Trojaner-Board - GVU-Trojaner

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - GVU-Trojaner (https://www.trojaner-board.de/118681-gvu-trojaner.html)

Hallo zusammen,

nachdem bei meiner Frau der BKA-Trojaner aufgetaucht war (beseitigt durch Neu-Aufspielen von Windows und sicher machen mit Eurer Hilfe), hat sich nun meine Tochter den GVU-Trojaner eingefangen. Da sie Studentin ist und viele Dateien auf dem Notebook hat, die sie dringend benötigt (steckt mitten in der Prüfung), möchte ich das System ungern neu aufspielen. Lieber ist mir ein restloses Entfernen des Trojaners. Hoffe dabei auf Eure Hilfe.

Nachdem der Trojaner aufgetaucht war, hat meine Tochter versucht, ihn mit folgender Anleitung zu entfernen:
hxxp://www.chip.de/bildergalerie/WindowsUnlocker-Starkes-Tool-gegen-Bundespolizei-Virus-Co.-Galerie_54218633.html
Dabei war sie leider nicht erfolgreich. Daraufhin hat sie mich angerufen und informiert. Nun unterstütze ich sie beim Bereinigen, indem ich mich an Euch wende.
Wir haben bereits mit OTLPENet.exe eine BOOT-CD erstellt und nach Anleitung die LOG-Dateien im Anhang beigefügt.

Auf dem Notebook befindet sich ein 64 Bit Windows 7 Home Premium.

Vielen Dank für jede Hilfe!

Funktioniert noch der abgesicherte Modus mit Netzwerktreibern? Mit Internetverbindung?

Abgesicherter Modus zur Bereinigung

Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

Ja, der abgesicherte Modus geht noch. Damit haben wir OTLPENet.exe heruntergeladen, die BOOT-CD erstellt und gescannt.

Malwarebytes Anti-Malware haben wir auch bereits nach Anleitung eingesetzt. Dabei wurde genau eine infizierte Datei gefunden (siehe Logdatei im Anhang). Diese haben wir entfernt. Seitdem können wir den PC auch wieder normal starten, der Trojaner scheint entfernt zu sein. Aber wir wissen natürlich nicht, ob er sich noch irgendwo versteckt hat...

Bitte erstmal routinemäßig einen neuen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

So, Scans sind durchgeführt, hier die Ergebnisse:

1. Scan mit Malwarebytes:

Code:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.07.11.06
 

Windows 7 x64 NTFS

Internet Explorer 8.0.7600.16385

Julia :: JULIA [Administrator]
 

11.07.2012 16:37:23

mbam-log-2012-07-11 (16-37-23).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 384587

Laufzeit: 1 Stunde(n), 17 Minute(n), 47 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Und hier noch einmal der Ergebnis von dem Scan, den wir am 06.07.2012 durchgeführt haben:

Code:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.07.06.05
 

Windows 7 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)

Internet Explorer 8.0.7600.16385

Julia :: JULIA [Administrator]
 

06.07.2012 15:52:49

mbam-log-2012-07-06 (15-52-49).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 378364

Laufzeit: 53 Minute(n), 17 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\Users\Julia\AppData\Local\Temp\0_0u_l.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Und hier das Ergebnis von ESET:

Code:

ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=6f0b091fb28086409ea6c758cc6ba2d1

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-07-11 08:43:44

# local_time=2012-07-11 10:43:44 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=5.1.2600 NT Service Pack 2

# compatibility_mode=1797 16775165 100 94 376335 78557492 281328 0

# compatibility_mode=5893 16776574 100 94 0 93655479 0 0

# compatibility_mode=8192 67108863 100 0 390 390 0 0

# scanned=168349

# found=1

# cleaned=0

# scan_time=13795

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\2dfb69fa-666b9977        Java/Exploit.CVE-2012-0507.CU trojan (unable to clean)        00000000000000000000000000000000        I

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Ja, es funktioniert wieder alles normal, und es fehlt nichts, zumindest sind mir keine leeren Ordner aufgefallen...

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Hier ist das Ergebnis des Adw-Cleaner:

Code:

# AdwCleaner v1.701 - Logfile created 07/12/2012 at 19:35:58

# Updated 02/07/2012 by Xplode

# Operating system : Windows 7 Home Premium  (64 bits)

# User : Julia - JULIA

# Running from : C:\Users\Julia\Desktop\adwcleaner.exe

# Option [Search]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 
 

***** [Registry] *****
 
 

***** [Registre - GUID] *****
 
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v8.0.7600.16385
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v13.0.1 (de)
 

Profile name : default 

File : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\zvhu1dy6.default\prefs.js
 

[OK] File is clean.
 

*************************
 

AdwCleaner[R1].txt - [687 octets] - [12/07/2012 19:35:58]
 

########## EOF - C:\AdwCleaner[R1].txt - [814 octets] ##########

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hier das Ergebnis:

Code:

OTL logfile created on: 7/13/2012 5:04:54 PM - Run 1

OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Julia\Desktop

64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3.79 Gb Total Physical Memory | 2.43 Gb Available Physical Memory | 64.05% Memory free

5.19 Gb Paging File | 3.56 Gb Available in Paging File | 68.50% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 285.99 Gb Total Space | 3.58 Gb Free Space | 1.25% Space Free | Partition Type: NTFS

 

Computer Name: JULIA | User Name: Julia | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012/07/13 17:02:04 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe

PRC - [2012/06/27 09:25:06 | 001,326,176 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe

PRC - [2012/06/27 09:25:04 | 000,681,056 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\sua.exe

PRC - [2012/06/27 09:25:04 | 000,572,000 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\psi_tray.exe

PRC - [2012/03/14 13:04:52 | 006,041,192 | ---- | M] (AnVir Software) -- C:\Program Files (x86)\AnVir Task Manager\AnVir.exe

PRC - [2012/01/03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011/08/30 18:18:30 | 002,358,656 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe

PRC - [2011/07/03 16:03:25 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2011/04/21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2011/04/21 07:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010/10/27 19:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

PRC - [2010/09/13 16:01:34 | 001,695,816 | ---- | M] (Elgato Systems) -- C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe

PRC - [2010/08/25 11:27:44 | 000,309,824 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

PRC - [2010/06/05 02:00:28 | 002,486,272 | ---- | M] (Micro-Star International Co., Ltd.) -- C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe

PRC - [2010/05/16 23:40:00 | 001,349,632 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe

PRC - [2010/05/05 16:20:00 | 001,604,200 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

PRC - [2010/04/13 18:57:58 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

PRC - [2010/04/13 18:57:56 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

PRC - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

PRC - [2009/09/30 15:01:32 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

PRC - [2009/09/30 15:01:30 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

PRC - [2009/09/23 16:45:50 | 001,287,176 | ---- | M] (Panda Security) -- C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe

PRC - [2009/08/27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

PRC - [2009/07/10 00:54:42 | 000,160,768 | ---- | M] (Micro-Star International Co., Ltd.) -- C:\Program Files (x86)\System Control Manager\MSIService.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012/06/15 09:21:33 | 001,670,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\3eaec5bc57c67c3b24ca2bb281ca249d\Microsoft.VisualBasic.ni.dll

MOD - [2012/06/14 21:42:15 | 014,325,760 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\517358eb2fd962a942dd1ea6afc5b93e\PresentationFramework.ni.dll

MOD - [2012/06/14 21:41:26 | 012,433,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll

MOD - [2012/06/14 21:41:14 | 001,591,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll

MOD - [2012/06/14 21:41:04 | 012,218,880 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\e9d0ba41128f363f2390c7e630129c2b\PresentationCore.ni.dll

MOD - [2012/05/11 18:29:34 | 000,452,608 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\68eb2c96de3918a4757f5f768dc671c7\IAStorUtil.ni.dll

MOD - [2012/05/11 17:50:40 | 000,368,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\fc626095c194be137bceb219934b06a7\PresentationFramework.Aero.ni.dll

MOD - [2012/05/11 17:50:19 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll

MOD - [2012/05/11 17:49:25 | 003,325,952 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\b68fdf2c95b93fc5006a092c11eed07c\WindowsBase.ni.dll

MOD - [2012/05/11 17:49:19 | 005,453,312 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll

MOD - [2012/05/11 17:49:16 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll

MOD - [2012/05/11 17:49:14 | 007,952,384 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll

MOD - [2012/05/11 17:49:06 | 011,490,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll

MOD - [2011/11/02 00:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2011/11/02 00:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2010/06/12 03:25:21 | 000,249,856 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll

MOD - [2010/06/12 03:24:54 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2010/05/17 21:56:42 | 000,155,648 | ---- | M] () -- C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\de-DE\THXAudio.resources.dll

MOD - [2010/05/04 19:59:00 | 000,182,272 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2009/07/14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2012/07/12 11:50:47 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012/07/03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012/06/27 09:25:06 | 001,326,176 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)

SRV - [2012/06/27 09:25:04 | 000,681,056 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\sua.exe -- (Secunia Update Agent)

SRV - [2012/06/20 00:20:23 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012/01/03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011/08/30 18:18:30 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)

SRV - [2011/07/03 16:03:25 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011/04/21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2010/05/05 16:20:00 | 001,604,200 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2010/04/13 18:57:58 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)

SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)

SRV - [2009/09/30 15:01:32 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)

SRV - [2009/09/30 15:01:30 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)

SRV - [2009/08/27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)

SRV - [2009/07/10 00:54:42 | 000,160,768 | ---- | M] (Micro-Star International Co., Ltd.) [Auto | Running] -- C:\Program Files (x86)\System Control Manager\MSIService.exe -- (Micro Star SCM)

SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2008/08/07 11:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\msi\msi Software Install\MGHwCtrl.sys -- (MGHwCtrl)

DRV:64bit: - [2012/07/05 17:55:07 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)

DRV:64bit: - [2012/03/01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2012/02/15 12:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2011/12/16 16:20:10 | 000,017,976 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\psi_mf.sys -- (PSI)

DRV:64bit: - [2011/07/03 16:03:25 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2011/07/03 16:03:25 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2011/04/13 15:04:38 | 000,045,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)

DRV:64bit: - [2011/03/30 13:05:55 | 000,035,112 | ---- | M] (TeamViewer GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\teamviewervpn.sys -- (teamviewervpn)

DRV:64bit: - [2011/03/11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011/03/11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010/04/21 06:18:44 | 010,326,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2010/04/13 18:44:22 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2010/03/04 16:43:00 | 000,346,144 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2010/02/26 11:32:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)

DRV:64bit: - [2010/02/10 12:16:10 | 000,572,608 | ---- | M] (TerraTec Electronic GmbH.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\UDST7000Bda.sys -- (UDST7000BDA)

DRV:64bit: - [2010/02/10 12:16:10 | 000,025,664 | ---- | M] (TerraTec Electronic GmbH.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\UDST7000HID.sys -- (UDST7000HID)

DRV:64bit: - [2010/02/03 01:38:30 | 000,271,872 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)

DRV:64bit: - [2010/01/18 14:37:56 | 000,128,512 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)

DRV:64bit: - [2010/01/13 02:37:18 | 007,675,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) Intel(R)

DRV:64bit: - [2009/12/05 03:50:22 | 000,087,888 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\EUCR6SK.sys -- (EUCR)

DRV:64bit: - [2009/11/18 16:12:00 | 000,032,344 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MBfilt64.sys -- (MBfilt)

DRV:64bit: - [2009/11/17 10:16:44 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.sys -- (SSPORT)

DRV:64bit: - [2009/09/17 07:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)

DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009/07/14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009/07/14 01:31:10 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)

DRV:64bit: - [2009/06/10 23:01:14 | 001,227,776 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SmSerl64.sys -- (smserial)

DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009/05/26 23:32:04 | 000,019,968 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys -- (ArcSoftKsUFilter)

DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)

DRV - [2009/10/28 07:09:33 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\SSPORT.SYS -- (SSPORT)

DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {380034B8-F238-4333-838A-E5EB888D7533}

IE:64bit: - HKLM\..\SearchScopes\{380034B8-F238-4333-838A-E5EB888D7533}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=MSITDF&pc=MAMI&src=IE-SearchBox

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {A5E7E3BF-B635-4287-B993-8A2C67E952C1}

IE - HKLM\..\SearchScopes\{A5E7E3BF-B635-4287-B993-8A2C67E952C1}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=MSITDF&pc=MAMI&src=IE-SearchBox

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-3739223292-1581300056-612234262-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://msi.msn.com

IE - HKU\S-1-5-21-3739223292-1581300056-612234262-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://msi.msn.com

 

IE - HKU\S-1-5-21-3739223292-1581300056-612234262-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://msi.msn.com

IE - HKU\S-1-5-21-3739223292-1581300056-612234262-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://msi.msn.com

IE - HKU\S-1-5-21-3739223292-1581300056-612234262-1001\..\SearchScopes,DefaultScope = {A5E7E3BF-B635-4287-B993-8A2C67E952C1}

IE - HKU\S-1-5-21-3739223292-1581300056-612234262-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3739223292-1581300056-612234262-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/06 20:47:03 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012/07/10 20:11:46 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/06 20:47:03 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2011/07/02 12:29:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julia\AppData\Roaming\mozilla\Extensions

[2012/07/11 20:16:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julia\AppData\Roaming\mozilla\Firefox\Profiles\zvhu1dy6.default\extensions

[2012/07/06 19:41:06 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Julia\AppData\Roaming\mozilla\Firefox\Profiles\zvhu1dy6.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2012/03/30 18:02:34 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Julia\AppData\Roaming\mozilla\Firefox\Profiles\zvhu1dy6.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2012/07/06 19:59:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012/07/06 19:59:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2012/06/20 00:20:24 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012/06/20 00:20:21 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012/06/20 00:20:21 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012/06/20 00:20:21 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012/06/20 00:20:21 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012/06/20 00:20:21 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012/06/20 00:20:21 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\PROGRA~2\TerraTec\TERRAT~1\THCDES~1.DLL (TerraTec Electronic GmbH)

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\windows\SysNative\NvCpl.dll (NVIDIA Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [THXCfg64] C:\windows\SysNative\THXCfg64.DLL (Creative Technology Ltd.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe (Micro-Star International Co., Ltd.)

O4 - HKLM..\Run: [THX Audio Control Panel] C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe (Creative Technology Ltd)

O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-3739223292-1581300056-612234262-1000..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-3739223292-1581300056-612234262-1001..\Run: [Remote Control Editor] C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe (Elgato Systems)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-21-3739223292-1581300056-612234262-1000..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\S-1-5-21-3739223292-1581300056-612234262-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\windows\system32\GPhotos.scr/200 File not found

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\windows\SysWow64\GPhotos.scr (Google Inc.)

O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2D15FE74-8863-40C7-813D-A2571063F8F2}: DhcpNameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O20:64bit: - AppInit_DLLs: (C:\windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)

O20 - AppInit_DLLs: (C:\windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O27:64bit: - HKLM IFEO\taskmgr.exe: Debugger - C:\Program Files (x86)\AnVir Task Manager\AnVir.exe (AnVir Software)

O27 - HKLM IFEO\taskmgr.exe: Debugger - C:\Program Files (x86)\AnVir Task Manager\AnVir.exe (AnVir Software)

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

 

 

SafeBootMin:64bit: AppMgmt - Service

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - Service

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\windows\SysWow64\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012/07/13 17:02:00 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe

[2012/07/11 18:47:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012/07/10 20:03:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup

[2012/07/10 20:03:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MozBackup

[2012/07/09 21:57:28 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4

[2012/07/09 21:36:31 | 000,000,000 | ---D | C] -- C:\Users\Julia\Desktop\OpenOffice.org 3.4 (de) Installation Files

[2012/07/07 19:31:06 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\sun

[2012/07/06 20:46:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime

[2012/07/06 20:46:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime

[2012/07/06 20:20:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2012/07/06 20:20:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2012/07/06 20:20:10 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2012/07/06 20:02:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinRAR

[2012/07/06 19:57:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

[2012/07/06 19:55:07 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2012/07/06 19:55:03 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2012/07/06 19:52:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update

[2012/07/06 19:44:30 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\Secunia PSI

[2012/07/06 19:44:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Secunia

[2012/07/06 19:40:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security

[2012/07/06 19:40:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Panda USB Vaccine

[2012/07/06 19:40:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security

[2012/07/05 18:09:02 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\TeamViewer

[2012/07/05 17:54:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LSoft Technologies

[2012/07/05 17:54:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Active@ ISO Burner

[2012/07/05 16:21:24 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\ElevatedDiagnostics

[2012/07/05 16:00:48 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\Malwarebytes

[2012/07/05 16:00:42 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys

[2012/07/05 16:00:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/07/05 16:00:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012/07/05 16:00:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012/06/24 20:15:28 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\Macromedia

[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012/07/13 17:02:04 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe

[2012/07/13 16:50:00 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job

[2012/07/13 13:46:37 | 000,017,376 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012/07/13 13:46:37 | 000,017,376 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012/07/13 13:38:50 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

[2012/07/13 13:38:43 | 3055,681,536 | -HS- | M] () -- C:\hiberfil.sys

[2012/07/12 19:35:11 | 000,618,655 | ---- | M] () -- C:\Users\Julia\Desktop\adwcleaner.exe

[2012/07/12 07:39:19 | 000,297,624 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT

[2012/07/10 20:11:52 | 000,002,015 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk

[2012/07/10 20:03:59 | 000,001,037 | ---- | M] () -- C:\Users\Public\Desktop\MozBackup.lnk

[2012/07/09 21:57:29 | 000,001,172 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.4.lnk

[2012/07/07 10:30:05 | 000,654,400 | ---- | M] () -- C:\windows\SysNative\perfh007.dat

[2012/07/07 10:30:05 | 000,616,242 | ---- | M] () -- C:\windows\SysNative\perfh009.dat

[2012/07/07 10:30:05 | 000,130,240 | ---- | M] () -- C:\windows\SysNative\perfc007.dat

[2012/07/07 10:30:05 | 000,106,622 | ---- | M] () -- C:\windows\SysNative\perfc009.dat

[2012/07/07 10:30:04 | 001,498,742 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI

[2012/07/06 20:46:42 | 000,001,855 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk

[2012/07/06 20:20:13 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2012/07/06 20:00:49 | 000,001,004 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk

[2012/07/06 19:57:39 | 000,001,763 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

[2012/07/06 19:44:01 | 000,001,116 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk

[2012/07/06 15:31:36 | 004,503,728 | ---- | M] () -- C:\ProgramData\l_u0_0.pad

[2012/07/06 01:23:20 | 000,054,120 | ---- | M] () -- C:\OTL.zip

[2012/07/05 17:55:07 | 000,834,544 | ---- | M] () -- C:\windows\SysNative\drivers\sptd.sys

[2012/07/05 16:00:42 | 000,001,119 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012/07/12 19:35:03 | 000,618,655 | ---- | C] () -- C:\Users\Julia\Desktop\adwcleaner.exe

[2012/07/10 20:03:59 | 000,001,037 | ---- | C] () -- C:\Users\Public\Desktop\MozBackup.lnk

[2012/07/09 21:57:29 | 000,001,172 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.4.lnk

[2012/07/06 20:46:42 | 000,001,855 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk

[2012/07/06 20:20:13 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2012/07/06 19:57:39 | 000,001,763 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk

[2012/07/06 19:44:01 | 000,001,116 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk

[2012/07/06 19:44:01 | 000,001,079 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk

[2012/07/06 01:22:59 | 000,054,120 | ---- | C] () -- C:\OTL.zip

[2012/07/05 17:55:07 | 000,834,544 | ---- | C] () -- C:\windows\SysNative\drivers\sptd.sys

[2012/07/05 16:00:42 | 000,001,119 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012/07/04 17:28:26 | 004,503,728 | ---- | C] () -- C:\ProgramData\l_u0_0.pad

[2012/04/07 15:59:04 | 000,000,606 | ---- | C] () -- C:\windows\wiso.ini

[2012/01/05 18:24:42 | 000,482,408 | ---- | C] () -- C:\windows\SSndii.exe

[2012/01/05 18:22:37 | 000,113,768 | ---- | C] () -- C:\windows\Wiainst.exe

[2011/11/27 18:43:54 | 000,003,584 | ---- | C] () -- C:\Users\Julia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/11/26 19:15:25 | 000,000,017 | ---- | C] () -- C:\Users\Julia\AppData\Local\resmon.resmoncfg

[2011/08/26 16:44:35 | 000,000,332 | ---- | C] () -- C:\windows\SIERRA.INI

[2011/07/02 11:56:13 | 000,120,200 | ---- | C] () -- C:\windows\SysWow64\DLLDEV32i.dll

 
 ========== LOP Check ==========

 

[2012/04/07 15:59:11 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Buhl Data Service

[2012/06/04 10:53:44 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\ICQ

[2011/07/03 22:02:09 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\MAGIX

[2011/07/03 17:58:05 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Notepad++

[2011/07/05 17:05:47 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\OpenOffice.org

[2012/07/05 18:09:02 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TeamViewer

[2011/10/26 19:14:45 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TerraTec

[2011/07/03 16:27:07 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Thunderbird

[2011/07/02 13:09:00 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\XMedia Recode

[2012/06/11 10:17:33 | 000,032,632 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011/07/10 13:24:26 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Adobe

[2012/02/22 12:03:36 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Apple Computer

[2011/07/03 21:44:19 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\ArcSoft

[2011/10/24 21:05:47 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Avira

[2012/04/07 15:59:11 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Buhl Data Service

[2012/05/16 17:35:42 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\dvdcss

[2012/06/04 10:53:44 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\ICQ

[2011/07/02 12:03:49 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Identities

[2012/01/05 18:23:09 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\InstallShield

[2011/07/02 12:04:30 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Intel Corporation

[2011/07/02 12:23:13 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Macromedia

[2011/07/03 22:02:09 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\MAGIX

[2012/07/05 16:00:48 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Malwarebytes

[2010/06/12 03:13:22 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Media Center Programs

[2011/07/10 13:24:26 | 000,000,000 | --SD | M] -- C:\Users\Julia\AppData\Roaming\Microsoft

[2011/07/02 12:29:51 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Mozilla

[2011/07/03 17:58:05 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Notepad++

[2011/07/05 17:05:47 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\OpenOffice.org

[2012/07/06 20:27:59 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Skype

[2012/07/05 18:09:02 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TeamViewer

[2011/10/26 19:14:45 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TerraTec

[2011/07/03 16:27:07 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Thunderbird

[2012/07/11 23:35:44 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\vlc

[2011/07/02 13:09:00 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\XMedia Recode

 
 < %APPDATA%\*.exe /s >

[2012/04/01 14:01:24 | 008,738,976 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\Julia\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

 
 < %SYSTEMDRIVE%\*.exe >

[2008/04/11 08:03:48 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe

 
 < MD5 for: AGP440.SYS  >

[2009/07/14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\windows\SysNative\drivers\AGP440.sys

[2009/07/14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys

[2009/07/14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009/07/14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\drivers\atapi.sys

[2009/07/14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys

[2009/07/14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009/07/14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\windows\SysNative\cngaudit.dll

[2009/07/14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2010/04/13 18:44:22 | 000,540,696 | ---- | M] (Intel Corporation) MD5=1384872112E8E7FD5786ECEB8BDDF4C9 -- C:\windows\SysNative\drivers\iaStor.sys

[2010/04/13 18:44:22 | 000,540,696 | ---- | M] (Intel Corporation) MD5=1384872112E8E7FD5786ECEB8BDDF4C9 -- C:\windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_d085c8f0cb5c2856\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2011/03/11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011/03/11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011/03/11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\windows\SysNative\drivers\iaStorV.sys

[2011/03/11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0033117673c16921\iaStorV.sys

[2011/03/11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011/03/11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009/07/14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys

[2009/07/14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009/07/14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\windows\SysNative\netlogon.dll

[2009/07/14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll

[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009/07/14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys

[2009/07/14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011/03/11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\windows\SysNative\drivers\nvstor.sys

[2011/03/11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_38e464dbe521cc7f\nvstor.sys

[2011/03/11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011/03/11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011/03/11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011/03/11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll

[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009/07/14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\windows\SysNative\scecli.dll

[2009/07/14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009/07/14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\windows\SysNative\user32.dll

[2009/07/14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009/07/14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll

[2009/07/14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe

[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009/07/14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\windows\SysNative\userinit.exe

[2009/07/14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009/07/14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\windows\SysNative\wininit.exe

[2009/07/14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012/04/04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009/07/14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2010/06/12 03:50:08 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2010/06/12 03:50:08 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\windows\SysNative\winlogon.exe

[2010/06/12 03:50:08 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009/07/14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\windows\SysNative\drivers\ws2ifsl.sys

[2009/07/14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

FF - user.js - File not found

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-21-3739223292-1581300056-612234262-1000..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\S-1-5-21-3739223292-1581300056-612234262-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O32 - HKLM CDRom: AutoRun - 1

:Files

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache

C:\ProgramData\l_u0_0.pad

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Hier ist das Logfile:

Code:

All processes killed

========== OTL ==========

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.

64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3739223292-1581300056-612234262-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3739223292-1581300056-612234262-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

========== FILES ==========

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.

C:\ProgramData\l_u0_0.pad moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Julia

->Temp folder emptied: 1092648079 bytes

->Temporary Internet Files folder emptied: 63752145 bytes

->FireFox cache emptied: 350802144 bytes

->Flash cache emptied: 8882472 bytes

 

User: Public

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 6 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 441164105 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67899 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 1,867.00 mb

 

 

[EMPTYFLASH]

 

User: All Users

 

User: Default

 

User: Default User

 

User: Julia

->Flash cache emptied: 0 bytes

 

User: Public

 

User: UpdatusUser

 

Total Flash Files Cleaned = 0.00 mb

 

C:\windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.54.0 log created on 07152012_122150
 

Files\Folders moved on Reboot...

C:\Users\Julia\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

C:\Users\Julia\AppData\Local\Mozilla\Firefox\Profiles\zvhu1dy6.default\Cache\_CACHE_001_ moved successfully.

C:\Users\Julia\AppData\Local\Mozilla\Firefox\Profiles\zvhu1dy6.default\Cache\_CACHE_002_ moved successfully.

C:\Users\Julia\AppData\Local\Mozilla\Firefox\Profiles\zvhu1dy6.default\Cache\_CACHE_003_ moved successfully.

C:\Users\Julia\AppData\Local\Mozilla\Firefox\Profiles\zvhu1dy6.default\Cache\_CACHE_MAP_ moved successfully.

C:\Users\Julia\AppData\Local\Mozilla\Firefox\Profiles\zvhu1dy6.default\urlclassifier3.sqlite moved successfully.
 

PendingFileRenameOperations files...

File C:\Users\Julia\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

File C:\Users\Julia\AppData\Local\Mozilla\Firefox\Profiles\zvhu1dy6.default\Cache\_CACHE_001_ not found!

File C:\Users\Julia\AppData\Local\Mozilla\Firefox\Profiles\zvhu1dy6.default\Cache\_CACHE_002_ not found!

File C:\Users\Julia\AppData\Local\Mozilla\Firefox\Profiles\zvhu1dy6.default\Cache\_CACHE_003_ not found!

File C:\Users\Julia\AppData\Local\Mozilla\Firefox\Profiles\zvhu1dy6.default\Cache\_CACHE_MAP_ not found!

File C:\Users\Julia\AppData\Local\Mozilla\Firefox\Profiles\zvhu1dy6.default\urlclassifier3.sqlite not found!
 

Registry entries deleted on Reboot...

Ich brauch den Quarantäneordner von OTL. Bitte folgendes machen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinflussen!
2.) Ordner MovedFiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten!

4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

Ich hab versucht es hochzuladen, allerdings hatte der Laptop am Anfang Probleme, ich bin mir also nicht ganz sicher, ob er es jetzt wirklich hochgeladen hat...hoffe aber, dass es funktioniert hat!

Lad die Datei hier hoch => File-Upload.net - Ihr kostenloser File Hoster!
und verlink sie hier

hxxp://www.file-upload.net/download-4565030/MovedFiles.zip.html

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Hier ist das Log vom TDSS-Killer:

Code:

12:27:43.0489 5864        TDSS rootkit removing tool 2.7.46.0 Jul 16 2012 22:10:11

12:27:43.0661 5864        ============================================================

12:27:43.0661 5864        Current date / time: 2012/07/20 12:27:43.0661

12:27:43.0661 5864        SystemInfo:

12:27:43.0661 5864        

12:27:43.0661 5864        OS Version: 6.1.7600 ServicePack: 0.0

12:27:43.0661 5864        Product type: Workstation

12:27:43.0661 5864        ComputerName: JULIA

12:27:43.0661 5864        UserName: Julia

12:27:43.0661 5864        Windows directory: C:\windows

12:27:43.0661 5864        System windows directory: C:\windows

12:27:43.0661 5864        Running under WOW64

12:27:43.0661 5864        Processor architecture: Intel x64

12:27:43.0661 5864        Number of processors: 4

12:27:43.0661 5864        Page size: 0x1000

12:27:43.0661 5864        Boot type: Normal boot

12:27:43.0661 5864        ============================================================

12:27:44.0098 5864        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

12:27:44.0113 5864        ============================================================

12:27:44.0113 5864        \Device\Harddisk0\DR0:

12:27:44.0113 5864        MBR partitions:

12:27:44.0113 5864        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1832800, BlocksNum 0x23BFB000

12:27:44.0113 5864        ============================================================

12:27:44.0144 5864        C: <-> \Device\Harddisk0\DR0\Partition0

12:27:44.0144 5864        ============================================================

12:27:44.0144 5864        Initialize success

12:27:44.0144 5864        ============================================================

12:27:52.0085 3736        ============================================================

12:27:52.0085 3736        Scan started

12:27:52.0085 3736        Mode: Manual; SigCheck; TDLFS; 

12:27:52.0085 3736        ============================================================

12:27:52.0506 3736        1394ohci        (1b00662092f9f9568b995902f0cc40d5) C:\windows\system32\DRIVERS\1394ohci.sys

12:27:52.0771 3736        1394ohci - ok

12:27:52.0896 3736        ACDaemon        (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

12:27:52.0927 3736        ACDaemon - ok

12:27:53.0005 3736        ACPI            (6f11e88748cdefd2f76aa215f97ddfe5) C:\windows\system32\DRIVERS\ACPI.sys

12:27:53.0037 3736        ACPI - ok

12:27:53.0068 3736        AcpiPmi         (63b05a0420ce4bf0e4af6dcc7cada254) C:\windows\system32\DRIVERS\acpipmi.sys

12:27:53.0130 3736        AcpiPmi - ok

12:27:53.0239 3736        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

12:27:53.0255 3736        AdobeARMservice - ok

12:27:53.0427 3736        AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

12:27:53.0458 3736        AdobeFlashPlayerUpdateSvc - ok

12:27:53.0520 3736        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\windows\system32\DRIVERS\adp94xx.sys

12:27:53.0583 3736        adp94xx - ok

12:27:53.0661 3736        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\windows\system32\DRIVERS\adpahci.sys

12:27:53.0723 3736        adpahci - ok

12:27:53.0754 3736        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\windows\system32\DRIVERS\adpu320.sys

12:27:53.0785 3736        adpu320 - ok

12:27:53.0848 3736        AeLookupSvc     (4b78b431f225fd8624c5655cb1de7b61) C:\windows\System32\aelupsvc.dll

12:27:54.0051 3736        AeLookupSvc - ok

12:27:54.0191 3736        AFD             (db9d6c6b2cd95a9ca414d045b627422e) C:\windows\system32\drivers\afd.sys

12:27:54.0285 3736        AFD - ok

12:27:54.0347 3736        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\windows\system32\DRIVERS\agp440.sys

12:27:54.0363 3736        agp440 - ok

12:27:54.0441 3736        ALG             (3290d6946b5e30e70414990574883ddb) C:\windows\System32\alg.exe

12:27:54.0487 3736        ALG - ok

12:27:54.0550 3736        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\windows\system32\DRIVERS\aliide.sys

12:27:54.0581 3736        aliide - ok

12:27:54.0643 3736        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\windows\system32\DRIVERS\amdide.sys

12:27:54.0659 3736        amdide - ok

12:27:54.0690 3736        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\windows\system32\DRIVERS\amdk8.sys

12:27:54.0721 3736        AmdK8 - ok

12:27:54.0737 3736        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\windows\system32\DRIVERS\amdppm.sys

12:27:54.0753 3736        AmdPPM - ok

12:27:54.0799 3736        amdsata         (ec7ebab00a4d8448bab68d1e49b4beb9) C:\windows\system32\drivers\amdsata.sys

12:27:54.0815 3736        amdsata - ok

12:27:54.0877 3736        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\windows\system32\DRIVERS\amdsbs.sys

12:27:54.0924 3736        amdsbs - ok

12:27:54.0987 3736        amdxata         (db27766102c7bf7e95140a2aa81d042e) C:\windows\system32\drivers\amdxata.sys

12:27:55.0018 3736        amdxata - ok

12:27:55.0143 3736        AntiVirSchedulerService (c27d46b06d340293670450fce9dfb166) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

12:27:55.0174 3736        AntiVirSchedulerService - ok

12:27:55.0221 3736        AntiVirService  (72d90e56563165984224493069c69ed4) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

12:27:55.0236 3736        AntiVirService - ok

12:27:55.0267 3736        AppID           (42fd751b27fa0e9c69bb39f39e409594) C:\windows\system32\drivers\appid.sys

12:27:55.0361 3736        AppID - ok

12:27:55.0408 3736        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\windows\System32\appidsvc.dll

12:27:55.0501 3736        AppIDSvc - ok

12:27:55.0533 3736        Appinfo         (d065be66822847b7f127d1f90158376e) C:\windows\System32\appinfo.dll

12:27:55.0564 3736        Appinfo - ok

12:27:55.0689 3736        Apple Mobile Device (f401929ee0cc92bfe7f15161ca535383) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

12:27:55.0704 3736        Apple Mobile Device - ok

12:27:55.0720 3736        arc             (c484f8ceb1717c540242531db7845c4e) C:\windows\system32\DRIVERS\arc.sys

12:27:55.0751 3736        arc - ok

12:27:55.0798 3736        arcsas          (019af6924aefe7839f61c830227fe79c) C:\windows\system32\DRIVERS\arcsas.sys

12:27:55.0813 3736        arcsas - ok

12:27:55.0860 3736        ArcSoftKsUFilter (c130bc4a51b1382b2be8e44579ec4c0a) C:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys

12:27:55.0891 3736        ArcSoftKsUFilter - ok

12:27:55.0907 3736        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\windows\system32\DRIVERS\asyncmac.sys

12:27:55.0985 3736        AsyncMac - ok

12:27:56.0047 3736        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\windows\system32\DRIVERS\atapi.sys

12:27:56.0063 3736        atapi - ok

12:27:56.0141 3736        AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\windows\System32\Audiosrv.dll

12:27:56.0219 3736        AudioEndpointBuilder - ok

12:27:56.0235 3736        AudioSrv        (07721a77180edd4d39ccb865bf63c7fd) C:\windows\System32\Audiosrv.dll

12:27:56.0281 3736        AudioSrv - ok

12:27:56.0344 3736        avgntflt        (b1224e6b086cd6548315b04ab575a23e) C:\windows\system32\DRIVERS\avgntflt.sys

12:27:56.0344 3736        avgntflt - ok

12:27:56.0422 3736        avipbb          (ed45f12cfa62b83765c9c1496758cc87) C:\windows\system32\DRIVERS\avipbb.sys

12:27:56.0453 3736        avipbb - ok

12:27:56.0484 3736        AxInstSV        (b20b5fa5ca050e9926e4d1db81501b32) C:\windows\System32\AxInstSV.dll

12:27:56.0531 3736        AxInstSV - ok

12:27:56.0593 3736        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\windows\system32\DRIVERS\bxvbda.sys

12:27:56.0656 3736        b06bdrv - ok

12:27:56.0718 3736        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\windows\system32\DRIVERS\b57nd60a.sys

12:27:56.0765 3736        b57nd60a - ok

12:27:56.0827 3736        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\windows\System32\bdesvc.dll

12:27:56.0874 3736        BDESVC - ok

12:27:56.0905 3736        Beep            (16a47ce2decc9b099349a5f840654746) C:\windows\system32\drivers\Beep.sys

12:27:56.0983 3736        Beep - ok

12:27:57.0077 3736        BFE             (4992c609a6315671463e30f6512bc022) C:\windows\System32\bfe.dll

12:27:57.0171 3736        BFE - ok

12:27:57.0295 3736        BITS            (7f0c323fe3da28aa4aa1bda3f575707f) C:\windows\System32\qmgr.dll

12:27:57.0373 3736        BITS - ok

12:27:57.0467 3736        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\windows\system32\DRIVERS\blbdrive.sys

12:27:57.0514 3736        blbdrive - ok

12:27:57.0639 3736        Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe

12:27:57.0670 3736        Bonjour Service - ok

12:27:57.0763 3736        bowser          (19d20159708e152267e53b66677a4995) C:\windows\system32\DRIVERS\bowser.sys

12:27:57.0826 3736        bowser - ok

12:27:57.0857 3736        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\windows\system32\DRIVERS\BrFiltLo.sys

12:27:57.0888 3736        BrFiltLo - ok

12:27:57.0888 3736        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\windows\system32\DRIVERS\BrFiltUp.sys

12:27:57.0904 3736        BrFiltUp - ok

12:27:57.0966 3736        Browser         (94fbc06f294d58d02361918418f996e3) C:\windows\System32\browser.dll

12:27:58.0044 3736        Browser - ok

12:27:58.0075 3736        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\windows\System32\Drivers\Brserid.sys

12:27:58.0138 3736        Brserid - ok

12:27:58.0138 3736        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\windows\System32\Drivers\BrSerWdm.sys

12:27:58.0185 3736        BrSerWdm - ok

12:27:58.0185 3736        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\windows\System32\Drivers\BrUsbMdm.sys

12:27:58.0231 3736        BrUsbMdm - ok

12:27:58.0247 3736        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\windows\System32\Drivers\BrUsbSer.sys

12:27:58.0278 3736        BrUsbSer - ok

12:27:58.0278 3736        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\windows\system32\DRIVERS\bthmodem.sys

12:27:58.0309 3736        BTHMODEM - ok

12:27:58.0341 3736        bthserv         (95f9c2976059462cbbf227f7aab10de9) C:\windows\system32\bthserv.dll

12:27:58.0403 3736        bthserv - ok

12:27:58.0465 3736        cdfs            (b8bd2bb284668c84865658c77574381a) C:\windows\system32\DRIVERS\cdfs.sys

12:27:58.0528 3736        cdfs - ok

12:27:58.0559 3736        cdrom           (83d2d75e1efb81b3450c18131443f7db) C:\windows\system32\DRIVERS\cdrom.sys

12:27:58.0606 3736        cdrom - ok

12:27:58.0637 3736        CertPropSvc     (312e2f82af11e79906898ac3e3d58a1f) C:\windows\System32\certprop.dll

12:27:58.0715 3736        CertPropSvc - ok

12:27:58.0731 3736        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\windows\system32\DRIVERS\circlass.sys

12:27:58.0777 3736        circlass - ok

12:27:58.0871 3736        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\windows\system32\CLFS.sys

12:27:58.0902 3736        CLFS - ok

12:27:58.0996 3736        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

12:27:59.0011 3736        clr_optimization_v2.0.50727_32 - ok

12:27:59.0074 3736        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

12:27:59.0105 3736        clr_optimization_v2.0.50727_64 - ok

12:27:59.0183 3736        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

12:27:59.0199 3736        clr_optimization_v4.0.30319_32 - ok

12:27:59.0261 3736        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

12:27:59.0292 3736        clr_optimization_v4.0.30319_64 - ok

12:27:59.0339 3736        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\windows\system32\DRIVERS\CmBatt.sys

12:27:59.0386 3736        CmBatt - ok

12:27:59.0401 3736        cmdide          (e19d3f095812725d88f9001985b94edd) C:\windows\system32\DRIVERS\cmdide.sys

12:27:59.0417 3736        cmdide - ok

12:27:59.0557 3736        CNG             (ca7720b73446fddec5c69519c1174c98) C:\windows\system32\Drivers\cng.sys

12:27:59.0620 3736        CNG - ok

12:27:59.0698 3736        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\windows\system32\DRIVERS\compbatt.sys

12:27:59.0713 3736        Compbatt - ok

12:27:59.0745 3736        CompositeBus    (f26b3a86f6fa87ca360b879581ab4123) C:\windows\system32\DRIVERS\CompositeBus.sys

12:27:59.0776 3736        CompositeBus - ok

12:27:59.0791 3736        COMSysApp - ok

12:27:59.0807 3736        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\windows\system32\DRIVERS\crcdisk.sys

12:27:59.0823 3736        crcdisk - ok

12:27:59.0901 3736        CryptSvc        (f02786b66375292e58c8777082d4396d) C:\windows\system32\cryptsvc.dll

12:27:59.0963 3736        CryptSvc - ok

12:28:00.0041 3736        DcomLaunch      (7266972e86890e2b30c0c322e906b027) C:\windows\system32\rpcss.dll

12:28:00.0103 3736        DcomLaunch - ok

12:28:00.0166 3736        defragsvc       (3cec7631a84943677aa8fa8ee5b6b43d) C:\windows\System32\defragsvc.dll

12:28:00.0228 3736        defragsvc - ok

12:28:00.0275 3736        DfsC            (9c253ce7311ca60fc11c774692a13208) C:\windows\system32\Drivers\dfsc.sys

12:28:00.0337 3736        DfsC - ok

12:28:00.0369 3736        DgiVecp - ok

12:28:00.0431 3736        Dhcp            (ce3b9562d997f69b330d181a8875960f) C:\windows\system32\dhcpcore.dll

12:28:00.0540 3736        Dhcp - ok

12:28:00.0587 3736        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\windows\system32\drivers\discache.sys

12:28:00.0649 3736        discache - ok

12:28:00.0696 3736        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\windows\system32\DRIVERS\disk.sys

12:28:00.0712 3736        Disk - ok

12:28:00.0759 3736        Dnscache        (85cf424c74a1d5ec33533e1dbff9920a) C:\windows\System32\dnsrslvr.dll

12:28:00.0805 3736        Dnscache - ok

12:28:00.0868 3736        dot3svc         (14452acdb09b70964c8c21bf80a13acb) C:\windows\System32\dot3svc.dll

12:28:00.0993 3736        dot3svc - ok

12:28:01.0024 3736        DPS             (8c2ba6bea949ee6e68385f5692bafb94) C:\windows\system32\dps.dll

12:28:01.0071 3736        DPS - ok

12:28:01.0102 3736        drmkaud         (9b19f34400d24df84c858a421c205754) C:\windows\system32\drivers\drmkaud.sys

12:28:01.0117 3736        drmkaud - ok

12:28:01.0227 3736        DXGKrnl         (ebce0b0924835f635f620d19f0529dce) C:\windows\System32\drivers\dxgkrnl.sys

12:28:01.0258 3736        DXGKrnl - ok

12:28:01.0305 3736        EapHost         (e2dda8726da9cb5b2c4000c9018a9633) C:\windows\System32\eapsvc.dll

12:28:01.0367 3736        EapHost - ok

12:28:01.0601 3736        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\windows\system32\DRIVERS\evbda.sys

12:28:01.0726 3736        ebdrv - ok

12:28:01.0851 3736        EFS             (156f6159457d0aa7e59b62681b56eb90) C:\windows\System32\lsass.exe

12:28:01.0929 3736        EFS - ok

12:28:02.0053 3736        ehRecvr         (47c071994c3f649f23d9cd075ac9304a) C:\windows\ehome\ehRecvr.exe

12:28:02.0131 3736        ehRecvr - ok

12:28:02.0163 3736        ehSched         (4705e8ef9934482c5bb488ce28afc681) C:\windows\ehome\ehsched.exe

12:28:02.0194 3736        ehSched - ok

12:28:02.0334 3736        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\windows\system32\DRIVERS\elxstor.sys

12:28:02.0365 3736        elxstor - ok

12:28:02.0365 3736        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\windows\system32\DRIVERS\errdev.sys

12:28:02.0397 3736        ErrDev - ok

12:28:02.0459 3736        ETD             (06c94be9d9e1e6411429433a64a76936) C:\windows\system32\DRIVERS\ETD.sys

12:28:02.0506 3736        ETD - ok

12:28:02.0568 3736        EUCR            (89d11159b361dd1eac5dd4e9895c04a4) C:\windows\system32\DRIVERS\EUCR6SK.SYS

12:28:02.0584 3736        EUCR - ok

12:28:02.0646 3736        EventSystem     (4166f82be4d24938977dd1746be9b8a0) C:\windows\system32\es.dll

12:28:02.0709 3736        EventSystem - ok

12:28:02.0740 3736        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\windows\system32\drivers\exfat.sys

12:28:02.0787 3736        exfat - ok

12:28:02.0880 3736        Fabs - ok

12:28:02.0943 3736        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\windows\system32\drivers\fastfat.sys

12:28:03.0021 3736        fastfat - ok

12:28:03.0099 3736        Fax             (d607b2f1bee3992aa6c2c92c0a2f0855) C:\windows\system32\fxssvc.exe

12:28:03.0177 3736        Fax - ok

12:28:03.0192 3736        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\windows\system32\DRIVERS\fdc.sys

12:28:03.0223 3736        fdc - ok

12:28:03.0255 3736        fdPHost         (0438cab2e03f4fb61455a7956026fe86) C:\windows\system32\fdPHost.dll

12:28:03.0317 3736        fdPHost - ok

12:28:03.0333 3736        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\windows\system32\fdrespub.dll

12:28:03.0395 3736        FDResPub - ok

12:28:03.0442 3736        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\windows\system32\drivers\fileinfo.sys

12:28:03.0442 3736        FileInfo - ok

12:28:03.0473 3736        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\windows\system32\drivers\filetrace.sys

12:28:03.0520 3736        Filetrace - ok

12:28:03.0801 3736        FirebirdServerMAGIXInstance (fff1130f7c9fa01d093a1edfc5cce8fc) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe

12:28:03.0925 3736        FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - warning

12:28:03.0925 3736        FirebirdServerMAGIXInstance - detected UnsignedFile.Multi.Generic (1)

12:28:04.0066 3736        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\windows\system32\DRIVERS\flpydisk.sys

12:28:04.0097 3736        flpydisk - ok

12:28:04.0144 3736        FltMgr          (f7866af72abbaf84b1fa5aa195378c59) C:\windows\system32\drivers\fltmgr.sys

12:28:04.0175 3736        FltMgr - ok

12:28:04.0284 3736        FontCache       (8ac4cb4ea61e41009fae9ae7b2b5da3a) C:\windows\system32\FntCache.dll

12:28:04.0393 3736        FontCache - ok

12:28:04.0471 3736        FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

12:28:04.0487 3736        FontCache3.0.0.0 - ok

12:28:04.0549 3736        FsDepends       (d43703496149971890703b4b1b723eac) C:\windows\system32\drivers\FsDepends.sys

12:28:04.0581 3736        FsDepends - ok

12:28:04.0659 3736        Fs_Rec          (d3e3f93d67821a2db2b3d9fac2dc2064) C:\windows\system32\drivers\Fs_Rec.sys

12:28:04.0674 3736        Fs_Rec - ok

12:28:04.0705 3736        fvevol          (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\windows\system32\DRIVERS\fvevol.sys

12:28:04.0737 3736        fvevol - ok

12:28:04.0768 3736        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\windows\system32\DRIVERS\gagp30kx.sys

12:28:04.0768 3736        gagp30kx - ok

12:28:04.0830 3736        GEARAspiWDM     (e403aacf8c7bb11375122d2464560311) C:\windows\system32\DRIVERS\GEARAspiWDM.sys

12:28:04.0830 3736        GEARAspiWDM - ok

12:28:04.0924 3736        gpsvc           (fe5ab4525bc2ec68b9119a6e5d40128b) C:\windows\System32\gpsvc.dll

12:28:04.0986 3736        gpsvc - ok

12:28:05.0080 3736        gusvc           (c1b577b2169900f4cf7190c39f085794) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

12:28:05.0111 3736        gusvc - ok

12:28:05.0142 3736        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\windows\system32\drivers\hcw85cir.sys

12:28:05.0173 3736        hcw85cir - ok

12:28:05.0236 3736        HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\windows\system32\drivers\HdAudio.sys

12:28:05.0298 3736        HdAudAddService - ok

12:28:05.0329 3736        HDAudBus        (0a49913402747a0b67de940fb42cbdbb) C:\windows\system32\DRIVERS\HDAudBus.sys

12:28:05.0361 3736        HDAudBus - ok

12:28:05.0392 3736        HECIx64         (b6ac71aaa2b10848f57fc49d55a651af) C:\windows\system32\DRIVERS\HECIx64.sys

12:28:05.0407 3736        HECIx64 - ok

12:28:05.0454 3736        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\windows\system32\DRIVERS\HidBatt.sys

12:28:05.0501 3736        HidBatt - ok

12:28:05.0517 3736        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\windows\system32\DRIVERS\hidbth.sys

12:28:05.0532 3736        HidBth - ok

12:28:05.0532 3736        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\windows\system32\DRIVERS\hidir.sys

12:28:05.0563 3736        HidIr - ok

12:28:05.0579 3736        hidserv         (bd9eb3958f213f96b97b1d897dee006d) C:\windows\system32\hidserv.dll

12:28:05.0626 3736        hidserv - ok

12:28:05.0641 3736        HidUsb          (b3bf6b5b50006def50b66306d99fcf6f) C:\windows\system32\DRIVERS\hidusb.sys

12:28:05.0673 3736        HidUsb - ok

12:28:05.0704 3736        hkmsvc          (efa58ede58dd74388ffd04cb32681518) C:\windows\system32\kmsvc.dll

12:28:05.0751 3736        hkmsvc - ok

12:28:05.0782 3736        HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\windows\system32\ListSvc.dll

12:28:05.0907 3736        HomeGroupListener - ok

12:28:05.0938 3736        HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\windows\system32\provsvc.dll

12:28:05.0969 3736        HomeGroupProvider - ok

12:28:06.0016 3736        HpSAMD          (0886d440058f203eba0e1825e4355914) C:\windows\system32\DRIVERS\HpSAMD.sys

12:28:06.0031 3736        HpSAMD - ok

12:28:06.0125 3736        HTTP            (cee049cac4efa7f4e1e4ad014414a5d4) C:\windows\system32\drivers\HTTP.sys

12:28:06.0203 3736        HTTP - ok

12:28:06.0219 3736        hwpolicy        (f17766a19145f111856378df337a5d79) C:\windows\system32\drivers\hwpolicy.sys

12:28:06.0219 3736        hwpolicy - ok

12:28:06.0250 3736        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\windows\system32\DRIVERS\i8042prt.sys

12:28:06.0265 3736        i8042prt - ok

12:28:06.0343 3736        iaStor          (1384872112e8e7fd5786eceb8bddf4c9) C:\windows\system32\DRIVERS\iaStor.sys

12:28:06.0375 3736        iaStor - ok

12:28:06.0453 3736        IAStorDataMgrSvc (6b24d1c3096de796d15571079ea5e98c) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

12:28:06.0468 3736        IAStorDataMgrSvc - ok

12:28:06.0546 3736        iaStorV         (b75e45c564e944a2657167d197ab29da) C:\windows\system32\drivers\iaStorV.sys

12:28:06.0593 3736        iaStorV - ok

12:28:06.0733 3736        idsvc           (2f2be70d3e02b6fa877921ab9516d43c) C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

12:28:06.0780 3736        idsvc - ok

12:28:07.0373 3736        igfx            (2a22ab054f4630d2ef4bab2853f6d5f6) C:\windows\system32\DRIVERS\igdkmd64.sys

12:28:07.0716 3736        igfx - ok

12:28:07.0888 3736        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\windows\system32\DRIVERS\iirsp.sys

12:28:07.0903 3736        iirsp - ok

12:28:08.0013 3736        IKEEXT          (c5b4683680df085b57bc53e5ef34861f) C:\windows\System32\ikeext.dll

12:28:08.0091 3736        IKEEXT - ok

12:28:08.0153 3736        Impcd           (dd587a55390ed2295bce6d36ad567da9) C:\windows\system32\DRIVERS\Impcd.sys

12:28:08.0215 3736        Impcd - ok

12:28:08.0403 3736        IntcAzAudAddService (b88e24bd77a0ce2cffee2facf1151be0) C:\windows\system32\drivers\RTKVHD64.sys

12:28:08.0512 3736        IntcAzAudAddService - ok

12:28:08.0715 3736        IntcDAud        (58cf58dee26c909bd6f977b61d246295) C:\windows\system32\DRIVERS\IntcDAud.sys

12:28:08.0777 3736        IntcDAud - ok

12:28:08.0839 3736        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\windows\system32\DRIVERS\intelide.sys

12:28:08.0855 3736        intelide - ok

12:28:08.0933 3736        intelppm        (ada036632c664caa754079041cf1f8c1) C:\windows\system32\DRIVERS\intelppm.sys

12:28:08.0964 3736        intelppm - ok

12:28:08.0995 3736        IPBusEnum       (098a91c54546a3b878dad6a7e90a455b) C:\windows\system32\ipbusenum.dll

12:28:09.0058 3736        IPBusEnum - ok

12:28:09.0089 3736        IpFilterDriver  (722dd294df62483cecaae6e094b4d695) C:\windows\system32\DRIVERS\ipfltdrv.sys

12:28:09.0120 3736        IpFilterDriver - ok

12:28:09.0183 3736        iphlpsvc        (f8e058d17363ec580e4b7232778b6cb5) C:\windows\System32\iphlpsvc.dll

12:28:09.0261 3736        iphlpsvc - ok

12:28:09.0276 3736        IPMIDRV         (e2b4a4494db7cb9b89b55ca268c337c5) C:\windows\system32\DRIVERS\IPMIDrv.sys

12:28:09.0292 3736        IPMIDRV - ok

12:28:09.0370 3736        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\windows\system32\drivers\ipnat.sys

12:28:09.0448 3736        IPNAT - ok

12:28:09.0635 3736        iPod Service    (a9ab99ee7d39725eafec82732d2b3271) C:\Program Files\iPod\bin\iPodService.exe

12:28:09.0682 3736        iPod Service - ok

12:28:09.0697 3736        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\windows\system32\drivers\irenum.sys

12:28:09.0729 3736        IRENUM - ok

12:28:09.0760 3736        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\windows\system32\DRIVERS\isapnp.sys

12:28:09.0775 3736        isapnp - ok

12:28:09.0807 3736        iScsiPrt        (fa4d2557de56d45b0a346f93564be6e1) C:\windows\system32\DRIVERS\msiscsi.sys

12:28:09.0822 3736        iScsiPrt - ok

12:28:09.0885 3736        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\windows\system32\DRIVERS\kbdclass.sys

12:28:09.0916 3736        kbdclass - ok

12:28:09.0963 3736        kbdhid          (6def98f8541e1b5dceb2c822a11f7323) C:\windows\system32\DRIVERS\kbdhid.sys

12:28:10.0009 3736        kbdhid - ok

12:28:10.0041 3736        KeyIso          (156f6159457d0aa7e59b62681b56eb90) C:\windows\system32\lsass.exe

12:28:10.0056 3736        KeyIso - ok

12:28:10.0134 3736        KSecDD          (4f4b5fde429416877de7143044582eb5) C:\windows\system32\Drivers\ksecdd.sys

12:28:10.0150 3736        KSecDD - ok

12:28:10.0212 3736        KSecPkg         (6f40465a44ecdc1731befafec5bdd03c) C:\windows\system32\Drivers\ksecpkg.sys

12:28:10.0259 3736        KSecPkg - ok

12:28:10.0306 3736        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\windows\system32\drivers\ksthunk.sys

12:28:10.0384 3736        ksthunk - ok

12:28:10.0446 3736        KtmRm           (6ab66e16aa859232f64deb66887a8c9c) C:\windows\system32\msdtckrm.dll

12:28:10.0524 3736        KtmRm - ok

12:28:10.0587 3736        LanmanServer    (81f1d04d4d0e433099365127375fd501) C:\windows\system32\srvsvc.dll

12:28:10.0633 3736        LanmanServer - ok

12:28:10.0680 3736        LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\windows\System32\wkssvc.dll

12:28:10.0743 3736        LanmanWorkstation - ok

12:28:10.0774 3736        lltdio          (1538831cf8ad2979a04c423779465827) C:\windows\system32\DRIVERS\lltdio.sys

12:28:10.0883 3736        lltdio - ok

12:28:10.0930 3736        lltdsvc         (c1185803384ab3feed115f79f109427f) C:\windows\System32\lltdsvc.dll

12:28:11.0023 3736        lltdsvc - ok

12:28:11.0039 3736        lmhosts         (f993a32249b66c9d622ea5592a8b76b8) C:\windows\System32\lmhsvc.dll

12:28:11.0101 3736        lmhosts - ok

12:28:11.0195 3736        LMS             (7485fbcef9136f530953575e2977859d) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

12:28:11.0226 3736        LMS - ok

12:28:11.0273 3736        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\windows\system32\DRIVERS\lsi_fc.sys

12:28:11.0304 3736        LSI_FC - ok

12:28:11.0320 3736        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\windows\system32\DRIVERS\lsi_sas.sys

12:28:11.0335 3736        LSI_SAS - ok

12:28:11.0367 3736        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\windows\system32\DRIVERS\lsi_sas2.sys

12:28:11.0382 3736        LSI_SAS2 - ok

12:28:11.0398 3736        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\windows\system32\DRIVERS\lsi_scsi.sys

12:28:11.0413 3736        LSI_SCSI - ok

12:28:11.0460 3736        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\windows\system32\drivers\luafv.sys

12:28:11.0507 3736        luafv - ok

12:28:11.0538 3736        MBfilt          (8ff2d95cba49b405c5de27039ff0bf35) C:\windows\system32\drivers\MBfilt64.sys

12:28:11.0538 3736        MBfilt - ok

12:28:11.0601 3736        Mcx2Svc         (f84c8f1000bc11e3b7b23cbd3baff111) C:\windows\system32\Mcx2Svc.dll

12:28:11.0632 3736        Mcx2Svc - ok

12:28:11.0679 3736        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\windows\system32\DRIVERS\megasas.sys

12:28:11.0694 3736        megasas - ok

12:28:11.0741 3736        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\windows\system32\DRIVERS\MegaSR.sys

12:28:11.0788 3736        MegaSR - ok

12:28:11.0866 3736        MGHwCtrl - ok

12:28:11.0944 3736        Micro Star SCM  (71c6748ee8de938532057ef10b4b7e44) C:\Program Files (x86)\System Control Manager\MSIService.exe

12:28:11.0975 3736        Micro Star SCM ( UnsignedFile.Multi.Generic ) - warning

12:28:11.0975 3736        Micro Star SCM - detected UnsignedFile.Multi.Generic (1)

12:28:12.0006 3736        MMCSS           (e40e80d0304a73e8d269f7141d77250b) C:\windows\system32\mmcss.dll

12:28:12.0069 3736        MMCSS - ok

12:28:12.0100 3736        Modem           (800ba92f7010378b09f9ed9270f07137) C:\windows\system32\drivers\modem.sys

12:28:12.0178 3736        Modem - ok

12:28:12.0209 3736        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\windows\system32\DRIVERS\monitor.sys

12:28:12.0240 3736        monitor - ok

12:28:12.0271 3736        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\windows\system32\DRIVERS\mouclass.sys

12:28:12.0287 3736        mouclass - ok

12:28:12.0303 3736        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\windows\system32\DRIVERS\mouhid.sys

12:28:12.0318 3736        mouhid - ok

12:28:12.0334 3736        mountmgr        (791af66c4d0e7c90a3646066386fb571) C:\windows\system32\drivers\mountmgr.sys

12:28:12.0349 3736        mountmgr - ok

12:28:12.0412 3736        MozillaMaintenance (46297fa8e30a6007f14118fc2b942fbc) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

12:28:12.0427 3736        MozillaMaintenance - ok

12:28:12.0474 3736        mpio            (609d1d87649ecc19796f4d76d4c15cea) C:\windows\system32\DRIVERS\mpio.sys

12:28:12.0490 3736        mpio - ok

12:28:12.0537 3736        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\windows\system32\drivers\mpsdrv.sys

12:28:12.0615 3736        mpsdrv - ok

12:28:12.0693 3736        MpsSvc          (aecab449567d1846dad63ece49e893e3) C:\windows\system32\mpssvc.dll

12:28:12.0771 3736        MpsSvc - ok

12:28:12.0802 3736        MRxDAV          (30524261bb51d96d6fcbac20c810183c) C:\windows\system32\drivers\mrxdav.sys

12:28:12.0833 3736        MRxDAV - ok

12:28:12.0895 3736        mrxsmb          (040d62a9d8ad28922632137acdd984f2) C:\windows\system32\DRIVERS\mrxsmb.sys

12:28:12.0942 3736        mrxsmb - ok

12:28:13.0020 3736        mrxsmb10        (f0067552f8f9b33d7c59403ab808a3cb) C:\windows\system32\DRIVERS\mrxsmb10.sys

12:28:13.0067 3736        mrxsmb10 - ok

12:28:13.0098 3736        mrxsmb20        (3c142d31de9f2f193218a53fe2632051) C:\windows\system32\DRIVERS\mrxsmb20.sys

12:28:13.0129 3736        mrxsmb20 - ok

12:28:13.0161 3736        msahci          (5c37497276e3b3a5488b23a326a754b7) C:\windows\system32\DRIVERS\msahci.sys

12:28:13.0192 3736        msahci - ok

12:28:13.0223 3736        msdsm           (8d27b597229aed79430fb9db3bcbfbd0) C:\windows\system32\DRIVERS\msdsm.sys

12:28:13.0270 3736        msdsm - ok

12:28:13.0317 3736        MSDTC           (de0ece52236cfa3ed2dbfc03f28253a8) C:\windows\System32\msdtc.exe

12:28:13.0363 3736        MSDTC - ok

12:28:13.0426 3736        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\windows\system32\drivers\Msfs.sys

12:28:13.0519 3736        Msfs - ok

12:28:13.0535 3736        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\windows\System32\drivers\mshidkmdf.sys

12:28:13.0582 3736        mshidkmdf - ok

12:28:13.0597 3736        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\windows\system32\DRIVERS\msisadrv.sys

12:28:13.0613 3736        msisadrv - ok

12:28:13.0660 3736        MSiSCSI         (808e98ff49b155c522e6400953177b08) C:\windows\system32\iscsiexe.dll

12:28:13.0738 3736        MSiSCSI - ok

12:28:13.0738 3736        msiserver - ok

12:28:13.0769 3736        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\windows\system32\drivers\MSKSSRV.sys

12:28:13.0831 3736        MSKSSRV - ok

12:28:13.0863 3736        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\windows\system32\drivers\MSPCLOCK.sys

12:28:13.0909 3736        MSPCLOCK - ok

12:28:13.0925 3736        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\windows\system32\drivers\MSPQM.sys

12:28:14.0003 3736        MSPQM - ok

12:28:14.0050 3736        MsRPC           (89cb141aa8616d8c6a4610fa26c60964) C:\windows\system32\drivers\MsRPC.sys

12:28:14.0065 3736        MsRPC - ok

12:28:14.0097 3736        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\windows\system32\DRIVERS\mssmbios.sys

12:28:14.0097 3736        mssmbios - ok

12:28:14.0128 3736        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\windows\system32\drivers\MSTEE.sys

12:28:14.0175 3736        MSTEE - ok

12:28:14.0190 3736        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\windows\system32\DRIVERS\MTConfig.sys

12:28:14.0221 3736        MTConfig - ok

12:28:14.0237 3736        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\windows\system32\Drivers\mup.sys

12:28:14.0253 3736        Mup - ok

12:28:14.0299 3736        napagent        (4987e079a4530fa737a128be54b63b12) C:\windows\system32\qagentRT.dll

12:28:14.0377 3736        napagent - ok

12:28:14.0440 3736        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\windows\system32\DRIVERS\nwifi.sys

12:28:14.0502 3736        NativeWifiP - ok

12:28:14.0611 3736        NDIS            (cad515dbd07d082bb317d9928ce8962c) C:\windows\system32\drivers\ndis.sys

12:28:14.0658 3736        NDIS - ok

12:28:14.0689 3736        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\windows\system32\DRIVERS\ndiscap.sys

12:28:14.0752 3736        NdisCap - ok

12:28:14.0767 3736        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\windows\system32\DRIVERS\ndistapi.sys

12:28:14.0814 3736        NdisTapi - ok

12:28:14.0845 3736        Ndisuio         (f105ba1e22bf1f2ee8f005d4305e4bec) C:\windows\system32\DRIVERS\ndisuio.sys

12:28:14.0908 3736        Ndisuio - ok

12:28:14.0955 3736        NdisWan         (557dfab9ca1fcb036ac77564c010dad3) C:\windows\system32\DRIVERS\ndiswan.sys

12:28:14.0986 3736        NdisWan - ok

12:28:15.0033 3736        NDProxy         (659b74fb74b86228d6338d643cd3e3cf) C:\windows\system32\drivers\NDProxy.sys

12:28:15.0111 3736        NDProxy - ok

12:28:15.0157 3736        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\windows\system32\DRIVERS\netbios.sys

12:28:15.0220 3736        NetBIOS - ok

12:28:15.0282 3736        NetBT           (9162b273a44ab9dce5b44362731d062a) C:\windows\system32\DRIVERS\netbt.sys

12:28:15.0360 3736        NetBT - ok

12:28:15.0391 3736        Netlogon        (156f6159457d0aa7e59b62681b56eb90) C:\windows\system32\lsass.exe

12:28:15.0407 3736        Netlogon - ok

12:28:15.0469 3736        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\windows\System32\netman.dll

12:28:15.0547 3736        Netman - ok

12:28:15.0594 3736        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\windows\System32\netprofm.dll

12:28:15.0657 3736        netprofm - ok

12:28:15.0735 3736        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

12:28:15.0766 3736        NetTcpPortSharing - ok

12:28:16.0249 3736        NETw5s64        (39ede676d17f37af4573c2b33ec28aca) C:\windows\system32\DRIVERS\NETw5s64.sys

12:28:16.0546 3736        NETw5s64 - ok

12:28:16.0717 3736        nfrd960         (77889813be4d166cdab78ddba990da92) C:\windows\system32\DRIVERS\nfrd960.sys

12:28:16.0749 3736        nfrd960 - ok

12:28:16.0795 3736        NlaSvc          (d9a0ce66046d6efa0c61baa885cba0a8) C:\windows\System32\nlasvc.dll

12:28:16.0889 3736        NlaSvc - ok

12:28:16.0920 3736        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\windows\system32\drivers\Npfs.sys

12:28:16.0967 3736        Npfs - ok

12:28:16.0983 3736        nsi             (d54bfdf3e0c953f823b3d0bfe4732528) C:\windows\system32\nsisvc.dll

12:28:17.0045 3736        nsi - ok

12:28:17.0061 3736        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\windows\system32\drivers\nsiproxy.sys

12:28:17.0123 3736        nsiproxy - ok

12:28:17.0295 3736        Ntfs            (378e0e0dfea67d98ae6ea53adbbd76bc) C:\windows\system32\drivers\Ntfs.sys

12:28:17.0373 3736        Ntfs - ok

12:28:17.0497 3736        Null            (9899284589f75fa8724ff3d16aed75c1) C:\windows\system32\drivers\Null.sys

12:28:17.0575 3736        Null - ok

12:28:18.0246 3736        nvlddmkm        (56743d7b668a19bd83bcdfb1f2136738) C:\windows\system32\DRIVERS\nvlddmkm.sys

12:28:18.0621 3736        nvlddmkm - ok

12:28:18.0792 3736        nvraid          (a4d9c9a608a97f59307c2f2600edc6a4) C:\windows\system32\drivers\nvraid.sys

12:28:18.0823 3736        nvraid - ok

12:28:18.0855 3736        nvstor          (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\windows\system32\drivers\nvstor.sys

12:28:18.0886 3736        nvstor - ok

12:28:18.0964 3736        nvsvc           (1d462154c746161683ebb7d95d0c0af1) C:\windows\system32\nvvsvc.exe

12:28:18.0995 3736        nvsvc - ok

12:28:19.0213 3736        nvUpdatusService (18f1906bfe993ead51200e3195b3d6e2) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

12:28:19.0291 3736        nvUpdatusService - ok

12:28:19.0447 3736        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\windows\system32\DRIVERS\nv_agp.sys

12:28:19.0479 3736        nv_agp - ok

12:28:19.0494 3736        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\windows\system32\DRIVERS\ohci1394.sys

12:28:19.0525 3736        ohci1394 - ok

12:28:19.0588 3736        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\windows\system32\pnrpsvc.dll

12:28:19.0650 3736        p2pimsvc - ok

12:28:19.0713 3736        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\windows\system32\p2psvc.dll

12:28:19.0759 3736        p2psvc - ok

12:28:19.0791 3736        Parport         (0086431c29c35be1dbc43f52cc273887) C:\windows\system32\DRIVERS\parport.sys

12:28:19.0822 3736        Parport - ok

12:28:19.0900 3736        partmgr         (90061b1acfe8ccaa5345750ffe08d8b8) C:\windows\system32\drivers\partmgr.sys

12:28:19.0931 3736        partmgr - ok

12:28:19.0962 3736        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\windows\System32\pcasvc.dll

12:28:20.0009 3736        PcaSvc - ok

12:28:20.0040 3736        pci             (f36f6504009f2fb0dfd1b17a116ad74b) C:\windows\system32\DRIVERS\pci.sys

12:28:20.0056 3736        pci - ok

12:28:20.0087 3736        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\windows\system32\DRIVERS\pciide.sys

12:28:20.0103 3736        pciide - ok

12:28:20.0134 3736        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\windows\system32\DRIVERS\pcmcia.sys

12:28:20.0149 3736        pcmcia - ok

12:28:20.0181 3736        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\windows\system32\drivers\pcw.sys

12:28:20.0181 3736        pcw - ok

12:28:20.0274 3736        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\windows\system32\drivers\peauth.sys

12:28:20.0352 3736        PEAUTH - ok

12:28:20.0446 3736        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\windows\SysWow64\perfhost.exe

12:28:20.0493 3736        PerfHost - ok

12:28:20.0633 3736        pla             (557e9a86f65f0de18c9b6751dfe9d3f1) C:\windows\system32\pla.dll

12:28:20.0773 3736        pla - ok

12:28:20.0836 3736        PlugPlay        (98b1721b8718164293b9701b98c52d77) C:\windows\system32\umpnpmgr.dll

12:28:20.0914 3736        PlugPlay - ok

12:28:20.0945 3736        PNRPAutoReg     (7195581cec9bb7d12abe54036acc2e38) C:\windows\system32\pnrpauto.dll

12:28:20.0976 3736        PNRPAutoReg - ok

12:28:21.0007 3736        PNRPsvc         (3eac4455472cc2c97107b5291e0dcafe) C:\windows\system32\pnrpsvc.dll

12:28:21.0023 3736        PNRPsvc - ok

12:28:21.0085 3736        Point64         (33328fa8a580885ab0065be6db266e9f) C:\windows\system32\DRIVERS\point64.sys

12:28:21.0101 3736        Point64 - ok

12:28:21.0179 3736        PolicyAgent     (166eb40d1f5b47e615de3d0fffe5f243) C:\windows\System32\ipsecsvc.dll

12:28:21.0257 3736        PolicyAgent - ok

12:28:21.0304 3736        Power           (6ba9d927dded70bd1a9caded45f8b184) C:\windows\system32\umpo.dll

12:28:21.0366 3736        Power - ok

12:28:21.0413 3736        PptpMiniport    (27cc19e81ba5e3403c48302127bda717) C:\windows\system32\DRIVERS\raspptp.sys

12:28:21.0475 3736        PptpMiniport - ok

12:28:21.0491 3736        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\windows\system32\DRIVERS\processr.sys

12:28:21.0522 3736        Processor - ok

12:28:21.0616 3736        ProfSvc         (97293447431311c06703368ad0f6c4be) C:\windows\system32\profsvc.dll

12:28:21.0663 3736        ProfSvc - ok

12:28:21.0694 3736        ProtectedStorage (156f6159457d0aa7e59b62681b56eb90) C:\windows\system32\lsass.exe

12:28:21.0709 3736        ProtectedStorage - ok

12:28:21.0756 3736        Psched          (ee992183bd8eaefd9973f352e587a299) C:\windows\system32\DRIVERS\pacer.sys

12:28:21.0819 3736        Psched - ok

12:28:21.0897 3736        PSI             (fb46e9a827a8799ebd7bfa9128c91f37) C:\windows\system32\DRIVERS\psi_mf.sys

12:28:21.0912 3736        PSI - ok

12:28:22.0053 3736        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\windows\system32\DRIVERS\ql2300.sys

12:28:22.0131 3736        ql2300 - ok

12:28:22.0287 3736        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\windows\system32\DRIVERS\ql40xx.sys

12:28:22.0318 3736        ql40xx - ok

12:28:22.0380 3736        QWAVE           (906191634e99aea92c4816150bda3732) C:\windows\system32\qwave.dll

12:28:22.0427 3736        QWAVE - ok

12:28:22.0458 3736        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\windows\system32\drivers\qwavedrv.sys

12:28:22.0505 3736        QWAVEdrv - ok

12:28:22.0521 3736        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\windows\system32\DRIVERS\rasacd.sys

12:28:22.0599 3736        RasAcd - ok

12:28:22.0661 3736        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\windows\system32\DRIVERS\AgileVpn.sys

12:28:22.0723 3736        RasAgileVpn - ok

12:28:22.0755 3736        RasAuto         (8f26510c5383b8dbe976de1cd00fc8c7) C:\windows\System32\rasauto.dll

12:28:22.0848 3736        RasAuto - ok

12:28:22.0879 3736        Rasl2tp         (87a6e852a22991580d6d39adc4790463) C:\windows\system32\DRIVERS\rasl2tp.sys

12:28:22.0957 3736        Rasl2tp - ok

12:28:23.0004 3736        RasMan          (47394ed3d16d053f5906efe5ab51cc83) C:\windows\System32\rasmans.dll

12:28:23.0098 3736        RasMan - ok

12:28:23.0129 3736        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\windows\system32\DRIVERS\raspppoe.sys

12:28:23.0191 3736        RasPppoe - ok

12:28:23.0223 3736        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\windows\system32\DRIVERS\rassstp.sys

12:28:23.0269 3736        RasSstp - ok

12:28:23.0332 3736        rdbss           (3bac8142102c15d59a87757c1d41dce5) C:\windows\system32\DRIVERS\rdbss.sys

12:28:23.0425 3736        rdbss - ok

12:28:23.0441 3736        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\windows\system32\DRIVERS\rdpbus.sys

12:28:23.0472 3736        rdpbus - ok

12:28:23.0503 3736        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\windows\system32\DRIVERS\RDPCDD.sys

12:28:23.0550 3736        RDPCDD - ok

12:28:23.0566 3736        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\windows\system32\drivers\rdpencdd.sys

12:28:23.0613 3736        RDPENCDD - ok

12:28:23.0628 3736        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\windows\system32\drivers\rdprefmp.sys

12:28:23.0675 3736        RDPREFMP - ok

12:28:23.0769 3736        RDPWD           (447de7e3dea39d422c1504f245b668b1) C:\windows\system32\drivers\RDPWD.sys

12:28:23.0862 3736        RDPWD - ok

12:28:23.0909 3736        rdyboost        (634b9a2181d98f15941236886164ec8b) C:\windows\system32\drivers\rdyboost.sys

12:28:23.0940 3736        rdyboost - ok

12:28:23.0971 3736        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\windows\System32\mprdim.dll

12:28:24.0018 3736        RemoteAccess - ok

12:28:24.0065 3736        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\windows\system32\regsvc.dll

12:28:24.0143 3736        RemoteRegistry - ok

12:28:24.0174 3736        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\windows\System32\RpcEpMap.dll

12:28:24.0221 3736        RpcEptMapper - ok

12:28:24.0252 3736        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\windows\system32\locator.exe

12:28:24.0268 3736        RpcLocator - ok

12:28:24.0315 3736        RpcSs           (7266972e86890e2b30c0c322e906b027) C:\windows\system32\rpcss.dll

12:28:24.0361 3736        RpcSs - ok

12:28:24.0408 3736        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\windows\system32\DRIVERS\rspndr.sys

12:28:24.0455 3736        rspndr - ok

12:28:24.0502 3736        RTL8167         (7ea8d2eb9bbfd2ab8a3117a1e96d3b3a) C:\windows\system32\DRIVERS\Rt64win7.sys

12:28:24.0533 3736        RTL8167 - ok

12:28:24.0564 3736        SamSs           (156f6159457d0aa7e59b62681b56eb90) C:\windows\system32\lsass.exe

12:28:24.0580 3736        SamSs - ok

12:28:24.0611 3736        sbp2port        (e3bbb89983daf5622c1d50cf49f28227) C:\windows\system32\DRIVERS\sbp2port.sys

12:28:24.0627 3736        sbp2port - ok

12:28:24.0689 3736        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\windows\System32\SCardSvr.dll

12:28:24.0798 3736        SCardSvr - ok

12:28:24.0814 3736        scfilter        (c94da20c7e3ba1dca269bc8460d98387) C:\windows\system32\DRIVERS\scfilter.sys

12:28:24.0861 3736        scfilter - ok

12:28:24.0970 3736        Schedule        (624d0f5ff99428bb90a5b8a4123e918e) C:\windows\system32\schedsvc.dll

12:28:25.0017 3736        Schedule - ok

12:28:25.0048 3736        SCPolicySvc     (312e2f82af11e79906898ac3e3d58a1f) C:\windows\System32\certprop.dll

12:28:25.0095 3736        SCPolicySvc - ok

12:28:25.0141 3736        sdbus           (54e47ad086782d3ae9417c155cdceb9b) C:\windows\system32\DRIVERS\sdbus.sys

12:28:25.0173 3736        sdbus - ok

12:28:25.0219 3736        SDRSVC          (765a27c3279ce11d14cb9e4f5869fca5) C:\windows\System32\SDRSVC.dll

12:28:25.0282 3736        SDRSVC - ok

12:28:25.0375 3736        SeaPort         (d358e077a0a05d9b12da22d137ee8464) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

12:28:25.0391 3736        SeaPort - ok

12:28:25.0422 3736        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\windows\system32\drivers\secdrv.sys

12:28:25.0500 3736        secdrv - ok

12:28:25.0531 3736        seclogon        (463b386ebc70f98da5dff85f7e654346) C:\windows\system32\seclogon.dll

12:28:25.0594 3736        seclogon - ok

12:28:25.0859 3736        Secunia PSI Agent (f70a51eb03ee7046784ef62efce9528e) C:\Program Files (x86)\Secunia\PSI\PSIA.exe

12:28:25.0984 3736        Secunia PSI Agent - ok

12:28:26.0155 3736        Secunia Update Agent (ad56ceb08eeb517332355fde9e5939c8) C:\Program Files (x86)\Secunia\PSI\sua.exe

12:28:26.0202 3736        Secunia Update Agent - ok

12:28:26.0327 3736        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\windows\System32\sens.dll

12:28:26.0405 3736        SENS - ok

12:28:26.0421 3736        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\windows\system32\sensrsvc.dll

12:28:26.0467 3736        SensrSvc - ok

12:28:26.0514 3736        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\windows\system32\DRIVERS\serenum.sys

12:28:26.0545 3736        Serenum - ok

12:28:26.0561 3736        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\windows\system32\DRIVERS\serial.sys

12:28:26.0608 3736        Serial - ok

12:28:26.0608 3736        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\windows\system32\DRIVERS\sermouse.sys

12:28:26.0623 3736        sermouse - ok

12:28:26.0670 3736        SessionEnv      (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\windows\system32\sessenv.dll

12:28:26.0717 3736        SessionEnv - ok

12:28:26.0717 3736        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\windows\system32\DRIVERS\sffdisk.sys

12:28:26.0748 3736        sffdisk - ok

12:28:26.0764 3736        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\windows\system32\DRIVERS\sffp_mmc.sys

12:28:26.0779 3736        sffp_mmc - ok

12:28:26.0779 3736        sffp_sd         (5588b8c6193eb1522490c122eb94dffa) C:\windows\system32\DRIVERS\sffp_sd.sys

12:28:26.0811 3736        sffp_sd - ok

12:28:26.0826 3736        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\windows\system32\DRIVERS\sfloppy.sys

12:28:26.0842 3736        sfloppy - ok

12:28:26.0889 3736        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\windows\System32\ipnathlp.dll

12:28:26.0967 3736        SharedAccess - ok

12:28:27.0045 3736        ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\windows\System32\shsvcs.dll

12:28:27.0091 3736        ShellHWDetection - ok

12:28:27.0107 3736        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\windows\system32\DRIVERS\SiSRaid2.sys

12:28:27.0123 3736        SiSRaid2 - ok

12:28:27.0185 3736        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\windows\system32\DRIVERS\sisraid4.sys

12:28:27.0201 3736        SiSRaid4 - ok

12:28:27.0310 3736        SkypeUpdate     (ea396139541706b4b433641d62ea53ce) C:\Program Files (x86)\Skype\Updater\Updater.exe

12:28:27.0325 3736        SkypeUpdate - ok

12:28:27.0341 3736        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\windows\system32\DRIVERS\smb.sys

12:28:27.0403 3736        Smb - ok

12:28:27.0528 3736        smserial        (7ae8bca90539ecbde87ac45ba1436be3) C:\windows\system32\DRIVERS\SmSerl64.sys

12:28:27.0606 3736        smserial - ok

12:28:27.0637 3736        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\windows\System32\snmptrap.exe

12:28:27.0669 3736        SNMPTRAP - ok

12:28:27.0684 3736        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\windows\system32\drivers\spldr.sys

12:28:27.0700 3736        spldr - ok

12:28:27.0762 3736        Spooler         (f8e1fa03cb70d54a9892ac88b91d1e7b) C:\windows\System32\spoolsv.exe

12:28:27.0825 3736        Spooler - ok

12:28:28.0074 3736        sppsvc          (913d843498553a1bc8f8dbad6358e49f) C:\windows\system32\sppsvc.exe

12:28:28.0183 3736        sppsvc - ok

12:28:28.0308 3736        sppuinotify     (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\windows\system32\sppuinotify.dll

12:28:28.0371 3736        sppuinotify - ok

12:28:28.0495 3736        sptd            (602884696850c86434530790b110e8eb) C:\windows\system32\Drivers\sptd.sys

12:28:28.0495 3736        Suspicious file (NoAccess): C:\windows\system32\Drivers\sptd.sys. md5: 602884696850c86434530790b110e8eb

12:28:28.0511 3736        sptd ( LockedFile.Multi.Generic ) - warning

12:28:28.0511 3736        sptd - detected LockedFile.Multi.Generic (1)

12:28:28.0589 3736        srv             (2408c0366d96bcdf63e8f1c78e4a29c5) C:\windows\system32\DRIVERS\srv.sys

12:28:28.0667 3736        srv - ok

12:28:28.0729 3736        srv2            (76548f7b818881b47d8d1ae1be9c11f8) C:\windows\system32\DRIVERS\srv2.sys

12:28:28.0761 3736        srv2 - ok

12:28:28.0807 3736        srvnet          (0af6e19d39c70844c5caa8fb0183c36e) C:\windows\system32\DRIVERS\srvnet.sys

12:28:28.0839 3736        srvnet - ok

12:28:28.0901 3736        SSDPSRV         (51b52fbd583cde8aa9ba62b8b4298f33) C:\windows\System32\ssdpsrv.dll

12:28:28.0995 3736        SSDPSRV - ok

12:28:29.0041 3736        SSPORT          (0211ab46b73a2623b86c1cfcb30579ab) C:\windows\system32\Drivers\SSPORT.sys

12:28:29.0057 3736        SSPORT - ok

12:28:29.0119 3736        SstpSvc         (ab7aebf58dad8daab7a6c45e6a8885cb) C:\windows\system32\sstpsvc.dll

12:28:29.0166 3736        SstpSvc - ok

12:28:29.0213 3736        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\windows\system32\DRIVERS\stexstor.sys

12:28:29.0213 3736        stexstor - ok

12:28:29.0291 3736        stisvc          (52d0e33b681bd0f33fdc08812fee4f7d) C:\windows\System32\wiaservc.dll

12:28:29.0369 3736        stisvc - ok

12:28:29.0385 3736        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\windows\system32\DRIVERS\swenum.sys

12:28:29.0400 3736        swenum - ok

12:28:29.0447 3736        swprv           (e08e46fdd841b7184194011ca1955a0b) C:\windows\System32\swprv.dll

12:28:29.0541 3736        swprv - ok

12:28:29.0712 3736        SysMain         (3c1284516a62078fb68f768de4f1a7be) C:\windows\system32\sysmain.dll

12:28:29.0790 3736        SysMain - ok

12:28:29.0915 3736        TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\windows\System32\TabSvc.dll

12:28:29.0977 3736        TabletInputService - ok

12:28:30.0009 3736        TapiSrv         (884264ac597b690c5707c89723bb8e7b) C:\windows\System32\tapisrv.dll

12:28:30.0071 3736        TapiSrv - ok

12:28:30.0087 3736        TBS             (1be03ac720f4d302ea01d40f588162f6) C:\windows\System32\tbssvc.dll

12:28:30.0133 3736        TBS - ok

12:28:30.0367 3736        Tcpip           (624c5b3aa4c99b3184bb922d9ece3ff0) C:\windows\system32\drivers\tcpip.sys

12:28:30.0445 3736        Tcpip - ok

12:28:30.0757 3736        TCPIP6          (624c5b3aa4c99b3184bb922d9ece3ff0) C:\windows\system32\DRIVERS\tcpip.sys

12:28:30.0804 3736        TCPIP6 - ok

12:28:30.0960 3736        tcpipreg        (76d078af6f587b162d50210f761eb9ed) C:\windows\system32\drivers\tcpipreg.sys

12:28:31.0007 3736        tcpipreg - ok

12:28:31.0023 3736        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\windows\system32\drivers\tdpipe.sys

12:28:31.0085 3736        TDPIPE - ok

12:28:31.0116 3736        TDTCP           (7518f7bcfd4b308abc9192bacaf6c970) C:\windows\system32\drivers\tdtcp.sys

12:28:31.0179 3736        TDTCP - ok

12:28:31.0225 3736        tdx             (079125c4b17b01fcaeebce0bcb290c0f) C:\windows\system32\DRIVERS\tdx.sys

12:28:31.0303 3736        tdx - ok

12:28:31.0553 3736        TeamViewer6     (1c46c27e9f1938b9589859c70450d275) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe

12:28:31.0600 3736        TeamViewer6 - ok

12:28:31.0740 3736        teamviewervpn   (f5520dbb47c60ee83024b38720abda24) C:\windows\system32\DRIVERS\teamviewervpn.sys

12:28:31.0756 3736        teamviewervpn - ok

12:28:31.0803 3736        TermDD          (c448651339196c0e869a355171875522) C:\windows\system32\DRIVERS\termdd.sys

12:28:31.0834 3736        TermDD - ok

12:28:31.0912 3736        TermService     (0f05ec2887bfe197ad82a13287d2f404) C:\windows\System32\termsrv.dll

12:28:31.0974 3736        TermService - ok

12:28:31.0990 3736        Themes          (f0344071948d1a1fa732231785a0664c) C:\windows\system32\themeservice.dll

12:28:32.0021 3736        Themes - ok

12:28:32.0037 3736        THREADORDER     (e40e80d0304a73e8d269f7141d77250b) C:\windows\system32\mmcss.dll

12:28:32.0083 3736        THREADORDER - ok

12:28:32.0115 3736        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\windows\System32\trkwks.dll

12:28:32.0177 3736        TrkWks - ok

12:28:32.0255 3736        TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\windows\servicing\TrustedInstaller.exe

12:28:32.0286 3736        TrustedInstaller - ok

12:28:32.0317 3736        tssecsrv        (61b96c26131e37b24e93327a0bd1fb95) C:\windows\system32\DRIVERS\tssecsrv.sys

12:28:32.0380 3736        tssecsrv - ok

12:28:32.0427 3736        tunnel          (3836171a2cdf3af8ef10856db9835a70) C:\windows\system32\DRIVERS\tunnel.sys

12:28:32.0473 3736        tunnel - ok

12:28:32.0505 3736        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\windows\system32\DRIVERS\uagp35.sys

12:28:32.0505 3736        uagp35 - ok

12:28:32.0583 3736        udfs            (d47baead86c65d4f4069d7ce0a4edceb) C:\windows\system32\DRIVERS\udfs.sys

12:28:32.0692 3736        udfs - ok

12:28:32.0754 3736        UDST7000BDA     (8943b9448dbd57570e4919326b312ee8) C:\windows\system32\DRIVERS\UDST7000BDA.sys

12:28:32.0801 3736        UDST7000BDA - ok

12:28:32.0832 3736        UDST7000HID     (d44cb4ea5cddcb0ccd535ffcd8975eba) C:\windows\system32\DRIVERS\UDST7000HID.sys

12:28:32.0832 3736        UDST7000HID - ok

12:28:32.0879 3736        UI0Detect       (3cbdec8d06b9968aba702eba076364a1) C:\windows\system32\UI0Detect.exe

12:28:32.0910 3736        UI0Detect - ok

12:28:32.0941 3736        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\windows\system32\DRIVERS\uliagpkx.sys

12:28:32.0957 3736        uliagpkx - ok

12:28:32.0973 3736        umbus           (eab6c35e62b1b0db0d1b48b671d3a117) C:\windows\system32\DRIVERS\umbus.sys

12:28:33.0019 3736        umbus - ok

12:28:33.0019 3736        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\windows\system32\DRIVERS\umpass.sys

12:28:33.0051 3736        UmPass - ok

12:28:33.0300 3736        UNS             (765f2dd351ba064f657751d8d75e58c0) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

12:28:33.0378 3736        UNS - ok

12:28:33.0519 3736        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\windows\System32\upnphost.dll

12:28:33.0597 3736        upnphost - ok

12:28:33.0690 3736        USBAAPL64       (fb251567f41bc61988b26731dec19e4b) C:\windows\system32\Drivers\usbaapl64.sys

12:28:33.0737 3736        USBAAPL64 - ok

12:28:33.0768 3736        usbccgp         (7b6a127c93ee590e4d79a5f2a76fe46f) C:\windows\system32\DRIVERS\usbccgp.sys

12:28:33.0831 3736        usbccgp - ok

12:28:33.0893 3736        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\windows\system32\DRIVERS\usbcir.sys

12:28:33.0924 3736        usbcir - ok

12:28:33.0955 3736        usbehci         (92969ba5ac44e229c55a332864f79677) C:\windows\system32\drivers\usbehci.sys

12:28:33.0971 3736        usbehci - ok

12:28:34.0002 3736        usbhub          (e7df1cfd28ca86b35ef5add0735ceef3) C:\windows\system32\DRIVERS\usbhub.sys

12:28:34.0065 3736        usbhub - ok

12:28:34.0111 3736        usbohci         (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\windows\system32\drivers\usbohci.sys

12:28:34.0158 3736        usbohci - ok

12:28:34.0205 3736        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\windows\system32\DRIVERS\usbprint.sys

12:28:34.0252 3736        usbprint - ok

12:28:34.0314 3736        usbscan         (aaa2513c8aed8b54b189fd0c6b1634c0) C:\windows\system32\DRIVERS\usbscan.sys

12:28:34.0361 3736        usbscan - ok

12:28:34.0392 3736        USBSTOR         (f39983647bc1f3e6100778ddfe9dce29) C:\windows\system32\DRIVERS\USBSTOR.SYS

12:28:34.0423 3736        USBSTOR - ok

12:28:34.0455 3736        usbuhci         (bc3070350a491d84b518d7cca9abd36f) C:\windows\system32\drivers\usbuhci.sys

12:28:34.0486 3736        usbuhci - ok

12:28:34.0564 3736        usbvideo        (7cb8c573c6e4a2714402cc0a36eab4fe) C:\windows\System32\Drivers\usbvideo.sys

12:28:34.0611 3736        usbvideo - ok

12:28:34.0657 3736        UxSms           (edbb23cbcf2cdf727d64ff9b51a6070e) C:\windows\System32\uxsms.dll

12:28:34.0720 3736        UxSms - ok

12:28:34.0767 3736        VaultSvc        (156f6159457d0aa7e59b62681b56eb90) C:\windows\system32\lsass.exe

12:28:34.0782 3736        VaultSvc - ok

12:28:34.0829 3736        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\windows\system32\DRIVERS\vdrvroot.sys

12:28:34.0860 3736        vdrvroot - ok

12:28:34.0954 3736        vds             (44d73e0bbc1d3c8981304ba15135c2f2) C:\windows\System32\vds.exe

12:28:35.0047 3736        vds - ok

12:28:35.0063 3736        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\windows\system32\DRIVERS\vgapnp.sys

12:28:35.0079 3736        vga - ok

12:28:35.0110 3736        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\windows\System32\drivers\vga.sys

12:28:35.0172 3736        VgaSave - ok

12:28:35.0188 3736        vhdmp           (c82e748660f62a242b2dfac1442f22a4) C:\windows\system32\DRIVERS\vhdmp.sys

12:28:35.0203 3736        vhdmp - ok

12:28:35.0235 3736        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\windows\system32\DRIVERS\viaide.sys

12:28:35.0235 3736        viaide - ok

12:28:35.0266 3736        volmgr          (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\windows\system32\DRIVERS\volmgr.sys

12:28:35.0281 3736        volmgr - ok

12:28:35.0313 3736        volmgrx         (99b0cbb569ca79acaed8c91461d765fb) C:\windows\system32\drivers\volmgrx.sys

12:28:35.0344 3736        volmgrx - ok

12:28:35.0375 3736        volsnap         (58f82eed8ca24b461441f9c3e4f0bf5c) C:\windows\system32\DRIVERS\volsnap.sys

12:28:35.0406 3736        volsnap - ok

12:28:35.0437 3736        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\windows\system32\DRIVERS\vsmraid.sys

12:28:35.0453 3736        vsmraid - ok

12:28:35.0593 3736        VSS             (787898bf9fb6d7bd87a36e2d95c899ba) C:\windows\system32\vssvc.exe

12:28:35.0656 3736        VSS - ok

12:28:35.0781 3736        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\windows\system32\DRIVERS\vwifibus.sys

12:28:35.0796 3736        vwifibus - ok

12:28:35.0827 3736        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\windows\system32\DRIVERS\vwififlt.sys

12:28:35.0859 3736        vwififlt - ok

12:28:35.0921 3736        vwifimp         (6a638fc4bfddc4d9b186c28c91bd1a01) C:\windows\system32\DRIVERS\vwifimp.sys

12:28:35.0952 3736        vwifimp - ok

12:28:35.0999 3736        W32Time         (1c9d80cc3849b3788048078c26486e1a) C:\windows\system32\w32time.dll

12:28:36.0077 3736        W32Time - ok

12:28:36.0108 3736        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\windows\system32\DRIVERS\wacompen.sys

12:28:36.0155 3736        WacomPen - ok

12:28:36.0202 3736        WANARP          (47ca49400643effd3f1c9a27e1d69324) C:\windows\system32\DRIVERS\wanarp.sys

12:28:36.0280 3736        WANARP - ok

12:28:36.0295 3736        Wanarpv6        (47ca49400643effd3f1c9a27e1d69324) C:\windows\system32\DRIVERS\wanarp.sys

12:28:36.0342 3736        Wanarpv6 - ok

12:28:36.0498 3736        wbengine        (5ab1bb85bd8b5089cc5d64200dedae68) C:\windows\system32\wbengine.exe

12:28:36.0623 3736        wbengine - ok

12:28:36.0764 3736        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\windows\System32\wbiosrvc.dll

12:28:36.0827 3736        WbioSrvc - ok

12:28:36.0920 3736        wcncsvc         (dd1bae8ebfc653824d29ccf8c9054d68) C:\windows\System32\wcncsvc.dll

12:28:36.0983 3736        wcncsvc - ok

12:28:36.0998 3736        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\windows\System32\WcsPlugInService.dll

12:28:37.0045 3736        WcsPlugInService - ok

12:28:37.0092 3736        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\windows\system32\DRIVERS\wd.sys

12:28:37.0123 3736        Wd - ok

12:28:37.0186 3736        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\windows\system32\drivers\Wdf01000.sys

12:28:37.0232 3736        Wdf01000 - ok

12:28:37.0279 3736        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\windows\system32\wdi.dll

12:28:37.0310 3736        WdiServiceHost - ok

12:28:37.0310 3736        WdiSystemHost   (bf1fc3f79b863c914687a737c2f3d681) C:\windows\system32\wdi.dll

12:28:37.0342 3736        WdiSystemHost - ok

12:28:37.0404 3736        WebClient       (733006127f235be7c35354ebee7b9a7b) C:\windows\System32\webclnt.dll

12:28:37.0482 3736        WebClient - ok

12:28:37.0544 3736        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\windows\system32\wecsvc.dll

12:28:37.0654 3736        Wecsvc - ok

12:28:37.0685 3736        wercplsupport   (7e591867422dc788b9e5bd337a669a08) C:\windows\System32\wercplsupport.dll

12:28:37.0747 3736        wercplsupport - ok

12:28:37.0794 3736        WerSvc          (6d137963730144698cbd10f202e9f251) C:\windows\System32\WerSvc.dll

12:28:37.0888 3736        WerSvc - ok

12:28:37.0950 3736        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\windows\system32\DRIVERS\wfplwf.sys

12:28:38.0012 3736        WfpLwf - ok

12:28:38.0028 3736        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\windows\system32\drivers\wimmount.sys

12:28:38.0044 3736        WIMMount - ok

12:28:38.0106 3736        WinDefend - ok

12:28:38.0122 3736        WinHttpAutoProxySvc - ok

12:28:38.0215 3736        Winmgmt         (19b07e7e8915d701225da41cb3877306) C:\windows\system32\wbem\WMIsvc.dll

12:28:38.0293 3736        Winmgmt - ok

12:28:38.0465 3736        WinRM           (41fbb751936b387f9179e7f03a74fe29) C:\windows\system32\WsmSvc.dll

12:28:38.0590 3736        WinRM - ok

12:28:38.0792 3736        Wlansvc         (4fada86e62f18a1b2f42ba18ae24e6aa) C:\windows\System32\wlansvc.dll

12:28:38.0839 3736        Wlansvc - ok

12:28:38.0886 3736        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\windows\system32\DRIVERS\wmiacpi.sys

12:28:38.0917 3736        WmiAcpi - ok

12:28:39.0011 3736        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\windows\system32\wbem\WmiApSrv.exe

12:28:39.0073 3736        wmiApSrv - ok

12:28:39.0136 3736        WMPNetworkSvc - ok

12:28:39.0167 3736        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\windows\System32\wpcsvc.dll

12:28:39.0214 3736        WPCSvc - ok

12:28:39.0260 3736        WPDBusEnum      (2e57ddf2880a7e52e76f41c7e96d327b) C:\windows\system32\wpdbusenum.dll

12:28:39.0276 3736        WPDBusEnum - ok

12:28:39.0307 3736        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\windows\system32\drivers\ws2ifsl.sys

12:28:39.0370 3736        ws2ifsl - ok

12:28:39.0416 3736        wscsvc          (8f9f3969933c02da96eb0f84576db43e) C:\windows\System32\wscsvc.dll

12:28:39.0463 3736        wscsvc - ok

12:28:39.0463 3736        WSearch - ok

12:28:39.0666 3736        wuauserv        (d9ef901dca379cfe914e9fa13b73b4c4) C:\windows\system32\wuaueng.dll

12:28:39.0760 3736        wuauserv - ok

12:28:39.0916 3736        WudfPf          (7cadc74271dd6461c452c271b30bd378) C:\windows\system32\drivers\WudfPf.sys

12:28:40.0025 3736        WudfPf - ok

12:28:40.0072 3736        WUDFRd          (3b197af0fff08aa66b6b2241ca538d64) C:\windows\system32\DRIVERS\WUDFRd.sys

12:28:40.0134 3736        WUDFRd - ok

12:28:40.0181 3736        wudfsvc         (b551d6637aa0e132c18ac6e504f7b79b) C:\windows\System32\WUDFSvc.dll

12:28:40.0259 3736        wudfsvc - ok

12:28:40.0321 3736        WwanSvc         (9a3452b3c2a46c073166c5cf49fad1ae) C:\windows\System32\wwansvc.dll

12:28:40.0368 3736        WwanSvc - ok

12:28:40.0446 3736        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

12:28:40.0898 3736        \Device\Harddisk0\DR0 - ok

12:28:40.0930 3736        Boot (0x1200)   (1ad88f4aa9cc3c90775abc549902d820) \Device\Harddisk0\DR0\Partition0

12:28:40.0930 3736        \Device\Harddisk0\DR0\Partition0 - ok

12:28:40.0930 3736        ============================================================

12:28:40.0930 3736        Scan finished

12:28:40.0930 3736        ============================================================

12:28:40.0945 2336        Detected object count: 3

12:28:40.0945 2336        Actual detected object count: 3

12:34:25.0098 2336        FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - skipped by user

12:34:25.0098 2336        FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:34:25.0098 2336        Micro Star SCM ( UnsignedFile.Multi.Generic ) - skipped by user

12:34:25.0098 2336        Micro Star SCM ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:34:25.0098 2336        sptd ( LockedFile.Multi.Generic ) - skipped by user

12:34:25.0098 2336        sptd ( LockedFile.Multi.Generic ) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Okay...hier die Log-Datei von ComboFix:

Code:

ComboFix 12-07-21.01 - Julia 22.07.2012  13:31:27.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3886.2197 [GMT 2:00]

ausgeführt von:: c:\users\Julia\Desktop\ComboFix.exe

AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\Install.exe

c:\windows\IsUn0407.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-06-22 bis 2012-07-22  ))))))))))))))))))))))))))))))

.

.

2012-07-20 09:25 . 2012-07-16 00:40        9133488        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{C0B485D3-EC5D-4CBC-BD1D-4D708BBCDBDA}\mpengine.dll

2012-07-15 10:21 . 2012-07-16 17:28        --------        d-----w-        C:\_OTL

2012-07-11 18:06 . 2012-06-12 03:02        3147264        ----a-w-        c:\windows\system32\win32k.sys

2012-07-11 16:47 . 2012-07-11 16:47        --------        d-----w-        c:\program files (x86)\ESET

2012-07-10 18:03 . 2012-07-10 18:03        --------        d-----w-        c:\program files (x86)\MozBackup

2012-07-06 18:54 . 2012-07-11 18:02        59701280        ----a-w-        c:\windows\system32\MRT.exe

2012-07-06 18:47 . 2012-07-06 18:47        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll

2012-07-06 18:47 . 2012-07-06 18:47        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll

2012-07-06 18:47 . 2012-07-06 18:47        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll

2012-07-06 18:47 . 2012-07-06 18:47        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll

2012-07-06 18:47 . 2012-07-06 18:47        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll

2012-07-06 18:47 . 2012-07-06 18:47        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll

2012-07-06 18:47 . 2012-07-06 18:47        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll

2012-07-06 18:46 . 2012-07-06 18:47        --------        d-----w-        c:\program files (x86)\QuickTime

2012-07-06 18:20 . 2012-07-06 18:20        --------        d-----w-        c:\program files (x86)\Common Files\Skype

2012-07-06 18:20 . 2012-07-06 18:20        --------        d-----r-        c:\program files (x86)\Skype

2012-07-06 17:59 . 2012-07-06 17:59        476936        ----a-w-        c:\windows\SysWow64\npdeployJava1.dll

2012-07-06 17:55 . 2012-07-06 17:55        --------        d-----w-        c:\program files\iPod

2012-07-06 17:55 . 2012-07-06 17:57        --------        d-----w-        c:\program files\iTunes

2012-07-06 17:52 . 2012-07-06 17:52        --------        d-----w-        c:\program files (x86)\Apple Software Update

2012-07-06 17:44 . 2012-07-06 17:44        --------        d-----w-        c:\users\Julia\AppData\Local\Secunia PSI

2012-07-06 17:44 . 2012-07-06 17:44        --------        d-----w-        c:\program files (x86)\Secunia

2012-07-06 17:40 . 2012-07-06 17:40        --------        d-----w-        c:\programdata\Panda Security

2012-07-06 17:40 . 2012-07-06 17:40        --------        d-----w-        c:\program files (x86)\Panda USB Vaccine

2012-07-05 16:09 . 2012-07-05 16:09        --------        d-----w-        c:\users\Julia\AppData\Roaming\TeamViewer

2012-07-05 15:55 . 2012-07-05 15:55        834544        ----a-w-        c:\windows\system32\drivers\sptd.sys

2012-07-05 15:54 . 2012-07-05 15:54        --------        d-----w-        c:\program files (x86)\LSoft Technologies

2012-07-05 14:21 . 2012-07-06 14:13        --------        d-----w-        c:\users\Julia\AppData\Local\ElevatedDiagnostics

2012-07-05 14:00 . 2012-07-05 14:00        --------        d-----w-        c:\users\Julia\AppData\Roaming\Malwarebytes

2012-07-05 14:00 . 2012-07-05 14:00        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2012-07-05 14:00 . 2012-07-05 14:00        --------        d-----w-        c:\programdata\Malwarebytes

2012-07-05 14:00 . 2012-04-04 13:56        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-06-24 18:15 . 2012-06-24 18:15        --------        d-----w-        c:\users\Julia\AppData\Local\Macromedia

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-07-12 09:50 . 2012-04-01 12:03        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-07-12 09:50 . 2011-07-02 10:31        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-07-06 17:59 . 2011-07-02 11:12        472840        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2012-07-05 23:23 . 2012-07-05 23:22        54120        ----a-w-        C:\OTL.zip

2012-06-02 22:19 . 2012-06-21 11:31        38424        ----a-w-        c:\windows\system32\wups.dll

2012-06-02 22:19 . 2012-06-21 11:32        2428952        ----a-w-        c:\windows\system32\wuaueng.dll

2012-06-02 22:19 . 2012-06-21 11:32        57880        ----a-w-        c:\windows\system32\wuauclt.exe

2012-06-02 22:19 . 2012-06-21 11:32        44056        ----a-w-        c:\windows\system32\wups2.dll

2012-06-02 22:19 . 2012-06-21 11:31        701976        ----a-w-        c:\windows\system32\wuapi.dll

2012-06-02 22:15 . 2012-06-21 11:32        2622464        ----a-w-        c:\windows\system32\wucltux.dll

2012-06-02 22:15 . 2012-06-21 11:31        99840        ----a-w-        c:\windows\system32\wudriver.dll

2012-06-02 13:19 . 2012-06-21 11:30        186752        ----a-w-        c:\windows\system32\wuwebv.dll

2012-06-02 13:15 . 2012-06-21 11:30        36864        ----a-w-        c:\windows\system32\wuapp.exe

2012-05-31 10:25 . 2011-07-02 11:00        279656        ------w-        c:\windows\system32\MpSigStub.exe

2012-05-15 03:56 . 2012-06-14 09:35        1197568        ----a-w-        c:\windows\system32\wininet.dll

2012-05-15 03:52 . 2012-06-14 09:35        64512        ----a-w-        c:\windows\system32\jsproxy.dll

2012-05-15 03:08 . 2012-06-14 09:35        981504        ----a-w-        c:\windows\SysWow64\wininet.dll

2012-05-04 10:52 . 2012-06-14 09:35        5505392        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-05-04 10:08 . 2012-06-14 09:35        3958128        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2012-05-04 10:08 . 2012-06-14 09:35        3902320        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2012-05-02 05:32 . 2012-06-14 09:35        208896        ----a-w-        c:\windows\system32\profsvc.dll

2012-04-28 03:50 . 2012-06-14 09:35        204800        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-04-26 05:34 . 2012-06-14 09:35        76288        ----a-w-        c:\windows\system32\rdpwsx.dll

2012-04-26 05:34 . 2012-06-14 09:35        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll

2012-04-26 05:28 . 2012-06-14 09:35        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe

2012-04-24 05:59 . 2012-06-14 09:34        1460224        ----a-w-        c:\windows\system32\crypt32.dll

2012-04-24 05:59 . 2012-06-14 09:34        182272        ----a-w-        c:\windows\system32\cryptsvc.dll

2012-04-24 05:59 . 2012-06-14 09:34        140288        ----a-w-        c:\windows\system32\cryptnet.dll

2012-04-24 04:47 . 2012-06-14 09:34        139264        ----a-w-        c:\windows\SysWow64\cryptsvc.dll

2012-04-24 04:47 . 2012-06-14 09:34        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll

2012-04-24 04:47 . 2012-06-14 09:34        1156608        ----a-w-        c:\windows\SysWow64\crypt32.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]

"Remote Control Editor"="c:\program files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe" [2010-09-13 1695816]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-04-13 284696]

"MGSysCtrl"="c:\program files (x86)\System Control Manager\MGSysCtrl.exe" [2010-06-05 2486272]

"THX Audio Control Panel"="c:\program files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe" [2010-05-16 1349632]

"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2012-6-27 572000]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-03 160944]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 250056]

R3 EUCR;EUCR;c:\windows\system32\DRIVERS\EUCR6SK.SYS [2009-12-05 87888]

R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]

R3 MGHwCtrl;MGHwCtrl;c:\program files\msi\msi Software Install\MGHwCtrl.sys [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-18 113120]

R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2011-04-13 45432]

R3 UDST7000BDA;TerraTec S7 service;c:\windows\system32\DRIVERS\UDST7000BDA.sys [2010-02-10 572608]

R3 UDST7000HID;TerraTec H7/S7 HID service;c:\windows\system32\DRIVERS\UDST7000HID.sys [2010-02-10 25664]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2012-07-05 834544]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]

S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-04-13 13336]

S2 Micro Star SCM;Micro Star SCM;c:\program files (x86)\System Control Manager\MSIService.exe [2009-07-09 160768]

S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-05-05 1604200]

S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2012-06-27 1326176]

S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2012-06-27 681056]

S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2009-11-17 11576]

S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-30 2358656]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]

S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2009-05-26 19968]

S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2010-01-18 128512]

S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 158976]

S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-02-02 271872]

S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [2009-11-18 32344]

S3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2010-01-13 7675392]

S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2011-12-16 17976]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-04 346144]

S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [2011-03-30 35112]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

Inhalt des "geplante Tasks" Ordners

.

2012-07-22 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 09:50]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-26 161304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-26 386584]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-26 413208]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-05-05 17412200]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-05-26 10816544]

"THXCfg64"="c:\windows\system32\THXCfg64.dll" [2009-10-15 17920]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-04-13 2399632]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x1

"AppInit_DLLs"=c:\windows\System32\nvinitx.dll

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://msi.msn.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\zvhu1dy6.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-ETDWare - c:\program files (x86)\Elantech\ETDCtrl.exe

AddRemove-Caesar 3 - c:\windows\IsUn0407.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files (x86)\AnVir Task Manager\AnVir.exe

c:\program files (x86)\Panda USB Vaccine\USBVaccine.exe

c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-07-22  13:55:20 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-07-22 11:55

.

Vor Suchlauf: 4.321.902.592 Bytes frei

Nach Suchlauf: 2.851.790.848 Bytes frei

.

- - End Of File - - F456CAA00155195873B77827B913908E

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

So, die Logs sind erstellt, hier sind sie:

1. GMER
Hierbei konnte ich allerdings nur Services, Registry und Files anhaken, die anderen Checkboxen waren alle disabled.

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-07-25 18:05:25

Windows 6.1.7600  

Running: poe2its1.exe
 
 

---- Registry - GMER 1.0.15 ----
 

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1  771343423

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2  285507792
 

---- EOF - GMER 1.0.15 ----

2. OSAM
Das "Autorun Data Scanning" ist direkt durchgelaufen. Das Online-Scannen der Files habe ich dann mit Cancel übersprungen, ich hoffe, das war so richtig.

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 18:12:05 on 25.07.2012
 

OS: Windows 7 Home Premium Edition (Build 7600), 64-bit

Default Browser: Mozilla Corporation Firefox 14.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"nvcpl.cpl" - "NVIDIA Corporation" - C:\windows\system32\nvcpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"QuickTime" - "Apple Inc." - C:\Program Files (x86)\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgntflt" (avgntflt) - "Avira GmbH" - C:\windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\windows\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"DgiVecp" (DgiVecp) - ? - C:\windows\system32\Drivers\DgiVecp.sys  (File not found)

"MGHwCtrl" (MGHwCtrl) - ? - C:\Program Files\msi\msi Software Install\MGHwCtrl.sys  (File not found)

"PSI" (PSI) - "Secunia" - C:\windows\System32\DRIVERS\psi_mf.sys

"sptd" (sptd) - "Duplex Secure Ltd." - C:\windows\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{AE424E85-F6DF-4910-A6A9-438797986431} "OpenOffice.org Property Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files (x86)\WinRAR\rarext.dll  (File found, but it contains no detailed information)

{B41DB860-64E4-11D2-9906-E49FADC173CA} "WinRAR shell extension" - ? -   (File not found | COM-object registry key not found)

{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab

{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\npjpi160_33.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"ICQ7.5" - "ICQ, LLC." - C:\Program Files (x86)\ICQ7.5\ICQ.exe

{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll

{AD6E6555-FB2C-47D4-8339-3E2965509877} "TerraTec Home Cinema" - "TerraTec Electronic GmbH" - C:\PROGRA~2\TerraTec\TERRAT~1\THCDES~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corp." - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"Secunia PSI Tray.lnk" - "Secunia" - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe  (Shortcut exists | File exists)

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"Remote Control Editor" - "Elgato Systems" - "C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe"

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"APSDaemon" - "Apple Inc." - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"ArcSoft Connection Service" - "ArcSoft Inc." - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

"avgnt" - "Avira GmbH" - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min

"IAStorIcon" - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"MGSysCtrl" - ? - C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe

"QuickTime Task" - "Apple Inc." - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

"THX Audio Control Panel" - "Creative Technology Ltd" - "C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe" /r

"UpdReg" - "Creative Technology Ltd." - C:\windows\UpdReg.EXE
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"ssb3m Langmon" - ? - C:\windows\system32\ssb3ml6.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)

"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)

"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"ArcSoft Connect Daemon" (ACDaemon) - "ArcSoft Inc." - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe

"Google Updater Service" (gusvc) - "Google" - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

"Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"Micro Star SCM" (Micro Star SCM) - "Micro-Star International Co., Ltd." - C:\Program Files (x86)\System Control Manager\MSIService.exe

"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\windows\system32\nvvsvc.exe

"NVIDIA Update Service Daemon" (nvUpdatusService) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

"SeaPort" (SeaPort) - "Microsoft Corp." - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

"Secunia PSI Agent" (Secunia PSI Agent) - "Secunia" - C:\Program Files (x86)\Secunia\PSI\PSIA.exe

"Secunia Update Agent" (Secunia Update Agent) - "Secunia" - C:\Program Files (x86)\Secunia\PSI\sua.exe

"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe

"TeamViewer 6" (TeamViewer6) - "TeamViewer GmbH" - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files (x86)\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

3. aswMBR.exe

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-07-25 18:48:10

-----------------------------

18:48:10.255    OS Version: Windows x64 6.1.7600 

18:48:10.255    Number of processors: 4 586 0x2502

18:48:10.255    ComputerName: JULIA  UserName: Julia

18:48:12.173    Initialize success

18:48:17.337    AVAST engine defs: 12072500

18:48:52.063    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

18:48:52.063    Disk 0 Vendor: WDC_WD32 01.0 Size: 305245MB BusType: 3

18:48:52.109    Disk 0 MBR read successfully

18:48:52.109    Disk 0 MBR scan

18:48:52.125    Disk 0 Windows 7 default MBR code

18:48:52.125    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        12288 MB offset 2048

18:48:52.172    Disk 0 Partition 2 80 (A) 27 Hidden NTFS WinRE NTFS          100 MB offset 25167872

18:48:52.203    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       292854 MB offset 25372672

18:48:52.219    Disk 0 scanning C:\windows\system32\drivers

18:49:17.210    Service scanning

18:49:54.338    Modules scanning

18:49:54.354    Disk 0 trace - called modules:

18:49:54.400    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys spif.sys hal.dll 

18:49:54.447    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004ca2060]

18:49:54.463    3 CLASSPNP.SYS[fffff88000d8543f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004986050]

18:49:57.552    AVAST engine scan C:\windows

18:50:08.050    AVAST engine scan C:\windows\system32

18:53:36.488    AVAST engine scan C:\windows\system32\drivers

18:53:47.861    AVAST engine scan C:\Users\Julia

19:08:56.030    AVAST engine scan C:\ProgramData

19:09:38.431    Scan finished successfully

19:11:00.003    Disk 0 MBR has been saved successfully to "C:\Users\Julia\Desktop\Virenscanner\MBR.dat"

19:11:00.003    The log file has been saved successfully to "C:\Users\Julia\Desktop\Virenscanner\aswMBR.txt"

Das geht übrigens alles nicht so schnell, da meine Tochter mitten in den Prüfungen steckt...

Gruß
Hartmut

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Geschafft, hier die Ergebnisse:

1. Malwarebytes:

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.07.26.12
 

Windows 7 x64 NTFS

Internet Explorer 8.0.7600.16385

Julia :: JULIA [Administrator]
 

26.07.2012 17:05:41

mbam-log-2012-07-26 (17-05-41).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 374294

Laufzeit: 52 Minute(n), 18 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

2. SASW

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 07/26/2012 at 11:00 PM
 

Application Version : 5.5.1012
 

Core Rules Database Version : 8967

Trace Rules Database Version: 6779
 

Scan type       : Complete Scan

Total Scan Time : 02:32:27
 

Operating System Information

Windows 7 Home Premium 64-bit (Build 6.01.7600)

UAC On - Administrator
 

Memory items scanned      : 639

Memory threats detected   : 0

Registry items scanned    : 71477

Registry threats detected : 0

File items scanned        : 152067

File threats detected     : 108
 

Adware.Tracking Cookie

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@adx.chip[1].txt [ /adx.chip ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@eyewonder[2].txt [ /eyewonder ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\BJVQ1ALS.txt [ /apmebf.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\4VB4AJ3H.txt [ /ad2.adfarm1.adition.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\MHAYLBW6.txt [ /mediaplex.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\C092XH3U.txt [ /zanox.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\LN9F9LHN.txt [ /smartadserver.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\Z9X4SPK7.txt [ /imrworldwide.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\P5XKJP5F.txt [ /tradedoubler.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\HGPJGTBT.txt [ /serving-sys.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\26JDO414.txt [ /c.atdmt.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\4EPFJ03K.txt [ /adfarm1.adition.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\K0SM47KQ.txt [ /track.adform.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\EVU1WOXA.txt [ /adform.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\X0FL16IW.txt [ /questionmarket.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\VBZA7MVC.txt [ /eas.apm.emediate.eu ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\AF02R85P.txt [ /bs.serving-sys.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\7DW2W5MW.txt [ /tracking.quisma.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\NYFG6RB8.txt [ /invitemedia.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\GUFTT0B9.txt [ /ad.yieldmanager.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\46VWVF1Z.txt [ /doubleclick.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\7EB48F0T.txt [ /fastclick.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\REMIDE9D.txt [ /ad3.adfarm1.adition.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\GMVMU0Z9.txt [ /content.yieldmanager.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\N6IOQ992.txt [ /ad1.adfarm1.adition.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\TI0FKZBJ.txt [ /atdmt.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\HMVXCDSD.txt [ /ad.zanox.com ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\julia@statse.webtrendslive[2].txt [ Cookie:julia@statse.webtrendslive.com/ ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\SMLA53DU.txt [ Cookie:julia@imrworldwide.com/cgi-bin ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\3NHQY4XD.txt [ Cookie:julia@c.atdmt.com/ ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\LU4K8QOM.txt [ Cookie:julia@doubleclick.net/ ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\YBLWI10J.txt [ Cookie:julia@atdmt.com/ ]

        C:\USERS\JULIA\Cookies\julia@adx.chip[1].txt [ Cookie:julia@adx.chip.de/ ]

        C:\USERS\JULIA\Cookies\BJVQ1ALS.txt [ Cookie:julia@apmebf.com/ ]

        C:\USERS\JULIA\Cookies\4VB4AJ3H.txt [ Cookie:julia@ad2.adfarm1.adition.com/ ]

        C:\USERS\JULIA\Cookies\MHAYLBW6.txt [ Cookie:julia@mediaplex.com/ ]

        C:\USERS\JULIA\Cookies\C092XH3U.txt [ Cookie:julia@zanox.com/ ]

        C:\USERS\JULIA\Cookies\LN9F9LHN.txt [ Cookie:julia@smartadserver.com/ ]

        C:\USERS\JULIA\Cookies\Z9X4SPK7.txt [ Cookie:julia@imrworldwide.com/cgi-bin ]

        C:\USERS\JULIA\Cookies\P5XKJP5F.txt [ Cookie:julia@tradedoubler.com/ ]

        C:\USERS\JULIA\Cookies\HGPJGTBT.txt [ Cookie:julia@serving-sys.com/ ]

        C:\USERS\JULIA\Cookies\26JDO414.txt [ Cookie:julia@c.atdmt.com/ ]

        C:\USERS\JULIA\Cookies\K0SM47KQ.txt [ Cookie:julia@track.adform.net/ ]

        C:\USERS\JULIA\Cookies\EVU1WOXA.txt [ Cookie:julia@adform.net/ ]

        C:\USERS\JULIA\Cookies\X0FL16IW.txt [ Cookie:julia@questionmarket.com/ ]

        C:\USERS\JULIA\Cookies\AF02R85P.txt [ Cookie:julia@bs.serving-sys.com/ ]

        C:\USERS\JULIA\Cookies\7DW2W5MW.txt [ Cookie:julia@tracking.quisma.com/ ]

        C:\USERS\JULIA\Cookies\NYFG6RB8.txt [ Cookie:julia@invitemedia.com/ ]

        C:\USERS\JULIA\Cookies\46VWVF1Z.txt [ Cookie:julia@doubleclick.net/ ]

        C:\USERS\JULIA\Cookies\REMIDE9D.txt [ Cookie:julia@ad3.adfarm1.adition.com/ ]

        C:\USERS\JULIA\Cookies\GMVMU0Z9.txt [ Cookie:julia@content.yieldmanager.com/ ]

        C:\USERS\JULIA\Cookies\N6IOQ992.txt [ Cookie:julia@ad1.adfarm1.adition.com/ ]

        C:\USERS\JULIA\Cookies\TI0FKZBJ.txt [ Cookie:julia@atdmt.com/ ]

        C:\USERS\JULIA\Cookies\HMVXCDSD.txt [ Cookie:julia@ad.zanox.com/ ]

        stat.ed.cupidplc.com [ C:\USERS\JULIA\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\KMX3DZP6 ]

        .doubleclick.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        7.rotator.wigetmedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        7.rotator.wigetmedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        7.rotator.wigetmedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .traffictrack.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .adform.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        ad4.adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        ww251.smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .statcounter.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ]

Gruß
Hartmut

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Mein System scheint in Ordnung zu sein, zumindest bemerke ich keine Probleme. Das einzige ist, dass der Rechner mir langsamer vorkommt als vorher. Ich werde mich dann erst mal daran machen, die ganzen Scanner, die ich installiert habe, wieder zu deinstallieren. Mal sehen, wie der sich dann verhält.

Mit deinen Tipps zu den Cookies werd ich mich nun auch mal auseinandersetzen. Vielen Dank erst mal für die gute Unterstützung!

Gruß
Hartmut

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Hallo,

ich melde mich zurück mit der Feststellung: Alles erledigt!

Hat ein bisschen gedauert wegen der Urlaubszeit.

Vielen Dank noch einmal für die gute Unterstützung!

Gruß
Hartmut