0

14:05:40.0643 3100        \Device\Harddisk1\DR1\Partition0 - ok

14:05:40.0643 3100        ============================================================

14:05:40.0643 3100        Scan finished

14:05:40.0643 3100        ============================================================

14:05:40.0643 3956        Detected object count: 7

14:05:40.0643 3956        Actual detected object count: 7

14:05:51.0204 3956        HPSLPSVC ( UnsignedFile.Multi.Generic ) - skipped by user

14:05:51.0204 3956        HPSLPSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:05:51.0204 3956        MDM ( UnsignedFile.Multi.Generic ) - skipped by user

14:05:51.0204 3956        MDM ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:05:51.0204 3956        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user

14:05:51.0204 3956        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:05:51.0204 3956        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user

14:05:51.0204 3956        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:05:51.0220 3956        SwitchBoard ( UnsignedFile.Multi.Generic ) - skipped by user

14:05:51.0220 3956        SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:05:51.0220 3956        VMAuthdService ( UnsignedFile.Multi.Generic ) - skipped by user

14:05:51.0220 3956        VMAuthdService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:05:51.0220 3956        VMwareHostd ( UnsignedFile.Multi.Generic ) - skipped by user

14:05:51.0220 3956        VMwareHostd ( UnsignedFile.Multi.Generic ) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Hier der Log vom Kombo Fix

Was mir jetzt auffällt ist dass meine Desktop Icons sich in letzter zeit nicht verschieben haben lassen nach jedem neustart oder aktualisierung via F5 waren alle icon links am Bild Sortiert. Jetzt nach dem Combofix sind die Icons so wie ich sie mal angeordnet habe :)

Code:

ComboFix 12-07-11.03 - user 12.07.2012   9:40.1.4 - x64

ausgeführt von:: c:\users\user\Desktop\ComboFix.exe

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\assembly\temp\cfg.ini

c:\windows\assembly\tmp\U

c:\windows\SysWow64\drivers\str.sys

c:\windows\SysWow64\muzapp.exe

.

Infizierte Kopie von c:\windows\system32\Services.exe wurde gefunden und desinfiziert 

Kopie von - c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe wurde wiederhergestellt 

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-06-12 bis 2012-07-12  ))))))))))))))))))))))))))))))

.

.

2012-07-12 07:42 . 2012-07-12 07:42        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-07-10 09:59 . 2012-07-10 09:59        --------        d-----w-        C:\_OTL

2012-07-09 12:11 . 2012-07-09 12:11        --------        d-----w-        c:\program files (x86)\JPEG Recovery Pro

2012-07-06 08:15 . 2012-07-06 08:15        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2012-07-06 08:15 . 2012-04-04 13:56        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-06-27 06:41 . 2012-06-27 06:41        --------        d-----w-        c:\program files (x86)\Audacity

2012-06-22 06:50 . 2012-06-22 07:06        --------        d-----w-        c:\program files (x86)\MozBackup

2012-06-22 06:38 . 2012-07-12 07:43        --------        d-----w-        c:\users\user

2012-06-22 06:19 . 2012-06-22 06:19        --------        d-----w-        c:\users\Administrator

2012-06-20 07:44 . 2009-06-18 10:55        18816        ------w-        c:\windows\SysWow64\SAVRKBootTasks.sys

2012-06-19 08:25 . 2012-06-19 08:25        --------        d-----w-        c:\program files (x86)\KeePass Password Safe 2

2012-06-15 07:15 . 2012-06-15 07:15        --------        d-----w-        c:\program files (x86)\Sophos

2012-06-15 06:39 . 2012-06-15 06:39        251488        ----a-w-        c:\windows\system32\drivers\afcdp.sys

2012-06-15 06:39 . 2012-06-15 06:39        1477728        ----a-w-        c:\windows\system32\drivers\tdrpm258.sys

2012-06-13 06:25 . 2012-06-13 06:25        770384        ----a-w-        c:\program files (x86)\Mozilla Firefox\msvcr100.dll

2012-06-13 06:25 . 2012-06-13 06:25        421200        ----a-w-        c:\program files (x86)\Mozilla Firefox\msvcp100.dll

2012-06-12 14:41 . 2012-06-12 14:41        --------        d-----w-        c:\programdata\IObit

2012-06-12 14:41 . 2012-06-12 14:41        --------        d-----w-        c:\program files (x86)\IObit

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-21 14:16 . 2011-03-02 08:59        4354048        ----a-w-        c:\windows\DVAPI32.DLL

2012-06-18 14:56 . 2011-03-02 08:59        9611264        ----a-w-        c:\windows\TOBITCLT.DLL

2012-06-14 06:17 . 2012-04-03 06:24        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-06-14 06:17 . 2011-05-18 08:10        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-04-30 18:56 . 2012-06-06 13:31        63088        ----a-w-        c:\windows\system32\drivers\vmx86.sys

2012-04-30 18:56 . 2012-06-06 13:31        942192        ----a-w-        c:\windows\system32\vnetlib64.dll

2012-04-30 18:56 . 2012-06-06 13:31        354416        ----a-w-        c:\windows\SysWow64\vmnetdhcp.exe

2012-04-30 18:56 . 2012-06-06 13:31        433264        ----a-w-        c:\windows\SysWow64\vmnat.exe

2012-04-30 18:54 . 2012-06-06 13:31        30320        ----a-w-        c:\windows\system32\drivers\vmnetuserif.sys

2012-04-30 16:26 . 2012-04-30 16:26        252016        ----a-w-        c:\windows\SysWow64\vmnc.dll

2012-04-30 15:22 . 2012-04-30 15:22        62064        ----a-w-        c:\windows\system32\vmnetbridge.dll

2012-04-30 15:22 . 2012-04-30 15:22        45680        ----a-w-        c:\windows\system32\drivers\vmnetbridge.sys

2012-04-30 15:22 . 2012-04-30 15:22        24176        ----a-w-        c:\windows\system32\drivers\vmnet.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2011-11-16 107000]

"Second Copy"="c:\program files (x86)\SecCopy\SecCopy.exe" [2008-12-22 2794496]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-04-29 284440]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]

"DV4TS.EXE"="c:\windows\system32\DV4TS.EXE" [2011-10-21 193536]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

TK-Suite Client.lnk - c:\program files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe [2011-10-10 7101952]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"DV4TS.EXE"=c:\windows\system32\DV4TS.EXE

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

.

R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 ctietfjaipsz;ctietfjaipsz;c:\users\user\AppData\Local\Temp\DAT1BE9.tmp.exe [x]

R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-04-29 13592]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]

R3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [2012-06-15 251488]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-02-24 99384]

R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 24904]

R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\738.tmp [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-19 113120]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys [2010-02-24 52224]

R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys [2010-02-24 72192]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-02-24 203320]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [2008-01-25 35112]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-09 1255736]

R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]

S0 mv91xx;mv91xx;c:\windows\System32\drivers\mv91xx.sys [2011-04-26 303408]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2011-11-03 56208]

S0 tdrpman258;Acronis Try&Decide and Restore Points filter (build 258);c:\windows\system32\DRIVERS\tdrpm258.sys [2012-06-15 1477728]

S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [2011-08-08 116336]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-02-14 283200]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-02-19 202752]

S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]

S2 MSSQL$DAVID;SQL Server (DAVID);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]

S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-01-11 240232]

S2 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]

S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [2011-02-25 69904]

S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2010-11-19 1974080]

S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2011-08-29 846448]

S2 VMwareHostd;VMware Workstation Server;c:\program files (x86)\VMware\VMware Workstation\vmware-hostd.exe [2012-04-30 11839488]

S2 vstor2-mntapi10-shared;Vstor2 MntApi 1.0 Driver (shared);SysWOW64\drivers\vstor2-mntapi10-shared.sys [x]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-02-19 6366720]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-02-19 186880]

S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2010-11-15 121832]

S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2010-11-15 364520]

S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-12-28 412776]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2010-10-07 11856]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - IPNAT

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]

"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-03-26 204584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.de/

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105

IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000

LSP: %SystemRoot%\system32\vsocklib.dll

FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bw8mt4vh.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.notify.interval - 600000

FF - user.js: content.switch.threshold - 600000

FF - user.js: nglayout.initialpaint.delay - 600

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MEMSWEEP2]

"ImagePath"="\??\c:\windows\system32\738.tmp"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{47833539-D0C5-4125-9FA8-0819E2EAAC93}"=hex:51,66,7a,6c,4c,1d,38,12,57,36,90,

   43,f7,9e,4b,04,e0,be,4b,59,e7,b4,e8,87

"{724D43A0-0D85-11D4-9908-00400523E39A}"=hex:51,66,7a,6c,4c,1d,38,12,ce,40,5e,

   76,b7,43,ba,54,e6,1e,43,00,00,7d,a7,8e

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,

   1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7

"{1CA1377B-DC1D-4A52-9585-6E06050FAC53}"=hex:51,66,7a,6c,4c,1d,38,12,15,34,b2,

   18,2f,92,3c,0f,ea,93,2d,46,00,51,e8,47

"{724D43A9-0D85-11D4-9908-00400523E39A}"=hex:51,66,7a,6c,4c,1d,38,12,c7,40,5e,

   76,b7,43,ba,54,e6,1e,43,00,00,7d,a7,8e

"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,

   76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{AE7CD045-E861-484F-8273-0445EE161910}"=hex:51,66,7a,6c,4c,1d,38,12,2b,d3,6f,

   aa,53,a6,21,0d,fd,65,47,05,eb,48,5d,04

"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,

   b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

"{F4971EE7-DAA0-4053-9964-665D8EE6A077}"=hex:51,66,7a,6c,4c,1d,38,12,89,1d,84,

   f0,92,94,3d,05,e6,72,25,1d,8b,b8,e4,63

"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,

   2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85

"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,

   fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:7f,ff,79,e5,06,3f,cd,01

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Desktop\NameSpace\{04731B67-D933-450a-90E6-4ACD2E9408FE}]

@Denied: (Full) (Administrators)

@Denied: (Full) (Owner)

@Denied: (Full) (LocalSystem)

@Denied: (Full) (Administrators)

@Denied: (Full) (Users)

@="CLSID_SearchFolder"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

c:\program files (x86)\VMware\VMware Workstation\vmware-authd.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-07-12  09:45:02 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-07-12 07:45

.

Vor Suchlauf: 11 Verzeichnis(se), 56.103.964.672 Bytes frei

Nach Suchlauf: 18 Verzeichnis(se), 55.943.475.200 Bytes frei

.

- - End Of File - - 3F9CD111A8153917A28381959593D719

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

Firefox::

FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bw8mt4vh.default\

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.notify.interval - 600000

FF - user.js: content.switch.threshold - 600000

FF - user.js: nglayout.initialpaint.delay - 600
 

File::

c:\users\user\AppData\Local\Temp\DAT1BE9.tmp.exe

c:\windows\system32\738.tmp
 

Driver::

ctietfjaipsz

MEMSWEEP2

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Combofix Logfile:

Code:

ComboFix 12-07-12.02 - user 12.07.2012  14:24:45.2.4 - x64

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.6125.4411 [GMT 2:00]

ausgeführt von:: c:\users\user\Desktop\MALWARE_Tools\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\user\Desktop\CFScript.txt

AV: Trend Micro Security Agent *Disabled/Updated* {7193B549-236F-55EE-9AEC-F65279E59A92}

SP: Trend Micro Security Agent *Disabled/Updated* {CAF254AD-0555-5A60-A05C-CD200262D02F}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\users\user\AppData\Local\Temp\DAT1BE9.tmp.exe"

"c:\windows\system32\738.tmp"

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_ctietfjaipsz

-------\Service_MEMSWEEP2

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-06-12 bis 2012-07-12  ))))))))))))))))))))))))))))))

.

.

2012-07-12 12:27 . 2012-07-12 12:27        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-07-12 07:46 . 2012-06-02 22:19        2428952        ----a-w-        c:\windows\system32\wuaueng.dll

2012-07-12 07:46 . 2012-06-02 22:19        57880        ----a-w-        c:\windows\system32\wuauclt.exe

2012-07-12 07:46 . 2012-06-02 22:19        44056        ----a-w-        c:\windows\system32\wups2.dll

2012-07-12 07:46 . 2012-06-02 22:15        2622464        ----a-w-        c:\windows\system32\wucltux.dll

2012-07-12 07:46 . 2012-06-02 22:19        38424        ----a-w-        c:\windows\system32\wups.dll

2012-07-12 07:46 . 2012-06-02 22:19        701976        ----a-w-        c:\windows\system32\wuapi.dll

2012-07-12 07:46 . 2012-06-02 22:15        99840        ----a-w-        c:\windows\system32\wudriver.dll

2012-07-12 07:46 . 2012-06-02 13:19        186752        ----a-w-        c:\windows\system32\wuwebv.dll

2012-07-12 07:46 . 2012-06-02 13:15        36864        ----a-w-        c:\windows\system32\wuapp.exe

2012-07-10 09:59 . 2012-07-10 09:59        --------        d-----w-        C:\_OTL

2012-07-09 12:11 . 2012-07-09 12:11        --------        d-----w-        c:\program files (x86)\JPEG Recovery Pro

2012-07-06 08:15 . 2012-07-06 08:15        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2012-07-06 08:15 . 2012-04-04 13:56        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-06-27 06:41 . 2012-06-27 06:41        --------        d-----w-        c:\program files (x86)\Audacity

2012-06-22 06:50 . 2012-06-22 07:06        --------        d-----w-        c:\program files (x86)\MozBackup

2012-06-22 06:38 . 2012-07-12 07:55        --------        d-----w-        c:\users\user

2012-06-22 06:19 . 2012-06-22 06:19        --------        d-----w-        c:\users\Administrator

2012-06-20 07:44 . 2009-06-18 10:55        18816        ------w-        c:\windows\SysWow64\SAVRKBootTasks.sys

2012-06-19 08:25 . 2012-06-19 08:25        --------        d-----w-        c:\program files (x86)\KeePass Password Safe 2

2012-06-15 07:15 . 2012-06-15 07:15        --------        d-----w-        c:\program files (x86)\Sophos

2012-06-15 06:39 . 2012-06-15 06:39        251488        ----a-w-        c:\windows\system32\drivers\afcdp.sys

2012-06-15 06:39 . 2012-06-15 06:39        1477728        ----a-w-        c:\windows\system32\drivers\tdrpm258.sys

2012-06-13 06:25 . 2012-06-13 06:25        770384        ----a-w-        c:\program files (x86)\Mozilla Firefox\msvcr100.dll

2012-06-13 06:25 . 2012-06-13 06:25        421200        ----a-w-        c:\program files (x86)\Mozilla Firefox\msvcp100.dll

2012-06-12 14:41 . 2012-06-12 14:41        --------        d-----w-        c:\programdata\IObit

2012-06-12 14:41 . 2012-06-12 14:41        --------        d-----w-        c:\program files (x86)\IObit

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-21 14:16 . 2011-03-02 08:59        4354048        ----a-w-        c:\windows\DVAPI32.DLL

2012-06-18 14:56 . 2011-03-02 08:59        9611264        ----a-w-        c:\windows\TOBITCLT.DLL

2012-06-14 06:17 . 2012-04-03 06:24        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-06-14 06:17 . 2011-05-18 08:10        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-04-30 18:56 . 2012-06-06 13:31        63088        ----a-w-        c:\windows\system32\drivers\vmx86.sys

2012-04-30 18:56 . 2012-06-06 13:31        942192        ----a-w-        c:\windows\system32\vnetlib64.dll

2012-04-30 18:56 . 2012-06-06 13:31        354416        ----a-w-        c:\windows\SysWow64\vmnetdhcp.exe

2012-04-30 18:56 . 2012-06-06 13:31        433264        ----a-w-        c:\windows\SysWow64\vmnat.exe

2012-04-30 18:54 . 2012-06-06 13:31        30320        ----a-w-        c:\windows\system32\drivers\vmnetuserif.sys

2012-04-30 16:26 . 2012-04-30 16:26        252016        ----a-w-        c:\windows\SysWow64\vmnc.dll

2012-04-30 15:22 . 2012-04-30 15:22        62064        ----a-w-        c:\windows\system32\vmnetbridge.dll

2012-04-30 15:22 . 2012-04-30 15:22        45680        ----a-w-        c:\windows\system32\drivers\vmnetbridge.sys

2012-04-30 15:22 . 2012-04-30 15:22        24176        ----a-w-        c:\windows\system32\drivers\vmnet.sys

.

.

(((((((((((((((((((((((((((((   SnapShot@2012-07-12_07.43.14   )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-11-21 03:09 . 2012-07-12 07:56        44558              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2009-07-14 05:10 . 2012-07-12 07:56        40536              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

- 2012-05-07 06:44 . 2011-02-25 10:09        69904              c:\windows\system32\drivers\tmevtmgr.sys

+ 2012-05-07 06:44 . 2011-06-23 09:34        69904              c:\windows\system32\drivers\tmevtmgr.sys

+ 2012-05-07 06:44 . 2011-06-23 09:34        90896              c:\windows\system32\drivers\tmactmon.sys

- 2012-05-07 06:44 . 2011-02-25 10:10        90896              c:\windows\system32\drivers\tmactmon.sys

+ 2012-06-02 13:19 . 2012-06-02 13:19        79232              c:\windows\SoftwareDistribution\SelfUpdate\Handler\WuSetupV.exe

+ 2011-10-05 11:24 . 2012-07-12 07:56        9028              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4097306890-2138770997-1041978500-1118_UserData.bin

+ 2012-07-12 12:27 . 2012-07-12 12:27        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2012-07-12 07:43 . 2012-07-12 07:43        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2009-07-14 02:36 . 2012-07-12 08:03        715792              c:\windows\system32\perfh009.dat

- 2009-07-14 02:36 . 2012-06-21 13:09        715792              c:\windows\system32\perfh009.dat

+ 2010-11-21 06:50 . 2012-07-12 08:03        761080              c:\windows\system32\perfh007.dat

- 2010-11-21 06:50 . 2012-06-21 13:09        761080              c:\windows\system32\perfh007.dat

+ 2009-07-14 02:36 . 2012-07-12 08:03        144164              c:\windows\system32\perfc009.dat

- 2009-07-14 02:36 . 2012-06-21 13:09        144164              c:\windows\system32\perfc009.dat

- 2010-11-21 06:50 . 2012-06-21 13:09        171376              c:\windows\system32\perfc007.dat

+ 2010-11-21 06:50 . 2012-07-12 08:03        171376              c:\windows\system32\perfc007.dat

- 2012-05-07 06:44 . 2011-02-25 10:09        146192              c:\windows\system32\drivers\tmcomm.sys

+ 2012-05-07 06:44 . 2011-06-23 09:34        146192              c:\windows\system32\drivers\tmcomm.sys

+ 2009-07-14 04:46 . 2012-07-12 07:57        109704              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat

+ 2009-07-14 05:01 . 2012-07-12 12:27        966952              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

- 2009-07-14 05:01 . 2012-07-12 07:42        966952              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2009-07-14 04:45 . 2012-07-12 07:57        7584621              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat

- 2009-07-14 04:45 . 2012-06-15 06:42        7584621              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat

+ 2012-07-10 11:49 . 2012-07-12 12:27        2518424              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4097306890-2138770997-1041978500-1118-8192.dat

+ 2009-07-14 02:34 . 2012-07-12 07:54        10485760              c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT

- 2009-07-14 02:34 . 2012-05-09 09:06        10485760              c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT

+ 2011-11-22 20:53 . 2011-11-22 20:53        12086784              c:\windows\Installer\214c12.msi

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2011-11-16 107000]

"Second Copy"="c:\program files (x86)\SecCopy\SecCopy.exe" [2008-12-22 2794496]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-04-29 284440]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]

"DV4TS.EXE"="c:\windows\system32\DV4TS.EXE" [2011-10-21 193536]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

TK-Suite Client.lnk - c:\program files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe [2011-10-10 7101952]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"DV4TS.EXE"=c:\windows\system32\DV4TS.EXE

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

.

R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-04-29 13592]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]

R3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [2012-06-15 251488]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-02-24 99384]

R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 24904]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-19 113120]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys [2010-02-24 52224]

R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys [2010-02-24 72192]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-02-24 203320]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [2008-01-25 35112]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-09 1255736]

R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]

S0 mv91xx;mv91xx;c:\windows\System32\drivers\mv91xx.sys [2011-04-26 303408]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2011-11-03 56208]

S0 tdrpman258;Acronis Try&Decide and Restore Points filter (build 258);c:\windows\system32\DRIVERS\tdrpm258.sys [2012-06-15 1477728]

S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [2011-08-08 116336]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-02-14 283200]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-02-19 202752]

S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]

S2 MSSQL$DAVID;SQL Server (DAVID);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]

S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-01-11 240232]

S2 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]

S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [2011-06-23 69904]

S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2010-11-19 1974080]

S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2011-08-29 846448]

S2 VMwareHostd;VMware Workstation Server;c:\program files (x86)\VMware\VMware Workstation\vmware-hostd.exe [2012-04-30 11839488]

S2 vstor2-mntapi10-shared;Vstor2 MntApi 1.0 Driver (shared);SysWOW64\drivers\vstor2-mntapi10-shared.sys [x]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-02-19 6366720]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-02-19 186880]

S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2010-11-15 121832]

S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2010-11-15 364520]

S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-12-28 412776]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2010-10-07 11856]

.

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]

"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-10-17 219480]

"combofix"="c:\combofix\CF342.3XE" [2010-11-21 345088]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.de/

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105

IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000

LSP: %SystemRoot%\system32\vsocklib.dll

FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bw8mt4vh.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{47833539-D0C5-4125-9FA8-0819E2EAAC93}"=hex:51,66,7a,6c,4c,1d,38,12,57,36,90,

   43,f7,9e,4b,04,e0,be,4b,59,e7,b4,e8,87

"{724D43A0-0D85-11D4-9908-00400523E39A}"=hex:51,66,7a,6c,4c,1d,38,12,ce,40,5e,

   76,b7,43,ba,54,e6,1e,43,00,00,7d,a7,8e

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,

   1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7

"{1CA1377B-DC1D-4A52-9585-6E06050FAC53}"=hex:51,66,7a,6c,4c,1d,38,12,15,34,b2,

   18,2f,92,3c,0f,ea,93,2d,46,00,51,e8,47

"{724D43A9-0D85-11D4-9908-00400523E39A}"=hex:51,66,7a,6c,4c,1d,38,12,c7,40,5e,

   76,b7,43,ba,54,e6,1e,43,00,00,7d,a7,8e

"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,

   76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{AE7CD045-E861-484F-8273-0445EE161910}"=hex:51,66,7a,6c,4c,1d,38,12,2b,d3,6f,

   aa,53,a6,21,0d,fd,65,47,05,eb,48,5d,04

"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,

   b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

"{F4971EE7-DAA0-4053-9964-665D8EE6A077}"=hex:51,66,7a,6c,4c,1d,38,12,89,1d,84,

   f0,92,94,3d,05,e6,72,25,1d,8b,b8,e4,63

"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,

   2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85

"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,

   fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:7f,ff,79,e5,06,3f,cd,01

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Desktop\NameSpace\{04731B67-D933-450a-90E6-4ACD2E9408FE}]

@Denied: (Full) (Administrators)

@Denied: (Full) (Owner)

@Denied: (Full) (LocalSystem)

@Denied: (Full) (Administrators)

@Denied: (Full) (Users)

@="CLSID_SearchFolder"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

c:\program files (x86)\VMware\VMware Workstation\vmware-authd.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-07-12  14:29:54 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-07-12 12:29

ComboFix2.txt  2012-07-12 07:45

.

Vor Suchlauf: 17 Verzeichnis(se), 55.199.891.456 Bytes frei

Nach Suchlauf: 19 Verzeichnis(se), 54.914.842.624 Bytes frei

.

- - End Of File - - 13F212861F80BA9E01BA3CB852DDECA6

--- --- ---

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

GMER hatt abgeschlossen ohne Funde

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 16:29:54 on 12.07.2012
 

OS: Windows 7  Service Pack 1 (Build 7601), 64-bit

Default Browser: Mozilla Corporation Firefox 13.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\MLCFG32.CPL

"QuickTime" - "Apple Inc." - C:\Program Files (x86)\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Acronis Try&Decide and Restore Points filter (build 258)" (tdrpman258) - "Acronis" - C:\Windows\System32\DRIVERS\tdrpm258.sys

"adfs" (adfs) - "Adobe Systems, Inc." - C:\Windows\system32\drivers\adfs.sys

"afcdp" (afcdp) - "Acronis" - C:\Windows\System32\DRIVERS\afcdp.sys

"BlackBerry-Smartphone" (RimUsb) - ? - C:\Windows\System32\Drivers\RimUsb_AMD64.sys  (File not found)

"Boot Tasks Driver" (SAVRKBootTasks) - ? - C:\Windows\system32\SAVRKBootTasks.sys  (File not found)

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"dgderdrv" (dgderdrv) - ? - C:\Windows\System32\drivers\dgderdrv.sys  (File not found)

"tmactmon" (tmactmon) - "Trend Micro Inc." - C:\Windows\System32\DRIVERS\tmactmon.sys

"tmcomm" (tmcomm) - "Trend Micro Inc." - C:\Windows\System32\DRIVERS\tmcomm.sys

"tmevtmgr" (tmevtmgr) - "Trend Micro Inc." - C:\Windows\System32\DRIVERS\tmevtmgr.sys

"Trend Micro TDI Driver" (tmtdi) - "Trend Micro Inc." - C:\Windows\System32\DRIVERS\tmtdi.sys

"TuneUpUtilitiesDrv" (TuneUpUtilitiesDrv) - "TuneUp Software" - C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys

"VMware hcmon" (hcmon) - "VMware, Inc." - C:\Windows\system32\drivers\hcmon.sys

"VMware Network Application Interface" (VMnetuserif) - "VMware, Inc." - C:\Windows\system32\drivers\vmnetuserif.sys

"VMware Virtual Ethernet Adapter Driver" (VMnetAdapter) - ? - C:\Windows\System32\DRIVERS\vmnetadapter.sys  (File not found)

"VMware vmx86" (vmx86) - "VMware, Inc." - C:\Windows\system32\drivers\vmx86.sys

"Vstor2 MntApi 1.0 Driver (shared)" (vstor2-mntapi10-shared) - "VMware, Inc." - C:\Windows\SysWOW64\drivers\vstor2-mntapi10-shared.sys
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{8EF5DC20-419C-4E43-A088-DE5B5625CA47} "{8EF5DC20-419C-4E43-A088-DE5B5625CA47}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll

{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

{0B37915C-8B98-4B9E-80D4-464D2C830D10} "TBProtocol Class" - "Trend Micro Inc." - C:\Program Files\Trend Micro\Security Agent\UIFramework\ProToolbarIMRatingActiveX.dll

{0E526CB5-7446-41D1-A403-19BFE95E8C23} "TmIEPlugInAPP Class" - "Trend Micro Inc." - C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1242\6.6.1089\TmIEPlg32.dll

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat Elements\ContextMenu.dll

{5E2121EE-0300-11D4-8D3B-444553540000} "Catalyst Context Menu extension" - ? -   (File not found | COM-object registry key not found)

{DE902992-61FC-4A01-8091-53E1895C9775} "CDR Icon Handler" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{7AD101F2-0B93-4D66-A1CA-DF73F3C4377B} "CDR preview provider" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell Extension\ShellVista.dll

{7FA63AC0-F5BC-4F3B-A9CF-94328D812B62} "CDR Property Handler" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell Extension\ShellVista.dll

{1462EBAA-96E7-4D93-9A66-0E4068DE4FCF} "CDR Thumbnail provider" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\VISSHE.DLL

{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll

{DE902994-61FC-4A01-8091-53E1895C9775} "CMX Icon Handler" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{1462EBAC-96E7-4D93-9A66-0E4068DE4FCF} "CMX Thumbnail provider" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{DE902993-61FC-4A01-8091-53E1895C9775} "CPT Icon Handler" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{7FA63AC1-F5BC-4F3B-A9CF-94328D812B62} "CPT Property Handler" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell Extension\ShellVista.dll

{1462EBAB-96E7-4D93-9A66-0E4068DE4FCF} "CPT Thumbnail provider" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" - "DivX, Inc." - C:\Program Files (x86)\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll

{83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" - "DivX, Inc." - C:\Program Files (x86)\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll

{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\VISSHE.DLL

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll

{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONFILTER.DLL

{00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\MLSHEXT.DLL

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL

{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - C:\Program Files (x86)\TuneUp Utilities 2011\DseShExt-x86.dll

{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - C:\Program Files (x86)\TuneUp Utilities 2011\SDShelEx-win32.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "&RoboForm" - "Siber Systems Inc." - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll

<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{0D41B8C5-2599-4893-8183-00195EC8D5F9} "asusTek_sysctrl Class" - ? - C:\Windows\DOWNLO~1\asusTek_sys_ctrl.dll / hxxp://support.asus.de/common/asusTek_sys_ctrl.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{5DA9D8E0-5A57-11CF-9E36-00C0930198C0} "Pegasus ImagN' 32-bit (Windowed) ActiveX Control v4.00" - "Pegasus Software, LLC." - C:\Windows\SysWOW64\IMW32O40.OCX / hxxp://192.168.13.150/LNetCam.cab

{7530BFB8-7293-4D34-9923-61A11451AFC5} "{7530BFB8-7293-4D34-9923-61A11451AFC5}" - ? -   (File not found | COM-object registry key not found) / hxxp://download.eset.com/special/eos/OnlineScanner.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL

{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "&RoboForm" - "Siber Systems Inc." - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll

<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{AE7CD045-E861-484f-8273-0445EE161910} "Adobe PDF Conversion Toolbar Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL

{F4971EE7-DAA0-4053-9964-665D8EE6A077} "SmartSelect Class" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

{1CA1377B-DC1D-4A52-9585-6E06050FAC53} "TmIEPlugInBHO Class" - "Trend Micro Inc." - C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1242\6.6.1089\TmIEPlg32.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{724d43a9-0d85-11d4-9908-00400523e39a} "{724d43a9-0d85-11d4-9908-00400523e39a}" - "Siber Systems Inc." - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"TK-Suite Client.lnk" - "AGFEO      " - C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe  (Shortcut exists | File exists)

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"RoboForm" - "Siber Systems" - "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"

"Second Copy" - "Centered Systems" - "C:\Program Files (x86)\SecCopy\SecCopy.exe"

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"DV4TS.EXE" - ? - c:\windows\system32\DV4TS.EXE  (File not found)

"IAStorIcon" - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

"NUSB3MON" - "Renesas Electronics Corporation" - "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Fax-Image Monitor" - "Tobit Software" - C:\Windows\faximgmo.dll

"FaxWare Monitor" - "Tobit Software" - C:\Windows\faxwarmo.dll

"KM Language Monitor" - "KYOCERA MITA Corporation" - C:\Windows\system32\KMPJL64.DLL

"Tobit Color Monitor" - ? - C:\Windows\IMGMSGMO.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)

"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)

"@%SystemRoot%\System32\uxtuneup.dll,-4096" (UxTuneUp) - "TuneUp Software" - C:\Windows\System32\uxtuneup.dll

"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

"HP Network Devices Support" (HPSLPSVC) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL

"Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe

"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll

"Protexis Licensing V2" (PSI_SVC_2) - "Protexis Inc." - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe

"SQL Server (DAVID)" (MSSQL$DAVID) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

"SwitchBoard" (SwitchBoard) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

"TeamViewer 5" (TeamViewer5) - "TeamViewer GmbH" - C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe

"Trend Micro Security Agent Communicator" (TmListen) - "Trend Micro Inc." - C:\Program Files\Trend Micro\Security Agent\tmlisten.exe

"Trend Micro Solution Platform" (Amsp) - "Trend Micro Inc." - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe

"TuneUp Utilities Service" (TuneUp.UtilitiesSvc) - "TuneUp Software" - C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe

"VMware Authorization Service" (VMAuthdService) - "VMware, Inc." - C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe

"VMware USB Arbitration Service" (VMUSBArbService) - "VMware, Inc." - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe

"VMware Workstation Server" (VMwareHostd) - ? - C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe  (File found, but it contains no detailed information)
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"VMCI sockets DGRAM" - "VMware, Inc." - C:\Windows\system32\vsocklib.dll

"VMCI sockets STREAM" - "VMware, Inc." - C:\Windows\system32\vsocklib.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
[/CODE]

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-07-12 16:37:20

-----------------------------

16:37:20.231    OS Version: Windows x64 6.1.7601 Service Pack 1

16:37:20.232    Number of processors: 4 586 0x2A07

16:37:20.232    ComputerName: PCUSER  UserName: user

16:37:20.510    Initialize success

16:37:23.250    AVAST engine defs: 12071200

16:37:28.588    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

16:37:28.589    Disk 0 Vendor: OCZ-VERT 1.35 Size: 109704MB BusType: 3

16:37:28.590    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2

16:37:28.591    Disk 1 Vendor: ST350041 CC44 Size: 476940MB BusType: 3

16:37:28.596    Disk 0 MBR read successfully

16:37:28.598    Disk 0 MBR scan

16:37:28.600    Disk 0 Windows 7 default MBR code

16:37:28.602    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       109701 MB offset 63

16:37:28.609    Disk 0 scanning C:\Windows\system32\drivers

16:37:31.944    Service scanning

16:37:38.520    Modules scanning

16:37:38.524    Disk 0 trace - called modules:

16:37:38.528    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 

16:37:38.531    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8008806060]

16:37:38.533    3 CLASSPNP.SYS[fffff88001fa043f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8005f87050]

16:37:38.535    Scan finished successfully

16:38:09.899    Disk 0 MBR has been saved successfully to "C:\Users\user\Desktop\MBR.dat"

16:38:09.902    The log file has been saved successfully to "C:\Users\user\Desktop\aswMBR.txt"

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Ich habe jetzt auf der C partition Ordner wie _OTL und Qoodox was kann ich jetzt mit diesen ordnern machen kann ich die Löschen oder wie soll ich damit umgehen?

Malwarebytes hatt nichts gefunden

hier der Log vom SuperAntiSpyware

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 07/13/2012 at 10:57 AM
 

Application Version : 5.5.1006
 

Core Rules Database Version : 8894

Trace Rules Database Version: 6706
 

Scan type       : Complete Scan

Total Scan Time : 01:26:22
 

Operating System Information

Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Limited User
 

Memory items scanned      : 621

Memory threats detected   : 0

Registry items scanned    : 72370

Registry threats detected : 0

File items scanned        : 419486

File threats detected     : 5
 

Adware.Tracking Cookie

        C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\KYSVSN0G.txt [ /doubleclick.net ]

        C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\KWNXWQ1C.txt [ /xiti.com ]

        C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\WFR4QXAM.txt [ /de.sitestat.com ]

        C:\USERS\user\Cookies\KWNXWQ1C.txt [ Cookie:user@xiti.com/ ]

        C:\USERS\user\Cookies\WFR4QXAM.txt [ Cookie:user@de.sitestat.com/idgcom-de/channelpartner/ ]

Das Log von Malwarebytes will ich trotzdem sehen

ok kein problem habs nochmal durchlaufen lassen

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.07.16.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

user :: PCUSER [Administrator]
 

16.07.2012 08:23:17

mbam-log-2012-07-16 (08-23-17).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 428439

Laufzeit: 37 Minute(n), 47 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Hallo
Ich benutze eigentlich schon immer den Firefox und lösche automatisch beim Beenden immer alle Temp, Cache & Cookie dateien.

Super der Pc scheint wieder alles zu funktunieren und Viren/Malware Meldungen habe ich auch keine mehr. Wie soll ich denn jetzt mit den Ordnern auf meiner C: Partition verfahren z.b: c:\_OTL oder c:\Qoobox kann ich die einfach löschen?

1000 Dank nochmal für eure tolle Hilfe ihr seit echt ein Spitze Board!! Hut ab!

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => http://www.adobe.com/software/flash/about/
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.