Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   TR/ATRAPS.Gen2, RootKit.0Access ... Rechner platt gemacht, was ist mit den gesicherten Daten zu tun? (https://www.trojaner-board.de/120855-tr-atraps-gen2-rootkit-0access-rechner-platt-gemacht-gesicherten-daten-tun.html)

Fontana 31.07.2012 12:58
TR/ATRAPS.Gen2, RootKit.0Access ... Rechner platt gemacht, was ist mit den gesicherten Daten zu tun?
 
Hallo liebes Forum,

Avira hat mir gestern den TR/ATRAPS.Gen2 gemeldet unter AppData\Local, habe ihn gelöscht. Dann mit Malwarebyte alle Laufwerke durchsucht, Fund 3x RootKit.0Access im gleichen Verzeichnis, sowie 3x Rogue.LiveSecurity.Platinum

Bei einer erneuten Suche, auch externe Festplatte, wurde nichts mehr gefunden. Danach habe ich nach Eurer Anleitung hier defooger benützt (hat nichts gefunden), dann OTL und schließlich Gmer (hat nichts gefunden).

Zur Sicherheit habe ich meine Dokumente auf einer externen Festplatte gesichert und den Rechner in den Auslieferungszustand versetzt.

Meine wichtigste Frage:
>> Was kann ich tun, damit ich mir beim Import meiner Daten nicht auch wieder diese Miststücke zurückhole? <<

Ich hatte den TR/ATRAPS schon am 17.7., danach alles platt gemacht und Daten wieder zugespielt...

Entweder es ist in meinen Daten versteckt, oder es liegt daran, dass ich wieder die gleiche Software installiert habe wie vorher und mir damit wieder das gleiche eingefangen habe - kann man das irgendwo erkennen? Mein OTL-Protokoll liegt leider auf der externen Festplatte. Es kam jedesmal eine Meldung "Flash Player Update", bevor der Mist losging...

cosinus 02.08.2012 13:35
Ohne die Logs von Malwarebytes und Co wird das hier nichts. :glaskugel:
Alles von Malwarebytes (und evtl. anderen Scannern) muss hier gepostet werden.

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Fontana 05.08.2012 17:28
Hallo,

hier der Report von malwarebytes und OTL. Leider lagen diese Reports auf der externen Festplatte, von der ich bisher den Daten-Reimport nicht gewagt habe...

Habe jetzt von einem anderen Rechner aus diese externe Festplatte mit Antivir, Malwarebyte, Symantec ohne gescannt. Dann unter Windows7 im Benutzermodus nur die unverzichtbaren Daten auf den Rechner geholt und darauf geachtet, dass keine .exe dabei ist. Sonst weiß ich nicht, was ich noch tun kann ... bin für jeden Tipp oder Link dankbar.

Am besten wär´es ja die Daten jeden Monat komplett zu speichern und dann diese Festplatte vom Netz zu nehmen, damit man notfalls auf einen unverseuchten Bestand zurückgreifen kann ?? Statt CD-Stapeln nun Festplattenstapel (oder wie macht man das in der Praxis, damit man nicht auf eine möglicherweise verseuchte Platte zurückgreifen muss...)

Aber vielleicht hab ich mir den TR/ATRAPS etc. erneut zugezogen bei der Installation einer Software (kann man das sehen?)




Code:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.30.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
MaxMustermann :: MaxMustermann-PC [Administrator]

Schutz: Deaktiviert

30.07.2012 19:20:42
mbam-log-2012-07-30 (19-51-18).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 407628
Laufzeit: 29 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum (Rogue.LiveSecurityPlatinum) -> Keine Aktion durchgeführt.

Infizierte Dateien: 6
C:\Users\MaxMustermann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AHUHDW0I\soft4[1].exe (Rogue.LiveSecurityPlatinum) -> Keine Aktion durchgeführt.
C:\Users\MaxMustermann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GBANO4UD\soft3[1].exe (RootKit.0Access) -> Keine Aktion durchgeführt.
C:\Users\MaxMustermann\AppData\Local\Temp\ED33.tmp (RootKit.0Access) -> Keine Aktion durchgeführt.
C:\Users\MaxMustermann\AppData\Local\Temp\msimg32.dll (RootKit.0Access) -> Keine Aktion durchgeführt.
C:\Users\MaxMustermann\Desktop\Live Security Platinum.lnk (Rogue.LiveSecurityPlatinum) -> Keine Aktion durchgeführt.
C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum\Live Security Platinum.lnk (Rogue.LiveSecurityPlatinum) -> Keine Aktion durchgeführt.

(Ende)
Und hier OTL

OTL Logfile:
Code:
OTL logfile created on: 30.07.2012 22:02:21 - Run 1
OTL by OldTimer - Version 3.2.55.0    Folder = C:\Users\MaxMustermann\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,98 Gb Total Physical Memory | 2,43 Gb Available Physical Memory | 61,12% Memory free
7,96 Gb Paging File | 6,05 Gb Available in Paging File | 75,98% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 880,41 Gb Total Space | 774,90 Gb Free Space | 88,02% Space Free | Partition Type: NTFS
Drive D: | 50,00 Gb Total Space | 27,05 Gb Free Space | 54,11% Space Free | Partition Type: NTFS
Drive I: | 781,25 Gb Total Space | 711,72 Gb Free Space | 91,10% Space Free | Partition Type: NTFS
Drive J: | 1081,76 Gb Total Space | 1081,64 Gb Free Space | 99,99% Space Free | Partition Type: NTFS
 
Computer Name: MaxMustermann-PC | User Name: MaxMustermann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.30 22:01:57 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\MaxMustermann\Downloads\OTL.exe
PRC - [2012.07.30 21:56:08 | 000,050,477 | ---- | M] () -- C:\Users\MaxMustermann\Downloads\Defogger.exe
PRC - [2012.07.30 21:48:53 | 001,467,064 | ---- | M] () -- C:\Users\MaxMustermann\AppData\Local\Temp\_iu14D2N.tmp
PRC - [2012.07.27 23:03:07 | 001,536,712 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_268.exe
PRC - [2012.07.17 17:50:30 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.07.17 17:50:14 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
PRC - [2012.07.17 17:50:11 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
PRC - [2012.07.17 17:50:11 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.07.17 17:50:10 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.17 17:50:09 | 000,391,632 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\program files (x86)\avira\antivir desktop\avcenter.exe
PRC - [2012.07.14 02:13:42 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.12.05 11:13:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.05.26 01:32:46 | 000,443,688 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe
PRC - [2011.05.20 20:10:26 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011.05.20 20:10:12 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2011.03.11 14:08:32 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011.03.11 14:08:31 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.10.22 02:00:00 | 002,105,344 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
PRC - [2010.10.22 02:00:00 | 000,376,832 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
PRC - [2010.08.04 01:39:38 | 000,107,816 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2010.03.10 14:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.07.30 21:56:08 | 000,050,477 | ---- | M] () -- C:\Users\MaxMustermann\Downloads\Defogger.exe
MOD - [2012.07.30 21:48:53 | 001,467,064 | ---- | M] () -- C:\Users\MaxMustermann\AppData\Local\Temp\_iu14D2N.tmp
MOD - [2012.07.27 23:03:07 | 009,465,032 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll
MOD - [2012.07.17 20:25:44 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\0018dd52b56988a833ee41699cf49325\IAStorUtil.ni.dll
MOD - [2012.07.17 20:25:44 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\e7cd67fc34ad0fc611c1e1244cfc6584\IAStorCommon.ni.dll
MOD - [2012.07.17 20:08:57 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll
MOD - [2012.07.17 20:08:52 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012.07.17 20:08:32 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012.07.17 20:08:26 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012.07.17 20:08:16 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012.07.17 20:08:13 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.07.17 20:08:10 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.07.17 20:08:10 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.07.17 20:07:57 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012.07.14 02:14:07 | 002,003,424 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2011.05.16 16:03:17 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.08.04 01:39:38 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
MOD - [2010.08.04 01:39:32 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
MOD - [2005.06.27 10:42:36 | 000,167,936 | ---- | M] () -- C:\Program Files (x86)\Macromedia\FlashPaper 2\FlashPaperContextMenu.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.09.23 03:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012.07.27 23:03:07 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.17 22:08:02 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2012.07.17 17:50:30 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.07.17 17:50:14 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2012.07.17 17:50:11 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2012.07.17 17:50:11 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.07.17 14:32:19 | 000,332,272 | ---- | M] (Google Inc.) [On_Demand | Stopped] -- C:\ProgramData\Partner\Partner.exe -- (Partner Service)
SRV - [2012.07.14 02:13:54 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.12.05 11:13:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.10.07 11:23:08 | 000,070,144 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\watchmi\TvdService.exe -- (watchmi)
SRV - [2011.09.28 02:47:38 | 000,025,824 | ---- | M] (Memeo) [Auto | Running] -- C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe -- (MemeoBackgroundService)
SRV - [2011.05.20 20:10:26 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2011.03.11 14:08:32 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011.03.11 14:08:31 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.10.22 02:00:00 | 000,376,832 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2010.03.18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.10 14:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.17 17:50:39 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.07.17 17:50:39 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.07.17 17:50:39 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.04.18 19:08:03 | 000,188,736 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.08.02 02:47:30 | 000,391,144 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)
DRV:64bit: - [2011.08.02 02:47:30 | 000,129,000 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)
DRV:64bit: - [2011.08.01 15:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2011.07.28 18:37:10 | 000,052,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d)
DRV:64bit: - [2011.06.10 14:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.05.20 19:53:44 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.03.11 14:08:31 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.25 15:59:00 | 000,694,888 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTL8192su.sys -- (RTL8192su)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.10.22 02:00:00 | 000,714,368 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\fwlanusbn.sys -- (fwlanusbn)
DRV:64bit: - [2010.10.22 02:00:00 | 000,014,120 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2010.09.23 22:03:06 | 000,129,008 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.06.10 22:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://adwords-de.blogspot.de/
IE - HKCU\..\SearchScopes,DefaultScope = {63362EF9-3C75-4DBB-B129-6D7AC3248C26}
IE - HKCU\..\SearchScopes\{63362EF9-3C75-4DBB-B129-6D7AC3248C26}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MDNE_deDE493
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_268.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 18:56:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.07.17 23:14:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2012.07.30 17:07:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MaxMustermann\AppData\Roaming\mozilla\Extensions
[2012.07.30 17:07:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MaxMustermann\AppData\Roaming\mozilla\Extensions\{ea278cf8-93cd-484f-b951-57360482d33a}
[2012.07.30 19:14:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MaxMustermann\AppData\Roaming\mozilla\Firefox\Profiles\uzzamw63.default\extensions
[2012.07.18 19:15:32 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\MaxMustermann\AppData\Roaming\mozilla\Firefox\Profiles\uzzamw63.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2012.07.30 19:14:14 | 000,000,000 | ---D | M] (WOT) -- C:\Users\MaxMustermann\AppData\Roaming\mozilla\Firefox\Profiles\uzzamw63.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.07.18 18:56:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.07.14 02:15:45 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.18 00:02:18 | 000,003,752 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.07.14 02:45:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: https://isearch.avg.com/?cid={86FBDE76-7254-4897-946B-42B2DCB0C64C}&mid=59436c3ec66947d0984e5dc0e34096fb-049aaccfb789215b5db01ff6f819e960326137f3&lang=de&ds=bm011&pr=sa&d=2012-07-18 00:02:20&v=12.1.0.20&sap=hp
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: https://isearch.avg.com/?cid={86FBDE76-7254-4897-946B-42B2DCB0C64C}&mid=59436c3ec66947d0984e5dc0e34096fb-049aaccfb789215b5db01ff6f819e960326137f3&lang=de&ds=bm011&pr=sa&d=2012-07-18 00:02:20&v=12.1.0.20&sap=hp
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java(TM) Platform SE 7 U2 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [MedionReminder] C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe (CyberLink)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4:64bit: - HKLM..\RunOnce: [MedionReminder] C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe (CyberLink)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9:64bit: - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5FDEDADD-6F28-4D36-BCAE-1F7B6B0DE51A}: DhcpNameServer = 192.168.244.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A488F377-0482-4B7C-A2EF-28C5AB854DA1}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B3C6BDAB-6D75-49D3-871D-38B982E51877}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{242f07d3-d00b-11e1-90c7-8c89a5a47f08}\Shell - "" = AutoRun
O33 - MountPoints2\{242f07d3-d00b-11e1-90c7-8c89a5a47f08}\Shell\AutoRun\command - "" = I:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.30 17:06:58 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google AdWords Editor
[2012.07.30 15:43:01 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\{9C5BBE4B-ADEE-48BD-B375-1142189FFFD3}
[2012.07.30 15:42:51 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\{862013CD-2684-416B-B7E4-96672B856CDF}
[2012.07.30 15:42:23 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\Tracing
[2012.07.30 15:37:05 | 000,000,000 | ---D | C] -- C:\Windows\de
[2012.07.30 15:36:10 | 000,000,000 | ---D | C] -- C:\Windows\da
[2012.07.30 15:36:06 | 000,000,000 | ---D | C] -- C:\Windows\el
[2012.07.30 15:36:03 | 000,000,000 | ---D | C] -- C:\Windows\en
[2012.07.30 15:35:58 | 000,000,000 | ---D | C] -- C:\Windows\es
[2012.07.30 15:35:54 | 000,000,000 | ---D | C] -- C:\Windows\fr
[2012.07.30 15:35:50 | 000,000,000 | ---D | C] -- C:\Windows\hu
[2012.07.30 15:35:46 | 000,000,000 | ---D | C] -- C:\Windows\it
[2012.07.30 15:35:43 | 000,000,000 | ---D | C] -- C:\Windows\nl
[2012.07.30 15:35:38 | 000,000,000 | ---D | C] -- C:\Windows\pl
[2012.07.30 15:35:34 | 000,000,000 | ---D | C] -- C:\Windows\sl
[2012.07.30 15:35:30 | 000,000,000 | ---D | C] -- C:\Windows\tr
[2012.07.30 15:29:07 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\{1C7CD60E-30A5-4EDA-ABD6-A18227EA235D}
[2012.07.30 15:28:34 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\{EDDE0A58-F840-4C26-A95C-1B56296416F1}
[2012.07.30 11:28:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
[2012.07.30 11:28:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft
[2012.07.29 23:38:18 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\{99C452D5-1E2A-43C4-A852-8B0E7FEFCB04}
[2012.07.29 23:16:02 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\{531029DA-0A61-4614-9877-E7F97035BE8A}
[2012.07.29 23:15:29 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\{3E9EBD91-DC40-4C6C-8DDB-14A53CB3CD62}
[2012.07.29 22:49:08 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\{559C3D4E-48D0-4713-A5CC-414D16615045}
[2012.07.29 22:46:05 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\{DE0DC919-51AA-4CFB-BAAC-9DD58F177D9B}
[2012.07.29 22:40:47 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Windows Live
[2012.07.29 22:40:31 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\{FBBD479E-3780-4C07-B4FB-E864F53FE207}
[2012.07.29 22:40:31 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\{31535B33-76CA-4F81-87EC-2FC43458DB45}
[2012.07.29 22:36:46 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Ashampoo
[2012.07.29 22:36:45 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Ashampoo
[2012.07.28 19:29:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\eRightSoft
[2012.07.24 15:08:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
[2012.07.24 15:08:52 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\pdfforge
[2012.07.24 15:08:51 | 000,095,744 | ---- | C] (pdfforge GbR) -- C:\Windows\SysNative\pdfcmon.dll
[2012.07.24 15:08:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator
[2012.07.23 23:07:56 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\FileZilla
[2012.07.23 23:07:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FileZilla FTP Client
[2012.07.19 16:33:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!WLAN
[2012.07.19 16:33:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\avmwlanstick
[2012.07.19 16:33:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVM_update
[2012.07.19 11:56:44 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\Documents\temp
[2012.07.19 11:56:21 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\FireShot
[2012.07.19 07:39:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft-Maus
[2012.07.19 07:39:54 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft IntelliPoint
[2012.07.18 19:57:30 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012.07.18 19:16:26 | 000,000,000 | -HSD | C] -- C:\ProgramData\System Restore
[2012.07.18 18:56:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.07.18 18:56:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.07.18 18:34:38 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Mozilla
[2012.07.18 18:28:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft-Tastatur
[2012.07.18 18:28:36 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft IntelliType Pro
[2012.07.18 14:30:49 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Dropbox
[2012.07.18 14:29:22 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Dropbox
[2012.07.18 00:04:46 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\PeaZip
[2012.07.18 00:02:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PeaZip
[2012.07.18 00:02:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PeaZip
[2012.07.18 00:02:04 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012.07.17 23:47:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2012.07.17 23:46:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Works
[2012.07.17 23:46:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2012.07.17 23:42:22 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012.07.17 23:41:36 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Microsoft Help
[2012.07.17 23:41:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2012.07.17 23:41:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2012.07.17 23:41:00 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2012.07.17 23:32:09 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Desktop\TOOLS
[2012.07.17 23:17:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
[2012.07.17 23:17:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MozBackup
[2012.07.17 23:15:00 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Thunderbird
[2012.07.17 23:15:00 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Thunderbird
[2012.07.17 23:14:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2012.07.17 22:32:40 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Mozilla
[2012.07.17 22:32:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.07.17 22:27:25 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2012.07.17 22:16:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
[2012.07.17 22:16:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe Media Player
[2012.07.17 22:13:14 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Adobe
[2012.07.17 22:10:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012.07.17 22:08:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macrovision Shared
[2012.07.17 21:59:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012.07.17 21:43:14 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Macromedia
[2012.07.17 21:36:42 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Macromedia
[2012.07.17 21:36:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macromedia Shared
[2012.07.17 21:35:28 | 000,000,000 | ---D | C] -- C:\Windows\Downloaded Installations
[2012.07.17 21:31:12 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\QuickTime
[2012.07.17 21:26:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Macromedia
[2012.07.17 21:26:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Macromedia
[2012.07.17 21:26:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Macromedia
[2012.07.17 21:26:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macromedia
[2012.07.17 20:12:50 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Malwarebytes
[2012.07.17 20:12:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.17 19:23:13 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\Documents\OneNote-Notizbücher
[2012.07.17 19:21:32 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\Documents\DATEN-Sicherung
[2012.07.17 19:14:39 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\Documents\DATEN-Projekte
[2012.07.17 19:14:20 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\Documents\DATEN-Privat
[2012.07.17 19:13:09 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\Documents\DATEN-Firma
[2012.07.17 18:17:09 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\{F3DBCF6E-FEF1-4481-9BFD-79014BC65A39}
[2012.07.17 17:57:03 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Avira
[2012.07.17 17:54:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.07.17 17:54:25 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.07.17 17:54:25 | 000,098,848 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.07.17 17:54:25 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.07.17 17:54:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2012.07.17 17:43:58 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\ElevatedDiagnostics
[2012.07.17 17:43:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.07.17 15:42:29 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Google
[2012.07.17 14:54:23 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AVM_Driver
[2012.07.17 14:45:03 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Adobe
[2012.07.17 14:44:59 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Mugle
[2012.07.17 14:44:16 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Google
[2012.07.17 14:37:57 | 000,000,000 | -H-D | C] -- C:\ProgramData\Medion Reminder
[2012.07.17 14:37:46 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Intel Corporation
[2012.07.17 14:37:43 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Power2Go
[2012.07.17 14:37:30 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.07.17 14:37:30 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Searches
[2012.07.17 14:37:30 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.07.17 14:37:21 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Identities
[2012.07.17 14:37:19 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Contacts
[2012.07.17 14:37:18 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\VirtualStore
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Vorlagen
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\AppData\Local\Verlauf
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\AppData\Local\Temporary Internet Files
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Startmenü
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\SendTo
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Recent
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Netzwerkumgebung
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Lokale Einstellungen
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Documents\Eigene Videos
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Documents\Eigene Musik
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Eigene Dateien
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Documents\Eigene Bilder
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Druckumgebung
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Cookies
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\AppData\Local\Anwendungsdaten
[2012.07.17 14:37:08 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Anwendungsdaten
[2012.07.17 14:37:07 | 000,000,000 | --SD | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft
[2012.07.17 14:37:07 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Videos
[2012.07.17 14:37:07 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Saved Games
[2012.07.17 14:37:07 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Pictures
[2012.07.17 14:37:07 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Music
[2012.07.17 14:37:07 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.07.17 14:37:07 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Links
[2012.07.17 14:37:07 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Favorites
[2012.07.17 14:37:07 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Downloads
[2012.07.17 14:37:07 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Documents
[2012.07.17 14:37:07 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Desktop
[2012.07.17 14:37:07 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.07.17 14:37:07 | 000,000,000 | -H-D | C] -- C:\Users\MaxMustermann\AppData
[2012.07.17 14:37:07 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Temp
[2012.07.17 14:37:07 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Microsoft
[2012.07.17 14:37:07 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Media Center Programs
[2012.07.17 14:37:07 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Macromedia
[2012.07.17 14:37:07 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerRecover
[2012.07.17 14:36:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Rescue Disk 10
[2012.07.17 14:35:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Memeo
[2012.07.17 14:35:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Memeo
[2012.07.17 14:35:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Memeo
[2012.07.17 14:35:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MARKEMENT
[2012.07.17 14:35:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MARKEMENT
[2012.07.17 14:35:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mediathek
[2012.07.17 14:35:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\myMugle
[2012.07.17 14:35:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\myMugle
[2012.07.17 14:34:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Corel
[2012.07.17 14:34:20 | 000,000,000 | ---D | C] -- C:\Program Files\PlayReady
[2012.07.17 14:34:00 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Corel
[2012.07.17 14:33:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Protexis
[2012.07.17 14:33:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Corel
[2012.07.17 14:33:37 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Essentials X5
[2012.07.17 14:32:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Corel
[2012.07.17 14:32:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\watchmi
[2012.07.17 14:32:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\watchmi
[2012.07.17 14:32:22 | 000,000,000 | ---D | C] -- C:\ProgramData\TvdPersonal
[2012.07.17 14:32:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Partner
[2012.07.17 14:32:18 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012.07.17 14:32:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2012.07.17 14:32:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2012.07.17 14:29:30 | 000,000,000 | -HSD | C] -- C:\Recovery
[2012.07.17 14:29:30 | 000,000,000 | -HSD | C] -- C:\Documents and Settings
[2012.07.17 14:29:27 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.30 22:03:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.30 21:59:58 | 000,000,000 | ---- | M] () -- C:\Users\MaxMustermann\defogger_reenable
[2012.07.30 21:59:06 | 000,017,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.30 21:59:06 | 000,017,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.30 21:52:06 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.30 21:51:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.30 21:51:33 | 3206,787,072 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.30 21:47:01 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.30 19:16:32 | 000,007,611 | ---- | M] () -- C:\Users\MaxMustermann\AppData\Local\Resmon.ResmonCfg
[2012.07.30 17:20:51 | 000,001,374 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\AdWords Editor.lnk
[2012.07.30 15:28:18 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.30 15:28:18 | 000,654,006 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.30 15:28:18 | 000,615,888 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.30 15:28:18 | 000,129,878 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.30 15:28:18 | 000,106,268 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.30 11:32:09 | 000,414,280 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.21 21:16:12 | 000,001,979 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\ust_2012.lnk
[2012.07.20 00:04:41 | 000,001,406 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\MaxMustermann.lnk
[2012.07.20 00:04:32 | 000,001,307 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\MaxMustermann.lnk
[2012.07.20 00:04:25 | 000,001,244 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\MaxMustermann.lnk
[2012.07.19 07:39:57 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf
[2012.07.18 19:40:28 | 000,001,095 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\Projekte.lnk
[2012.07.18 19:40:23 | 000,001,077 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\Privat.lnk
[2012.07.18 19:40:18 | 000,001,064 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\Firma.lnk
[2012.07.18 18:56:12 | 000,001,134 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.07.18 18:29:23 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64k_01009.Wdf
[2012.07.18 18:26:41 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01009.Wdf
[2012.07.18 00:28:02 | 000,159,772 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2012.07.18 00:28:02 | 000,159,772 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2012.07.17 23:51:31 | 000,001,356 | ---- | M] () -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
[2012.07.17 23:49:25 | 000,002,697 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\Microsoft Office Word 2007.lnk
[2012.07.17 23:49:09 | 000,002,703 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\Microsoft Office Excel 2007.lnk
[2012.07.17 22:50:01 | 000,001,178 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\Adobe Photoshop 6.0.lnk
[2012.07.17 22:48:57 | 000,001,257 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
[2012.07.17 22:27:18 | 000,001,165 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\Adobe Dreamweaver CS4.lnk
[2012.07.17 21:30:15 | 000,002,026 | ---- | M] () -- C:\Users\Public\Desktop\Macromedia Fireworks 8.lnk
[2012.07.17 20:09:12 | 000,001,443 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\Internet Explorer.lnk
[2012.07.17 17:50:39 | 000,132,832 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.07.17 17:50:39 | 000,098,848 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.07.17 17:50:39 | 000,027,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.07.17 16:42:55 | 000,002,666 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.07.05 13:02:30 | 000,095,744 | ---- | M] (pdfforge GbR) -- C:\Windows\SysNative\pdfcmon.dll
 
========== Files Created - No Company Name ==========
 
[2012.07.30 21:59:58 | 000,000,000 | ---- | C] () -- C:\Users\MaxMustermann\defogger_reenable
[2012.07.30 19:16:32 | 000,007,611 | ---- | C] () -- C:\Users\MaxMustermann\AppData\Local\Resmon.ResmonCfg
[2012.07.30 18:46:52 | 000,001,712 | ---- | C] () -- C:\Users\MaxMustermann\AppData\Local\{93832d05-75e6-fdfc-982d-8cf84e7110f2}\U\00000001.@
[2012.07.30 17:20:51 | 000,001,374 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\AdWords Editor.lnk
[2012.07.21 21:16:12 | 000,001,979 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\ust_2012.lnk
[2012.07.20 00:04:41 | 000,001,406 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\MaxMustermann.lnk
[2012.07.20 00:04:32 | 000,001,307 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\MaxMustermann.lnk
[2012.07.20 00:04:25 | 000,001,244 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\MaxMustermann.lnk
[2012.07.19 07:39:57 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf
[2012.07.18 19:57:29 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.18 19:40:28 | 000,001,095 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\Projekte.lnk
[2012.07.18 19:40:23 | 000,001,077 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\Privat.lnk
[2012.07.18 19:40:18 | 000,001,064 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\Firma.lnk
[2012.07.18 18:56:12 | 000,001,146 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.07.18 18:56:12 | 000,001,134 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.07.18 18:29:23 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64k_01009.Wdf
[2012.07.18 18:26:41 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01009.Wdf
[2012.07.18 00:18:21 | 3206,787,072 | -HS- | C] () -- C:\hiberfil.sys
[2012.07.17 23:51:31 | 000,001,356 | ---- | C] () -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
[2012.07.17 23:49:25 | 000,002,697 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\Microsoft Office Word 2007.lnk
[2012.07.17 23:49:09 | 000,002,703 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\Microsoft Office Excel 2007.lnk
[2012.07.17 23:14:55 | 000,002,102 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
[2012.07.17 22:50:01 | 000,001,178 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\Adobe Photoshop 6.0.lnk
[2012.07.17 22:48:57 | 000,001,257 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
[2012.07.17 22:27:18 | 000,001,165 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\Adobe Dreamweaver CS4.lnk
[2012.07.17 22:18:48 | 000,001,165 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Dreamweaver CS4.lnk
[2012.07.17 22:15:37 | 000,001,103 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS4.lnk
[2012.07.17 22:11:24 | 000,001,196 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS4.lnk
[2012.07.17 22:09:31 | 000,001,287 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS4.lnk
[2012.07.17 22:08:58 | 000,001,411 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS4.lnk
[2012.07.17 21:57:00 | 002,621,723 | ---- | C] () -- C:\Windows\SysNative\nvcoproc.bin
[2012.07.17 21:54:32 | 000,007,384 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb
[2012.07.17 21:30:15 | 000,002,026 | ---- | C] () -- C:\Users\Public\Desktop\Macromedia Fireworks 8.lnk
[2012.07.17 20:09:12 | 000,001,443 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\Internet Explorer.lnk
[2012.07.17 14:37:34 | 000,001,409 | ---- | C] () -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2012.07.17 14:37:31 | 000,001,443 | ---- | C] () -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.07.17 14:32:22 | 000,002,789 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\watchmi tray.lnk
[2012.07.17 14:32:20 | 000,002,360 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
[2012.07.17 14:32:14 | 000,002,666 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.07.17 14:32:03 | 000,001,110 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.17 14:32:03 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.05.15 02:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2012.01.24 00:31:52 | 000,002,048 | -HS- | C] () -- C:\Users\MaxMustermann\AppData\Local\{93832d05-75e6-fdfc-982d-8cf84e7110f2}\@
 
========== LOP Check ==========
 
[2012.07.29 22:36:48 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Ashampoo
[2012.07.30 20:15:16 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Dropbox
[2012.07.30 00:38:33 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\FileZilla
[2012.07.25 13:21:28 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\FireShot
[2012.07.17 14:45:22 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Mugle
[2012.07.24 15:11:27 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\pdfforge
[2012.07.18 00:04:50 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\PeaZip
[2012.07.17 23:15:00 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Thunderbird
[2009.07.14 07:08:49 | 000,024,256 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---


Danke für Eure Hilfe!

cosinus 05.08.2012 17:47
Bitte erstmal routinemäßig einen neuen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Fontana 05.08.2012 22:25
Hallo

Malwarebyte fullscan: Keine Funde

ESET :balla:

Code:
C:\Users\MaxMustermann\Documents\FIRMA-Projekte\MaxMustermann\korrespondenz\web-galerie-hack\index.html        JS/TrojanDownloader.Agent.NWI trojan
C:\Users\MaxMustermann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XKBLJ5KK\PDFCreator_Stub_5874[1].exe        Win32/InstallMonetizer.AB application
J:\Documents\FIRMA-Projekte\MaxMustermann\korrespondenz\web-galerie-hack\index.html        JS/TrojanDownloader.Agent.NWI trojan

?!? Das ist jetzt wieder ein ganz anderer Trojaner ... hat das eine mit dem anderen zu tun ??

hier die Langversion von ESET

Code:
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=edd3ab2ba966e84bb08b66576559d349
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-05 09:11:00
# local_time=2012-08-05 11:11:00 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=1792 16777215 100 0 448445 448445 0 0
# compatibility_mode=5893 16776573 100 94 74508 95827396 0 0
# compatibility_mode=8192 67108863 100 0 423 423 0 0
# scanned=236683
# found=3
# cleaned=0
# scan_time=3514
C:\Users\GaWi\Documents\FIRMA-Projekte\MaxMustermann\korrespondenz\web-galerie-hack\index.html        JS/TrojanDownloader.Agent.NWI trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\GW\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XKBLJ5KK\PDFCreator_Stub_5874[1].exe        Win32/InstallMonetizer.AB application (unable to clean)        00000000000000000000000000000000        I
J:\Documents\FIRMA-Projekte\MaxMustermann\korrespondenz\web-galerie-hack\index.html        JS/TrojanDownloader.Agent.NWI trojan (unable to clean)        00000000000000000000000000000000        I
ESETSmartInstaller@High as downloader log:
all ok

cosinus 06.08.2012 14:56
Zitat:
Malwarebyte fullscan: Keine Funde
Das Log soll trotzdem gepostet werden! Es enthält mehr Infos als nur Fund oder kein Fund!

Code:
J:\Documents\FIRMA-Projekte\MaxMustermann\korrespondenz\web-galerie-hack
Ein "web-galerie-hack" soll also einen Firmenprojekt sein? Interessant, erzähl mir mehr darüber! :blabla:

Fontana 06.08.2012 15:23
zum Hack: Das ist nicht das, was Du denkst :rofl:

Unter dem Namen hab ich vor ca. 2-3 Jahren eine html-Datei abgelegt (und vergessen), da in dieser Website eingeschleuste Links enthalten waren => Quellcode kopiert und dem Inhaber gezeigt. Meinst Du das ist wirklich ein Trojaner ?!?

Hier Malwarebytes

Code:
alwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.05.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
MaxMustermann :: MaxMustermann-PC [limited]

Protection: Enabled

05.08.2012 19:53:41
mbam-log-2012-08-05 (19-53-41).txt

Scan type: Full scan (C:\|D:\|I:\|J:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 370580
Time elapsed: 57 minute(s), 35 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

cosinus 06.08.2012 20:38
Ich wollte nur wissen was es damit auf sich hat! :)

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Fontana 06.08.2012 20:54
Das Tool ist ja schnell...

[code]
# AdwCleaner v1.800 - Logfile created 08/06/2012 at 21:49:58
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : MaxiMustermann - MaxiMustermann-PC
# Running from : C:\Users\MaxiMustermann\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

... nächster Versuch:

Code:
# AdwCleaner v1.800 - Logfile created 08/06/2012 at 21:49:58
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : MaxiMustermann - MaxiMustermann-PC
# Running from : C:\Users\MaxiMustermann\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\MaxiMustermann\AppData\Roaming\pdfforge
Folder Found : C:\Users\MaxiMustermann\AppData\Roaming\pdfforge
Folder Found : C:\ProgramData\Partner

***** [Registry] *****


***** [Registre - GUID] *****

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Google Chrome v21.0.1180.60

File : C:\Users\MaxiMustermann\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

File : C:\Users\MaxiMustermann\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1139 octets] - [06/08/2012 21:49:58]

########## EOF - \AdwCleaner[R1].txt - [1267 octets] ##########

cosinus 07.08.2012 15:28
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Fontana 07.08.2012 16:12
Was mich fertig macht, ist gestern und heute zweimal der Tastaturanschlag für kurze Zeit verlangsamt war ... ich leide langsam schon an Paranoia :wtf:

Danke für deine Unterstützung, bist mein rettender Strohhalm

Hier der Code von adwcleaner


Code:
# AdwCleaner v1.800 - Logfile created 08/07/2012 at 16:59:39
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : MaxMustermann - MaxMustermann-PC
# Running from : C:\Users\MaxMustermann\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\MaxMustermann\AppData\Roaming\pdfforge
Folder Deleted : C:\Users\MaxMustermann\AppData\Roaming\pdfforge
Folder Deleted : C:\ProgramData\Partner

***** [Registry] *****


***** [Registre - GUID] *****

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Google Chrome v21.0.1180.60

File : C:\Users\MaxMustermann\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

File : C:\Users\MaxMustermann\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [1030 octets] - [07/08/2012 16:59:39]
AdwCleaner[R1].txt - [1264 octets] - [06/08/2012 21:49:58]

########## EOF - \AdwCleaner[S1].txt - [1218 octets] ##########

cosinus 08.08.2012 16:25
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Fontana 08.08.2012 17:22
Ja, Windows geht uneingeschränkt und es fehlen keine Ordner!

cosinus 09.08.2012 13:24
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Fontana 09.08.2012 18:04
respect, dass Du sowas lesen kannst...

OTL Logfile:
Code:
OTL logfile created on: 09.08.2012 18:38:39 - Run 1
OTL by OldTimer - Version 3.2.56.0    Folder = C:\Users\MaxMustermann\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,98 Gb Total Physical Memory | 2,62 Gb Available Physical Memory | 65,74% Memory free
7,96 Gb Paging File | 6,38 Gb Available in Paging File | 80,09% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 880,41 Gb Total Space | 773,14 Gb Free Space | 87,82% Space Free | Partition Type: NTFS
Drive D: | 50,00 Gb Total Space | 27,05 Gb Free Space | 54,11% Space Free | Partition Type: NTFS
Drive I: | 1081,76 Gb Total Space | 1081,64 Gb Free Space | 99,99% Space Free | Partition Type: NTFS
Drive J: | 781,25 Gb Total Space | 726,63 Gb Free Space | 93,01% Space Free | Partition Type: NTFS
 
Computer Name: MaxMustermann-PC | User Name: MaxMustermann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.09 18:35:51 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\MaxMustermann\Downloads\OTL.exe
PRC - [2012.08.08 10:47:41 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.08.08 10:47:40 | 000,613,880 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\update.exe
PRC - [2012.07.31 17:31:15 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.07.31 17:30:54 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
PRC - [2012.07.31 17:30:53 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.07.31 17:29:22 | 000,047,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\updrgui.exe
PRC - [2012.07.31 00:50:43 | 000,186,832 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Update\1.3.21.115\GoogleCrashHandler.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.05.15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.05.26 01:32:46 | 000,443,688 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe
PRC - [2011.05.20 20:10:26 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011.05.20 20:10:12 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2011.03.11 14:08:32 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011.03.11 14:08:31 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.10.22 02:00:00 | 002,105,344 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
PRC - [2010.10.22 02:00:00 | 000,376,832 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
PRC - [2010.03.10 14:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.07.31 01:53:11 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\0018dd52b56988a833ee41699cf49325\IAStorUtil.ni.dll
MOD - [2012.07.31 01:53:11 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\e7cd67fc34ad0fc611c1e1244cfc6584\IAStorCommon.ni.dll
MOD - [2012.07.31 00:56:21 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012.07.31 00:56:12 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012.07.31 00:56:07 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012.07.31 00:55:44 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012.07.31 00:55:41 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.07.31 00:55:38 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.07.31 00:55:37 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.07.31 00:55:33 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011.05.16 16:03:17 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012.07.31 17:31:15 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.07.31 17:30:58 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Disabled | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2012.07.31 17:30:54 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2012.07.31 17:30:53 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.07.31 01:25:48 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.05.15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.09.28 02:47:38 | 000,025,824 | ---- | M] (Memeo) [Auto | Running] -- C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe -- (MemeoBackgroundService)
SRV - [2011.05.20 20:10:26 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2011.03.11 14:08:32 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011.03.11 14:08:31 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.10.22 02:00:00 | 000,376,832 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2010.03.18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.10 14:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.31 17:31:25 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.07.31 17:31:25 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.07.31 17:31:25 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.06.26 21:38:28 | 000,046,176 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2012.06.24 22:24:48 | 000,052,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d)
DRV:64bit: - [2012.04.18 19:08:03 | 000,188,736 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.08.02 02:47:30 | 000,391,144 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)
DRV:64bit: - [2011.08.02 02:47:30 | 000,129,000 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)
DRV:64bit: - [2011.06.10 14:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.05.20 19:53:44 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.03.11 14:08:31 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.25 15:59:00 | 000,694,888 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTL8192su.sys -- (RTL8192su)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.10.22 02:00:00 | 000,714,368 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\fwlanusbn.sys -- (fwlanusbn)
DRV:64bit: - [2010.10.22 02:00:00 | 000,014,120 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2010.09.23 22:03:06 | 000,129,008 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.06.10 22:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2617558925-3834871055-3452261518-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
IE - HKU\S-1-5-21-2617558925-3834871055-3452261518-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-2617558925-3834871055-3452261518-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com
IE - HKU\S-1-5-21-2617558925-3834871055-3452261518-1001\..\SearchScopes,DefaultScope = {7D669EDC-044D-40D3-93EF-D8D7F3A50501}
IE - HKU\S-1-5-21-2617558925-3834871055-3452261518-1001\..\SearchScopes\{7D669EDC-044D-40D3-93EF-D8D7F3A50501}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MDNE_enDE393
IE - HKU\S-1-5-21-2617558925-3834871055-3452261518-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-2617558925-3834871055-3452261518-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
IE - HKU\S-1-5-21-2617558925-3834871055-3452261518-1002\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-2617558925-3834871055-3452261518-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com
IE - HKU\S-1-5-21-2617558925-3834871055-3452261518-1002\..\SearchScopes,DefaultScope = {1E7D4692-C1A7-43CC-BB8D-432225DD839D}
IE - HKU\S-1-5-21-2617558925-3834871055-3452261518-1002\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2617558925-3834871055-3452261518-1002\..\SearchScopes\{1E7D4692-C1A7-43CC-BB8D-432225DD839D}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MDNE_enDE393
IE - HKU\S-1-5-21-2617558925-3834871055-3452261518-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.08.01 19:37:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2012.08.01 19:37:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MaxMustermann\AppData\Roaming\mozilla\Extensions
[2012.05.02 13:27:46 | 000,564,732 | ---- | M] () (No name found) -- C:\USERS\MaxMustermann\APPDATA\ROAMING\THUNDERBIRD\PROFILES\DYYGADKP.DEFAULT\EXTENSIONS\TBTESTPILOT@LABS.MOZILLA.COM.XPI
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/ig/redirectdomain?brand=MDNE&bmod=MDNE
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/ig/redirectdomain?brand=MDNE&bmod=MDNE
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.60\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.60\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.60\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\MaxMustermann\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\plugin/npUrlAdvisor.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\MaxMustermann\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\plugin/npVKPlugin.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\MaxMustermann\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java(TM) Platform SE 7 U2 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft Device Center\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [IntelliType Pro] C:\Program Files\Microsoft Device Center\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [MedionReminder] C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe (CyberLink)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2617558925-3834871055-3452261518-1002..\Run: [AdobeBridge]  File not found
O4 - HKU\S-1-5-21-2617558925-3834871055-3452261518-1003..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [MedionReminder] C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe (CyberLink)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-2617558925-3834871055-3452261518-1001..\RunOnce: [Report] \AdwCleaner[S1].txt ()
O4 - HKU\S-1-5-21-2617558925-3834871055-3452261518-1003..\RunOnce: [HKCU] C:\Windows\SysWOW64\oobe\info\HKCU.vbs ()
O4 - HKU\S-1-5-21-2617558925-3834871055-3452261518-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-2617558925-3834871055-3452261518-1003..\RunOnce: [Screensaver] C:\Windows\Web\Wallpaper\MEDION\start.vbs ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9:64bit: - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5FDEDADD-6F28-4D36-BCAE-1F7B6B0DE51A}: DhcpNameServer = 192.168.244.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9E09E736-B08D-4550-8BE9-359EE6A34CD2}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B3C6BDAB-6D75-49D3-871D-38B982E51877}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{cd5cd506-da8f-11e1-a4be-8c89a5a47f08}\Shell - "" = AutoRun
O33 - MountPoints2\{cd5cd506-da8f-11e1-a4be-8c89a5a47f08}\Shell\AutoRun\command - "" = I:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
 
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {778853D1-923D-A411-7F6B-23E240405245} - Browser Customizations
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: msacm.siren -  File not found
Drivers32:64bit: vidc.cvid -  File not found
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.09 09:34:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft-Maus- und Tastatur-Center
[2012.08.09 09:33:49 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Device Center
[2012.08.05 22:05:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.08.04 22:42:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
[2012.08.03 23:45:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MozBackup
[2012.08.02 21:45:36 | 000,000,000 | ---D | C] -- C:\Windows\de
[2012.08.02 21:45:03 | 000,000,000 | ---D | C] -- C:\Windows\da
[2012.08.02 21:44:13 | 000,000,000 | ---D | C] -- C:\Windows\el
[2012.08.02 21:43:37 | 000,000,000 | ---D | C] -- C:\Windows\en
[2012.08.02 21:42:44 | 000,000,000 | ---D | C] -- C:\Windows\es
[2012.08.02 21:42:12 | 000,000,000 | ---D | C] -- C:\Windows\fr
[2012.08.02 21:41:27 | 000,000,000 | ---D | C] -- C:\Windows\hu
[2012.08.02 21:40:37 | 000,000,000 | ---D | C] -- C:\Windows\it
[2012.08.02 21:39:58 | 000,000,000 | ---D | C] -- C:\Windows\nl
[2012.08.02 21:39:14 | 000,000,000 | ---D | C] -- C:\Windows\pl
[2012.08.02 21:38:36 | 000,000,000 | ---D | C] -- C:\Windows\sl
[2012.08.02 21:37:47 | 000,000,000 | ---D | C] -- C:\Windows\tr
[2012.08.02 21:33:55 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Windows Live
[2012.08.02 19:52:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!WLAN
[2012.08.02 19:52:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\avmwlanstick
[2012.08.02 19:51:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVM_update
[2012.08.02 14:19:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
[2012.08.02 14:19:18 | 000,095,744 | ---- | C] (pdfforge GbR) -- C:\Windows\SysNative\pdfcmon.dll
[2012.08.02 14:19:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator
[2012.08.01 23:31:48 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Malwarebytes
[2012.08.01 23:31:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.01 23:31:44 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.01 23:31:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.01 23:31:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.01 19:37:58 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Thunderbird
[2012.08.01 19:37:58 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Thunderbird
[2012.08.01 19:37:58 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Mozilla
[2012.08.01 19:37:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2012.08.01 19:14:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
[2012.08.01 19:14:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft
[2012.08.01 18:52:10 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Macromedia
[2012.08.01 18:46:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2012.08.01 18:45:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Works
[2012.08.01 18:45:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2012.08.01 18:41:35 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012.08.01 18:40:49 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Microsoft Help
[2012.08.01 18:40:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2012.08.01 18:40:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2012.08.01 18:40:14 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2012.08.01 18:36:36 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\ElevatedDiagnostics
[2012.08.01 18:27:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012.08.01 18:27:09 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2012.08.01 18:26:41 | 000,068,928 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2012.08.01 18:26:41 | 000,061,248 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2012.08.01 18:26:33 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2012.08.01 18:24:54 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Avira
[2012.07.31 20:29:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.07.31 20:29:26 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.07.31 17:38:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.07.31 17:38:31 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.07.31 17:38:31 | 000,098,848 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.07.31 17:38:31 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.07.31 17:38:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.07.31 17:38:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2012.07.31 10:36:44 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2012.07.31 01:28:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe Media Player
[2012.07.31 01:28:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
[2012.07.31 01:27:23 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Adobe
[2012.07.31 01:26:38 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012.07.31 01:26:09 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Adobe
[2012.07.31 01:25:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macrovision Shared
[2012.07.31 01:16:49 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Macromedia
[2012.07.31 01:16:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macromedia Shared
[2012.07.31 01:16:22 | 000,000,000 | ---D | C] -- C:\Windows\Downloaded Installations
[2012.07.31 01:14:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\QuickTime
[2012.07.31 01:12:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Macromedia
[2012.07.31 01:11:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Macromedia
[2012.07.31 01:11:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Macromedia
[2012.07.31 01:11:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macromedia
[2012.07.31 00:05:06 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Diagnostics
[2012.07.31 00:01:55 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AVM_Driver
[2012.07.30 23:53:52 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Google
[2012.07.30 23:51:37 | 000,000,000 | -H-D | C] -- C:\ProgramData\Medion Reminder
[2012.07.30 23:51:25 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Intel Corporation
[2012.07.30 23:51:22 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Power2Go
[2012.07.30 23:51:11 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.07.30 23:51:11 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Searches
[2012.07.30 23:51:11 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.07.30 23:51:03 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Identities
[2012.07.30 23:51:02 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Contacts
[2012.07.30 23:51:01 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\VirtualStore
[2012.07.30 23:50:50 | 000,000,000 | --SD | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft
[2012.07.30 23:50:50 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Videos
[2012.07.30 23:50:50 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Pictures
[2012.07.30 23:50:50 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Music
[2012.07.30 23:50:50 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.07.30 23:50:50 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Links
[2012.07.30 23:50:50 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Favorites
[2012.07.30 23:50:50 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Downloads
[2012.07.30 23:50:50 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Documents
[2012.07.30 23:50:50 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\Desktop
[2012.07.30 23:50:50 | 000,000,000 | R--D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Vorlagen
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\AppData\Local\Verlauf
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\AppData\Local\Temporary Internet Files
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Startmenü
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\SendTo
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Recent
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Netzwerkumgebung
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Lokale Einstellungen
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Documents\Eigene Videos
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Documents\Eigene Musik
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Eigene Dateien
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Documents\Eigene Bilder
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Druckumgebung
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Cookies
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\AppData\Local\Anwendungsdaten
[2012.07.30 23:50:50 | 000,000,000 | -HSD | C] -- C:\Users\MaxMustermann\Anwendungsdaten
[2012.07.30 23:50:50 | 000,000,000 | -H-D | C] -- C:\Users\MaxMustermann\AppData
[2012.07.30 23:50:50 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Temp
[2012.07.30 23:50:50 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Local\Microsoft
[2012.07.30 23:50:50 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Media Center Programs
[2012.07.30 23:50:50 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Macromedia
[2012.07.30 23:50:50 | 000,000,000 | ---D | C] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerRecover
[2012.07.30 23:50:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Rescue Disk 10
[2012.07.30 23:49:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Memeo
[2012.07.30 23:49:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Memeo
[2012.07.30 23:49:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Memeo
[2012.07.30 23:49:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MARKEMENT
[2012.07.30 23:49:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MARKEMENT
[2012.07.30 23:49:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mediathek
[2012.07.30 23:48:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Corel
[2012.07.30 23:48:06 | 000,000,000 | ---D | C] -- C:\Program Files\PlayReady
[2012.07.30 23:47:41 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Corel
[2012.07.30 23:47:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Protexis
[2012.07.30 23:47:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Corel
[2012.07.30 23:47:12 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Essentials X5
[2012.07.30 23:46:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Corel
[2012.07.30 23:46:00 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012.07.30 23:45:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2012.07.30 23:44:20 | 000,000,000 | -HSD | C] -- C:\Recovery
[2012.07.30 23:44:20 | 000,000,000 | -HSD | C] -- C:\Documents and Settings
[2012.07.30 23:44:17 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.09 18:40:48 | 000,017,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.09 18:40:48 | 000,017,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.09 18:33:55 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.09 18:33:16 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.09 18:33:07 | 3206,787,072 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.09 14:57:11 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.03 18:26:25 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.03 18:26:25 | 000,654,006 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.03 18:26:25 | 000,615,888 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.03 18:26:25 | 000,129,878 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.03 18:26:25 | 000,106,268 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.03 10:59:06 | 000,002,678 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.08.01 23:31:45 | 000,001,117 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.01 20:04:52 | 000,001,261 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
[2012.08.01 19:21:07 | 000,409,224 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.31 17:38:43 | 000,002,074 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012.07.31 17:31:25 | 000,132,832 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.07.31 17:31:25 | 000,098,848 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.07.31 17:31:25 | 000,027,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.07.31 10:36:37 | 000,001,165 | ---- | M] () -- C:\Users\MaxMustermann\Desktop\Adobe Dreamweaver CS4.lnk
[2012.07.31 09:43:35 | 000,159,772 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2012.07.31 09:43:35 | 000,159,772 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2012.07.31 01:06:38 | 000,017,408 | ---- | M] () -- C:\Users\MaxMustermann\AppData\Local\WebpageIcons.db
[2012.07.31 01:02:24 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf
[2012.07.31 01:00:11 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01009.Wdf
 
========== Files Created - No Company Name ==========
 
[2012.08.01 23:31:45 | 000,001,117 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.01 20:04:52 | 000,001,261 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
[2012.08.01 19:37:47 | 000,002,106 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
[2012.08.01 18:26:50 | 002,621,723 | ---- | C] () -- C:\Windows\SysNative\nvcoproc.bin
[2012.08.01 18:25:40 | 000,014,324 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb
[2012.07.31 17:38:43 | 000,002,074 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012.07.31 10:36:37 | 000,001,165 | ---- | C] () -- C:\Users\MaxMustermann\Desktop\Adobe Dreamweaver CS4.lnk
[2012.07.31 09:39:33 | 3206,787,072 | -HS- | C] () -- C:\hiberfil.sys
[2012.07.31 01:28:51 | 000,001,165 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Dreamweaver CS4.lnk
[2012.07.31 01:28:04 | 000,001,103 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS4.lnk
[2012.07.31 01:26:55 | 000,001,196 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS4.lnk
[2012.07.31 01:26:14 | 000,001,287 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS4.lnk
[2012.07.31 01:26:03 | 000,001,411 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS4.lnk
[2012.07.31 01:06:38 | 000,017,408 | ---- | C] () -- C:\Users\MaxMustermann\AppData\Local\WebpageIcons.db
[2012.07.31 01:02:24 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf
[2012.07.31 01:00:11 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01009.Wdf
[2012.07.30 23:51:14 | 000,001,413 | ---- | C] () -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2012.07.30 23:51:12 | 000,001,447 | ---- | C] () -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.07.30 23:46:01 | 000,002,360 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
[2012.07.30 23:45:56 | 000,002,678 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.07.30 23:45:47 | 000,001,110 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.30 23:45:47 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.05.15 02:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
 
========== LOP Check ==========
 
[2012.08.05 00:53:42 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Ashampoo
[2012.08.07 17:38:43 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\pdfforge
[2012.08.01 20:18:00 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Thunderbird
[2012.08.01 19:37:58 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Thunderbird
[2009.07.14 07:08:49 | 000,025,518 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.07.31 11:25:02 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Adobe
[2012.08.01 18:24:54 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Avira
[2012.07.30 23:51:03 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Identities
[2012.07.30 23:51:25 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Intel Corporation
[2012.07.31 01:20:24 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Macromedia
[2012.08.01 23:31:48 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Malwarebytes
[2011.04.12 10:28:03 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Media Center Programs
[2012.08.01 19:52:16 | 000,000,000 | --SD | M] -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft
[2012.08.01 19:37:58 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Mozilla
[2012.08.01 19:37:58 | 000,000,000 | ---D | M] -- C:\Users\MaxMustermann\AppData\Roaming\Thunderbird
 
< %APPDATA%\*.exe /s >
[2011.12.01 23:25:57 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\MaxMustermann\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2012.07.31 01:14:23 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Installer\{885A63EA-382B-4DD4-A755-14809B8557D6}\ARPPRODUCTICON.exe
[2012.07.31 01:14:25 | 000,045,056 | R--- | M] (InstallShield Software Corp.) -- C:\Users\MaxMustermann\AppData\Roaming\Microsoft\Installer\{91057632-CA70-413C-B628-2D3CDBBB906B}\ARPPRODUCTICON.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2011.05.20 19:53:44 | 000,557,848 | ---- | M] (Intel Corporation) MD5=2FDAEC4B02729C48C0FD1B0B4695995B -- C:\Windows\SysNative\drivers\iaStor.sys
[2011.05.20 19:53:44 | 000,557,848 | ---- | M] (Intel Corporation) MD5=2FDAEC4B02729C48C0FD1B0B4695995B -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_e6913aab23ea9a9c\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >
--- --- ---

[/code]

cosinus 10.08.2012 20:37
Zitat:
respect, dass Du sowas lesen kannst...
Lesen kann das jeder, aber damit etwas anfangen zu können ist eine Frage der Übung und ob man sich mit der systematischen Auswertung beschäftigt hat ;)
Nicht jeder kann alles, es lebe die Arbeitsteilung :blabla:

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
FF - user.js - File not found
O4 - HKU\S-1-5-21-2617558925-3834871055-3452261518-1002..\Run: [AdobeBridge]  File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-2617558925-3834871055-3452261518-1003..\RunOnce: [HKCU] C:\Windows\SysWOW64\oobe\info\HKCU.vbs ()
O4 - HKU\S-1-5-21-2617558925-3834871055-3452261518-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-2617558925-3834871055-3452261518-1003..\RunOnce: [Screensaver] C:\Windows\Web\Wallpaper\MEDION\start.vbs ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{cd5cd506-da8f-11e1-a4be-8c89a5a47f08}\Shell - "" = AutoRun
O33 - MountPoints2\{cd5cd506-da8f-11e1-a4be-8c89a5a47f08}\Shell\AutoRun\command - "" = I:\pushinst.exe
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Fontana 10.08.2012 21:34
... so, alles mit OTL gekillt ... was mach ich da eigentlich :dummguck:


Code:
All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-2617558925-3834871055-3452261518-1002\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2617558925-3834871055-3452261518-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\HKCU deleted successfully.
C:\Windows\SysWOW64\oobe\info\HKCU.vbs moved successfully.
Registry value HKEY_USERS\S-1-5-21-2617558925-3834871055-3452261518-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2617558925-3834871055-3452261518-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Screensaver deleted successfully.
C:\Windows\Web\Wallpaper\MEDION\start.vbs moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd5cd506-da8f-11e1-a4be-8c89a5a47f08}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd5cd506-da8f-11e1-a4be-8c89a5a47f08}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd5cd506-da8f-11e1-a4be-8c89a5a47f08}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd5cd506-da8f-11e1-a4be-8c89a5a47f08}\ not found.
File I:\pushinst.exe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: MaxMustermann
->Temp folder emptied: 1970324 bytes
->Temporary Internet Files folder emptied: 7205452 bytes
->FireFox cache emptied: 107673146 bytes
->Google Chrome cache emptied: 22067276 bytes
->Flash cache emptied: 60118 bytes
 
User: MaxMustermann
->Temp folder emptied: 174924889 bytes
->Temporary Internet Files folder emptied: 853550 bytes
->Google Chrome cache emptied: 10264602 bytes
->Flash cache emptied: 56854 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 78108007 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 749 bytes
RecycleBin emptied: 234091067 bytes
 
Total Files Cleaned = 608,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: MaxMustermann
->Flash cache emptied: 0 bytes
 
User: MaxMustermann
->Flash cache emptied: 0 bytes
 
User: Public
 
User: UpdatusUser
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.56.0 log created on 08102012_222503

cosinus 11.08.2012 16:46
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Fontana 11.08.2012 20:35
Hier die Logs

Code:
21:06:17.0286 4052        TDSS rootkit removing tool 2.7.48.0 Jul 24 2012 13:16:32
21:06:17.0551 4052        ============================================================
21:06:17.0551 4052        Current date / time: 2012/08/11 21:06:17.0551
21:06:17.0551 4052        SystemInfo:
21:06:17.0551 4052       
21:06:17.0551 4052        OS Version: 6.1.7601 ServicePack: 1.0
21:06:17.0551 4052        Product type: Workstation
21:06:17.0551 4052        ComputerName: MaxMustermann-PC
21:06:17.0551 4052        UserName: MaxMustermann
21:06:17.0551 4052        Windows directory: C:\Windows
21:06:17.0551 4052        System windows directory: C:\Windows
21:06:17.0551 4052        Running under WOW64
21:06:17.0551 4052        Processor architecture: Intel x64
21:06:17.0551 4052        Number of processors: 4
21:06:17.0551 4052        Page size: 0x1000
21:06:17.0551 4052        Boot type: Normal boot
21:06:17.0551 4052        ============================================================
21:06:17.0847 4052        Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
21:06:17.0863 4052        Drive \Device\Harddisk4\DR4 - Size: 0x1D1C1116000 (1863.02 Gb), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
21:06:17.0910 4052        ============================================================
21:06:17.0910 4052        \Device\Harddisk0\DR0:
21:06:17.0910 4052        MBR partitions:
21:06:17.0910 4052        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
21:06:17.0910 4052        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x6E0D3000
21:06:17.0910 4052        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x6E105800, BlocksNum 0x6400000
21:06:17.0910 4052        \Device\Harddisk4\DR4:
21:06:17.0910 4052        MBR partitions:
21:06:17.0910 4052        \Device\Harddisk4\DR4\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x61A80000
21:06:17.0910 4052        \Device\Harddisk4\DR4\Partition1: MBR, Type 0x7, StartLBA 0x61A80800, BlocksNum 0x87387000
21:06:17.0910 4052        ============================================================
21:06:18.0003 4052        C: <-> \Device\Harddisk0\DR0\Partition1
21:06:18.0066 4052        D: <-> \Device\Harddisk0\DR0\Partition2
21:06:18.0112 4052        I: <-> \Device\Harddisk4\DR4\Partition1
21:06:18.0144 4052        J: <-> \Device\Harddisk4\DR4\Partition0
21:06:18.0144 4052        ============================================================
21:06:18.0144 4052        Initialize success
21:06:18.0144 4052        ============================================================
21:06:28.0830 2572        ============================================================
21:06:28.0830 2572        Scan started
21:06:28.0830 2572        Mode: Manual; SigCheck; TDLFS;
21:06:28.0830 2572        ============================================================
21:06:29.0126 2572        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
21:06:29.0173 2572        1394ohci - ok
21:06:29.0204 2572        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
21:06:29.0220 2572        ACPI - ok
21:06:29.0251 2572        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
21:06:29.0251 2572        AcpiPmi - ok
21:06:29.0376 2572        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
21:06:29.0391 2572        AdobeARMservice - ok
21:06:29.0422 2572        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys
21:06:29.0438 2572        adp94xx - ok
21:06:29.0485 2572        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys
21:06:29.0500 2572        adpahci - ok
21:06:29.0532 2572        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys
21:06:29.0547 2572        adpu320 - ok
21:06:29.0578 2572        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
21:06:29.0610 2572        AeLookupSvc - ok
21:06:29.0672 2572        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
21:06:29.0688 2572        AFD - ok
21:06:29.0734 2572        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
21:06:29.0734 2572        agp440 - ok
21:06:29.0750 2572        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
21:06:29.0766 2572        ALG - ok
21:06:29.0781 2572        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
21:06:29.0797 2572        aliide - ok
21:06:29.0812 2572        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
21:06:29.0828 2572        amdide - ok
21:06:29.0844 2572        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys
21:06:29.0859 2572        AmdK8 - ok
21:06:29.0875 2572        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\drivers\amdppm.sys
21:06:29.0890 2572        AmdPPM - ok
21:06:29.0906 2572        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
21:06:29.0922 2572        amdsata - ok
21:06:29.0953 2572        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys
21:06:29.0968 2572        amdsbs - ok
21:06:29.0968 2572        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
21:06:29.0984 2572        amdxata - ok
21:06:30.0062 2572        AntiVirMailService (b9b5dfafea592bd4ca967824ebb42e3d) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
21:06:30.0078 2572        AntiVirMailService - ok
21:06:30.0140 2572        AntiVirSchedulerService (67b1d78711b4386c26241096326ee14a) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
21:06:30.0140 2572        AntiVirSchedulerService - ok
21:06:30.0156 2572        AntiVirService  (845c4e7ae211edad5e0b832126f56932) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
21:06:30.0171 2572        AntiVirService - ok
21:06:30.0187 2572        AntiVirWebService (30d71e0c149943a8985d02ea0944f2fe) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
21:06:30.0202 2572        AntiVirWebService - ok
21:06:30.0234 2572        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
21:06:30.0249 2572        AppID - ok
21:06:30.0265 2572        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
21:06:30.0296 2572        AppIDSvc - ok
21:06:30.0296 2572        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
21:06:30.0327 2572        Appinfo - ok
21:06:30.0358 2572        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys
21:06:30.0358 2572        arc - ok
21:06:30.0358 2572        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys
21:06:30.0374 2572        arcsas - ok
21:06:30.0405 2572        asmthub3        (d6d2bb2f4f5868549dde75f3146bc84e) C:\Windows\system32\drivers\asmthub3.sys
21:06:30.0421 2572        asmthub3 - ok
21:06:30.0452 2572        asmtxhci        (1e758172367dc2a3653f16586d62a3f0) C:\Windows\system32\drivers\asmtxhci.sys
21:06:30.0468 2572        asmtxhci - ok
21:06:30.0483 2572        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
21:06:30.0514 2572        AsyncMac - ok
21:06:30.0546 2572        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
21:06:30.0561 2572        atapi - ok
21:06:30.0608 2572        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:06:30.0639 2572        AudioEndpointBuilder - ok
21:06:30.0655 2572        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:06:30.0670 2572        AudioSrv - ok
21:06:30.0717 2572        avgntflt        (26e38b5a58c6c55fafbc563eeddb0867) C:\Windows\system32\DRIVERS\avgntflt.sys
21:06:30.0717 2572        avgntflt - ok
21:06:30.0733 2572        avipbb          (9d1f00beff84cbbf46d7f052bc7e0565) C:\Windows\system32\DRIVERS\avipbb.sys
21:06:30.0748 2572        avipbb - ok
21:06:30.0748 2572        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys
21:06:30.0764 2572        avkmgr - ok
21:06:30.0826 2572        AVM WLAN Connection Service (c6f4c466b654c1be98af31418bb5ac30) C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
21:06:30.0842 2572        AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - warning
21:06:30.0842 2572        AVM WLAN Connection Service - detected UnsignedFile.Multi.Generic (1)
21:06:30.0858 2572        avmeject        (1dc2f715792cf33428ad7993acbd224d) C:\Windows\system32\drivers\avmeject.sys
21:06:30.0858 2572        avmeject - ok
21:06:30.0904 2572        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
21:06:30.0904 2572        AxInstSV - ok
21:06:30.0951 2572        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys
21:06:30.0967 2572        b06bdrv - ok
21:06:30.0998 2572        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
21:06:31.0014 2572        b57nd60a - ok
21:06:31.0060 2572        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
21:06:31.0076 2572        BDESVC - ok
21:06:31.0076 2572        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
21:06:31.0123 2572        Beep - ok
21:06:31.0138 2572        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
21:06:31.0170 2572        BFE - ok
21:06:31.0216 2572        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
21:06:31.0248 2572        BITS - ok
21:06:31.0310 2572        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\drivers\blbdrive.sys
21:06:31.0326 2572        blbdrive - ok
21:06:31.0357 2572        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
21:06:31.0372 2572        bowser - ok
21:06:31.0388 2572        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys
21:06:31.0404 2572        BrFiltLo - ok
21:06:31.0419 2572        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys
21:06:31.0435 2572        BrFiltUp - ok
21:06:31.0466 2572        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
21:06:31.0513 2572        Browser - ok
21:06:31.0528 2572        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
21:06:31.0544 2572        Brserid - ok
21:06:31.0560 2572        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
21:06:31.0575 2572        BrSerWdm - ok
21:06:31.0591 2572        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
21:06:31.0606 2572        BrUsbMdm - ok
21:06:31.0606 2572        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
21:06:31.0622 2572        BrUsbSer - ok
21:06:31.0638 2572        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\drivers\bthmodem.sys
21:06:31.0638 2572        BTHMODEM - ok
21:06:31.0684 2572        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
21:06:31.0700 2572        bthserv - ok
21:06:31.0731 2572        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
21:06:31.0747 2572        cdfs - ok
21:06:31.0778 2572        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
21:06:31.0794 2572        cdrom - ok
21:06:31.0809 2572        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:06:31.0825 2572        CertPropSvc - ok
21:06:31.0840 2572        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys
21:06:31.0856 2572        circlass - ok
21:06:31.0887 2572        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
21:06:31.0887 2572        CLFS - ok
21:06:31.0934 2572        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:06:31.0950 2572        clr_optimization_v2.0.50727_32 - ok
21:06:31.0981 2572        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:06:31.0981 2572        clr_optimization_v2.0.50727_64 - ok
21:06:32.0059 2572        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:06:32.0074 2572        clr_optimization_v4.0.30319_32 - ok
21:06:32.0090 2572        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:06:32.0106 2572        clr_optimization_v4.0.30319_64 - ok
21:06:32.0121 2572        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\drivers\CmBatt.sys
21:06:32.0121 2572        CmBatt - ok
21:06:32.0137 2572        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
21:06:32.0152 2572        cmdide - ok
21:06:32.0199 2572        CNG            (9ac4f97c2d3e93367e2148ea940cd2cd) C:\Windows\system32\Drivers\cng.sys
21:06:32.0230 2572        CNG - ok
21:06:32.0262 2572        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\drivers\compbatt.sys
21:06:32.0262 2572        Compbatt - ok
21:06:32.0308 2572        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
21:06:32.0324 2572        CompositeBus - ok
21:06:32.0324 2572        COMSysApp - ok
21:06:32.0340 2572        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys
21:06:32.0355 2572        crcdisk - ok
21:06:32.0386 2572        CryptSvc        (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll
21:06:32.0402 2572        CryptSvc - ok
21:06:32.0449 2572        dc3d            (c7259495924d21f1afa26467d9f4dae0) C:\Windows\system32\DRIVERS\dc3d.sys
21:06:32.0464 2572        dc3d - ok
21:06:32.0496 2572        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:06:32.0527 2572        DcomLaunch - ok
21:06:32.0558 2572        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
21:06:32.0589 2572        defragsvc - ok
21:06:32.0605 2572        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
21:06:32.0636 2572        DfsC - ok
21:06:32.0652 2572        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
21:06:32.0667 2572        Dhcp - ok
21:06:32.0698 2572        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
21:06:32.0714 2572        discache - ok
21:06:32.0761 2572        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys
21:06:32.0776 2572        Disk - ok
21:06:32.0808 2572        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
21:06:32.0823 2572        Dnscache - ok
21:06:32.0870 2572        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
21:06:32.0901 2572        dot3svc - ok
21:06:32.0901 2572        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
21:06:32.0917 2572        DPS - ok
21:06:32.0964 2572        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
21:06:32.0964 2572        drmkaud - ok
21:06:33.0010 2572        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
21:06:33.0042 2572        DXGKrnl - ok
21:06:33.0057 2572        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
21:06:33.0088 2572        EapHost - ok
21:06:33.0182 2572        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys
21:06:33.0213 2572        ebdrv - ok
21:06:33.0307 2572        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
21:06:33.0322 2572        EFS - ok
21:06:33.0385 2572        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
21:06:33.0400 2572        ehRecvr - ok
21:06:33.0416 2572        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
21:06:33.0432 2572        ehSched - ok
21:06:33.0494 2572        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys
21:06:33.0525 2572        elxstor - ok
21:06:33.0525 2572        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
21:06:33.0541 2572        ErrDev - ok
21:06:33.0588 2572        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
21:06:33.0619 2572        EventSystem - ok
21:06:33.0650 2572        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
21:06:33.0666 2572        exfat - ok
21:06:33.0681 2572        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
21:06:33.0697 2572        fastfat - ok
21:06:33.0728 2572        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
21:06:33.0744 2572        Fax - ok
21:06:33.0775 2572        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys
21:06:33.0775 2572        fdc - ok
21:06:33.0775 2572        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
21:06:33.0806 2572        fdPHost - ok
21:06:33.0822 2572        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
21:06:33.0837 2572        FDResPub - ok
21:06:33.0868 2572        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
21:06:33.0868 2572        FileInfo - ok
21:06:33.0884 2572        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
21:06:33.0915 2572        Filetrace - ok
21:06:33.0993 2572        FLEXnet Licensing Service (1f63900e2eb00101b9aca2b7a870704e) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
21:06:34.0009 2572        FLEXnet Licensing Service - ok
21:06:34.0040 2572        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys
21:06:34.0056 2572        flpydisk - ok
21:06:34.0087 2572        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
21:06:34.0102 2572        FltMgr - ok
21:06:34.0165 2572        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
21:06:34.0196 2572        FontCache - ok
21:06:34.0258 2572        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:06:34.0274 2572        FontCache3.0.0.0 - ok
21:06:34.0305 2572        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
21:06:34.0321 2572        FsDepends - ok
21:06:34.0352 2572        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
21:06:34.0352 2572        Fs_Rec - ok
21:06:34.0383 2572        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
21:06:34.0399 2572        fvevol - ok
21:06:34.0446 2572        fwlanusbn      (15585492e45e2f30768b2d5b57929d99) C:\Windows\system32\DRIVERS\fwlanusbn.sys
21:06:34.0461 2572        fwlanusbn - ok
21:06:34.0492 2572        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys
21:06:34.0508 2572        gagp30kx - ok
21:06:34.0555 2572        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
21:06:34.0586 2572        gpsvc - ok
21:06:34.0617 2572        gupdate - ok
21:06:34.0617 2572        gupdatem - ok
21:06:34.0648 2572        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
21:06:34.0664 2572        hcw85cir - ok
21:06:34.0711 2572        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
21:06:34.0726 2572        HdAudAddService - ok
21:06:34.0773 2572        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
21:06:34.0789 2572        HDAudBus - ok
21:06:34.0804 2572        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys
21:06:34.0820 2572        HidBatt - ok
21:06:34.0836 2572        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys
21:06:34.0851 2572        HidBth - ok
21:06:34.0882 2572        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys
21:06:34.0898 2572        HidIr - ok
21:06:34.0914 2572        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
21:06:34.0929 2572        hidserv - ok
21:06:34.0976 2572        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
21:06:34.0976 2572        HidUsb - ok
21:06:34.0992 2572        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
21:06:35.0023 2572        hkmsvc - ok
21:06:35.0023 2572        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
21:06:35.0038 2572        HomeGroupListener - ok
21:06:35.0054 2572        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
21:06:35.0070 2572        HomeGroupProvider - ok
21:06:35.0070 2572        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
21:06:35.0085 2572        HpSAMD - ok
21:06:35.0132 2572        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
21:06:35.0179 2572        HTTP - ok
21:06:35.0179 2572        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
21:06:35.0194 2572        hwpolicy - ok
21:06:35.0226 2572        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
21:06:35.0241 2572        i8042prt - ok
21:06:35.0272 2572        iaStor          (2fdaec4b02729c48c0fd1b0b4695995b) C:\Windows\system32\drivers\iaStor.sys
21:06:35.0304 2572        iaStor - ok
21:06:35.0366 2572        IAStorDataMgrSvc (d41861e56e7552c13674d7f147a02464) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
21:06:35.0382 2572        IAStorDataMgrSvc - ok
21:06:35.0413 2572        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
21:06:35.0444 2572        iaStorV - ok
21:06:35.0522 2572        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:06:35.0538 2572        idsvc - ok
21:06:35.0725 2572        igfx            (a87261ef1546325b559374f5689cf5bc) C:\Windows\system32\DRIVERS\igdkmd64.sys
21:06:35.0787 2572        igfx - ok
21:06:35.0896 2572        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys
21:06:35.0896 2572        iirsp - ok
21:06:35.0959 2572        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
21:06:35.0990 2572        IKEEXT - ok
21:06:36.0130 2572        IntcAzAudAddService (cb7dadef3d83fe2c12655a0bdcba99f2) C:\Windows\system32\drivers\RTKVHD64.sys
21:06:36.0162 2572        IntcAzAudAddService - ok
21:06:36.0255 2572        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
21:06:36.0271 2572        intelide - ok
21:06:36.0286 2572        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
21:06:36.0302 2572        intelppm - ok
21:06:36.0318 2572        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
21:06:36.0349 2572        IPBusEnum - ok
21:06:36.0364 2572        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:06:36.0396 2572        IpFilterDriver - ok
21:06:36.0411 2572        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
21:06:36.0442 2572        iphlpsvc - ok
21:06:36.0474 2572        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
21:06:36.0474 2572        IPMIDRV - ok
21:06:36.0474 2572        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
21:06:36.0505 2572        IPNAT - ok
21:06:36.0505 2572        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
21:06:36.0520 2572        IRENUM - ok
21:06:36.0536 2572        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
21:06:36.0552 2572        isapnp - ok
21:06:36.0567 2572        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
21:06:36.0598 2572        iScsiPrt - ok
21:06:36.0614 2572        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
21:06:36.0630 2572        kbdclass - ok
21:06:36.0645 2572        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
21:06:36.0645 2572        kbdhid - ok
21:06:36.0676 2572        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:06:36.0692 2572        KeyIso - ok
21:06:36.0723 2572        KSecDD          (97a7070aea4c058b6418519e869a63b4) C:\Windows\system32\Drivers\ksecdd.sys
21:06:36.0739 2572        KSecDD - ok
21:06:36.0754 2572        KSecPkg        (26c43a7c2862447ec59deda188d1da07) C:\Windows\system32\Drivers\ksecpkg.sys
21:06:36.0770 2572        KSecPkg - ok
21:06:36.0786 2572        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
21:06:36.0817 2572        ksthunk - ok
21:06:36.0848 2572        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
21:06:36.0864 2572        KtmRm - ok
21:06:36.0895 2572        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
21:06:36.0926 2572        LanmanServer - ok
21:06:36.0942 2572        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
21:06:36.0973 2572        LanmanWorkstation - ok
21:06:37.0004 2572        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
21:06:37.0020 2572        lltdio - ok
21:06:37.0051 2572        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
21:06:37.0082 2572        lltdsvc - ok
21:06:37.0082 2572        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
21:06:37.0113 2572        lmhosts - ok
21:06:37.0191 2572        LMS            (1584deeae5aa0e3fb045f3d0eac585ea) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
21:06:37.0207 2572        LMS - ok
21:06:37.0238 2572        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys
21:06:37.0254 2572        LSI_FC - ok
21:06:37.0285 2572        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys
21:06:37.0300 2572        LSI_SAS - ok
21:06:37.0332 2572        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys
21:06:37.0332 2572        LSI_SAS2 - ok
21:06:37.0363 2572        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys
21:06:37.0378 2572        LSI_SCSI - ok
21:06:37.0410 2572        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
21:06:37.0456 2572        luafv - ok
21:06:37.0488 2572        MBAMProtector  (dc8490812a3b72811ae534f423b4c206) C:\Windows\system32\drivers\mbam.sys
21:06:37.0503 2572        MBAMProtector - ok
21:06:37.0550 2572        MBAMService    (43683e970f008c93c9429ef428147a54) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
21:06:37.0566 2572        MBAMService - ok
21:06:37.0597 2572        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
21:06:37.0612 2572        Mcx2Svc - ok
21:06:37.0628 2572        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys
21:06:37.0644 2572        megasas - ok
21:06:37.0675 2572        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys
21:06:37.0706 2572        MegaSR - ok
21:06:37.0722 2572        MEIx64          (a6518dcc42f7a6e999bb3bea8fd87567) C:\Windows\system32\drivers\HECIx64.sys
21:06:37.0737 2572        MEIx64 - ok
21:06:37.0784 2572        MemeoBackgroundService (8a43d23ace2e8c95a2d87b6e9599deda) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
21:06:37.0800 2572        MemeoBackgroundService - ok
21:06:37.0815 2572        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:06:37.0846 2572        MMCSS - ok
21:06:37.0862 2572        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
21:06:37.0893 2572        Modem - ok
21:06:37.0909 2572        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
21:06:37.0909 2572        monitor - ok
21:06:37.0940 2572        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
21:06:37.0956 2572        mouclass - ok
21:06:37.0971 2572        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
21:06:37.0987 2572        mouhid - ok
21:06:38.0018 2572        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
21:06:38.0034 2572        mountmgr - ok
21:06:38.0049 2572        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
21:06:38.0065 2572        mpio - ok
21:06:38.0065 2572        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
21:06:38.0096 2572        mpsdrv - ok
21:06:38.0127 2572        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
21:06:38.0158 2572        MpsSvc - ok
21:06:38.0190 2572        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
21:06:38.0190 2572        MRxDAV - ok
21:06:38.0221 2572        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
21:06:38.0236 2572        mrxsmb - ok
21:06:38.0252 2572        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:06:38.0268 2572        mrxsmb10 - ok
21:06:38.0283 2572        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:06:38.0283 2572        mrxsmb20 - ok
21:06:38.0299 2572        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
21:06:38.0314 2572        msahci - ok
21:06:38.0330 2572        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
21:06:38.0346 2572        msdsm - ok
21:06:38.0361 2572        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
21:06:38.0377 2572        MSDTC - ok
21:06:38.0392 2572        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
21:06:38.0408 2572        Msfs - ok
21:06:38.0439 2572        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
21:06:38.0455 2572        mshidkmdf - ok
21:06:38.0470 2572        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
21:06:38.0470 2572        msisadrv - ok
21:06:38.0486 2572        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
21:06:38.0517 2572        MSiSCSI - ok
21:06:38.0517 2572        msiserver - ok
21:06:38.0548 2572        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
21:06:38.0564 2572        MSKSSRV - ok
21:06:38.0580 2572        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
21:06:38.0611 2572        MSPCLOCK - ok
21:06:38.0611 2572        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
21:06:38.0626 2572        MSPQM - ok
21:06:38.0642 2572        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
21:06:38.0658 2572        MsRPC - ok
21:06:38.0673 2572        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
21:06:38.0673 2572        mssmbios - ok
21:06:38.0673 2572        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
21:06:38.0704 2572        MSTEE - ok
21:06:38.0720 2572        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys
21:06:38.0720 2572        MTConfig - ok
21:06:38.0736 2572        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
21:06:38.0751 2572        Mup - ok
21:06:38.0782 2572        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
21:06:38.0798 2572        napagent - ok
21:06:38.0829 2572        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
21:06:38.0845 2572        NativeWifiP - ok
21:06:38.0892 2572        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
21:06:38.0923 2572        NDIS - ok
21:06:38.0923 2572        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
21:06:38.0954 2572        NdisCap - ok
21:06:38.0970 2572        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
21:06:38.0985 2572        NdisTapi - ok
21:06:39.0016 2572        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
21:06:39.0032 2572        Ndisuio - ok
21:06:39.0063 2572        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
21:06:39.0079 2572        NdisWan - ok
21:06:39.0094 2572        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
21:06:39.0126 2572        NDProxy - ok
21:06:39.0126 2572        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
21:06:39.0141 2572        NetBIOS - ok
21:06:39.0157 2572        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
21:06:39.0172 2572        NetBT - ok
21:06:39.0219 2572        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:06:39.0235 2572        Netlogon - ok
21:06:39.0266 2572        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
21:06:39.0313 2572        Netman - ok
21:06:39.0328 2572        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
21:06:39.0360 2572        netprofm - ok
21:06:39.0422 2572        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
21:06:39.0438 2572        NetTcpPortSharing - ok
21:06:39.0453 2572        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys
21:06:39.0469 2572        nfrd960 - ok
21:06:39.0500 2572        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
21:06:39.0531 2572        NlaSvc - ok
21:06:39.0547 2572        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
21:06:39.0562 2572        Npfs - ok
21:06:39.0578 2572        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
21:06:39.0594 2572        nsi - ok
21:06:39.0609 2572        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
21:06:39.0625 2572        nsiproxy - ok
21:06:39.0703 2572        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
21:06:39.0734 2572        Ntfs - ok
21:06:39.0828 2572        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
21:06:39.0859 2572        Null - ok
21:06:39.0906 2572        NVENETFD        (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys
21:06:39.0921 2572        NVENETFD - ok
21:06:39.0968 2572        NVHDA          (102806b360d0e6bc6e55bf47ef655d43) C:\Windows\system32\drivers\nvhda64v.sys
21:06:39.0984 2572        NVHDA - ok
21:06:40.0374 2572        nvlddmkm        (ba0b4889c40380a01ecdf84c227a89c9) C:\Windows\system32\DRIVERS\nvlddmkm.sys
21:06:40.0530 2572        nvlddmkm - ok
21:06:40.0623 2572        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
21:06:40.0639 2572        nvraid - ok
21:06:40.0654 2572        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
21:06:40.0670 2572        nvstor - ok
21:06:40.0717 2572        nvsvc          (06633cf95bea62164c3bfca24bce6b11) C:\Windows\system32\nvvsvc.exe
21:06:40.0748 2572        nvsvc - ok
21:06:40.0842 2572        nvUpdatusService (53b629ce436b110c5689c2f6439e567b) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
21:06:40.0873 2572        nvUpdatusService - ok
21:06:40.0966 2572        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
21:06:40.0982 2572        nv_agp - ok
21:06:41.0076 2572        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
21:06:41.0091 2572        odserv - ok
21:06:41.0122 2572        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
21:06:41.0138 2572        ohci1394 - ok
21:06:41.0154 2572        ose            (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:06:41.0169 2572        ose - ok
21:06:41.0200 2572        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:06:41.0216 2572        p2pimsvc - ok
21:06:41.0232 2572        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
21:06:41.0247 2572        p2psvc - ok
21:06:41.0278 2572        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys
21:06:41.0278 2572        Parport - ok
21:06:41.0310 2572        partmgr        (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
21:06:41.0310 2572        partmgr - ok
21:06:41.0325 2572        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
21:06:41.0341 2572        PcaSvc - ok
21:06:41.0356 2572        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
21:06:41.0356 2572        pci - ok
21:06:41.0372 2572        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
21:06:41.0388 2572        pciide - ok
21:06:41.0419 2572        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys
21:06:41.0419 2572        pcmcia - ok
21:06:41.0434 2572        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
21:06:41.0450 2572        pcw - ok
21:06:41.0481 2572        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
21:06:41.0512 2572        PEAUTH - ok
21:06:41.0575 2572        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
21:06:41.0590 2572        PerfHost - ok
21:06:41.0637 2572        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
21:06:41.0684 2572        pla - ok
21:06:41.0731 2572        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
21:06:41.0746 2572        PlugPlay - ok
21:06:41.0778 2572        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
21:06:41.0793 2572        PNRPAutoReg - ok
21:06:41.0809 2572        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:06:41.0824 2572        PNRPsvc - ok
21:06:41.0871 2572        Point64        (32d374c60778253b81fa76c2fe19e155) C:\Windows\system32\DRIVERS\point64.sys
21:06:41.0887 2572        Point64 - ok
21:06:41.0918 2572        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
21:06:41.0965 2572        PolicyAgent - ok
21:06:41.0996 2572        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
21:06:42.0012 2572        Power - ok
21:06:42.0043 2572        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
21:06:42.0074 2572        PptpMiniport - ok
21:06:42.0090 2572        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys
21:06:42.0105 2572        Processor - ok
21:06:42.0136 2572        ProfSvc        (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll
21:06:42.0152 2572        ProfSvc - ok
21:06:42.0168 2572        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:06:42.0183 2572        ProtectedStorage - ok
21:06:42.0214 2572        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
21:06:42.0230 2572        Psched - ok
21:06:42.0292 2572        PSI_SVC_2      (543a4ef0923bf70d126625b034ef25af) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
21:06:42.0308 2572        PSI_SVC_2 - ok
21:06:42.0386 2572        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys
21:06:42.0417 2572        ql2300 - ok
21:06:42.0480 2572        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys
21:06:42.0495 2572        ql40xx - ok
21:06:42.0511 2572        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
21:06:42.0542 2572        QWAVE - ok
21:06:42.0558 2572        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
21:06:42.0573 2572        QWAVEdrv - ok
21:06:42.0573 2572        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
21:06:42.0604 2572        RasAcd - ok
21:06:42.0620 2572        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
21:06:42.0636 2572        RasAgileVpn - ok
21:06:42.0651 2572        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
21:06:42.0682 2572        RasAuto - ok
21:06:42.0682 2572        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
21:06:42.0714 2572        Rasl2tp - ok
21:06:42.0729 2572        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
21:06:42.0760 2572        RasMan - ok
21:06:42.0760 2572        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
21:06:42.0776 2572        RasPppoe - ok
21:06:42.0792 2572        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
21:06:42.0823 2572        RasSstp - ok
21:06:42.0838 2572        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
21:06:42.0854 2572        rdbss - ok
21:06:42.0885 2572        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\drivers\rdpbus.sys
21:06:42.0885 2572        rdpbus - ok
21:06:42.0901 2572        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
21:06:42.0916 2572        RDPCDD - ok
21:06:42.0932 2572        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
21:06:42.0948 2572        RDPENCDD - ok
21:06:42.0963 2572        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
21:06:42.0994 2572        RDPREFMP - ok
21:06:43.0026 2572        RDPWD          (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys
21:06:43.0041 2572        RDPWD - ok
21:06:43.0088 2572        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
21:06:43.0104 2572        rdyboost - ok
21:06:43.0119 2572        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
21:06:43.0150 2572        RemoteAccess - ok
21:06:43.0166 2572        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
21:06:43.0197 2572        RemoteRegistry - ok
21:06:43.0197 2572        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
21:06:43.0213 2572        RpcEptMapper - ok
21:06:43.0228 2572        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
21:06:43.0228 2572        RpcLocator - ok
21:06:43.0244 2572        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:06:43.0275 2572        RpcSs - ok
21:06:43.0291 2572        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
21:06:43.0306 2572        rspndr - ok
21:06:43.0369 2572        RTL8167        (ee082e06a82ff630351d1e0ebbd3d8d0) C:\Windows\system32\DRIVERS\Rt64win7.sys
21:06:43.0384 2572        RTL8167 - ok
21:06:43.0447 2572        RTL8192su      (b3f36b4b3f192ea87ddc119f3a0b3e45) C:\Windows\system32\DRIVERS\RTL8192su.sys
21:06:43.0478 2572        RTL8192su - ok
21:06:43.0478 2572        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:06:43.0494 2572        SamSs - ok
21:06:43.0509 2572        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
21:06:43.0525 2572        sbp2port - ok
21:06:43.0540 2572        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
21:06:43.0556 2572        SCardSvr - ok
21:06:43.0587 2572        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
21:06:43.0603 2572        scfilter - ok
21:06:43.0634 2572        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
21:06:43.0665 2572        Schedule - ok
21:06:43.0681 2572        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:06:43.0712 2572        SCPolicySvc - ok
21:06:43.0728 2572        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
21:06:43.0728 2572        SDRSVC - ok
21:06:43.0774 2572        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
21:06:43.0790 2572        secdrv - ok
21:06:43.0821 2572        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
21:06:43.0837 2572        seclogon - ok
21:06:43.0852 2572        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
21:06:43.0868 2572        SENS - ok
21:06:43.0884 2572        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
21:06:43.0899 2572        SensrSvc - ok
21:06:43.0915 2572        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\drivers\serenum.sys
21:06:43.0930 2572        Serenum - ok
21:06:43.0946 2572        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys
21:06:43.0946 2572        Serial - ok
21:06:43.0962 2572        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys
21:06:43.0962 2572        sermouse - ok
21:06:43.0993 2572        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
21:06:44.0008 2572        SessionEnv - ok
21:06:44.0024 2572        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
21:06:44.0040 2572        sffdisk - ok
21:06:44.0055 2572        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
21:06:44.0055 2572        sffp_mmc - ok
21:06:44.0071 2572        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
21:06:44.0071 2572        sffp_sd - ok
21:06:44.0118 2572        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys
21:06:44.0118 2572        sfloppy - ok
21:06:44.0149 2572        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
21:06:44.0180 2572        SharedAccess - ok
21:06:44.0211 2572        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
21:06:44.0258 2572        ShellHWDetection - ok
21:06:44.0274 2572        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys
21:06:44.0289 2572        SiSRaid2 - ok
21:06:44.0289 2572        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys
21:06:44.0305 2572        SiSRaid4 - ok
21:06:44.0336 2572        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
21:06:44.0383 2572        Smb - ok
21:06:44.0414 2572        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
21:06:44.0414 2572        SNMPTRAP - ok
21:06:44.0430 2572        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
21:06:44.0430 2572        spldr - ok
21:06:44.0461 2572        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
21:06:44.0492 2572        Spooler - ok
21:06:44.0601 2572        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
21:06:44.0648 2572        sppsvc - ok
21:06:44.0710 2572        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
21:06:44.0742 2572        sppuinotify - ok
21:06:44.0804 2572        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
21:06:44.0835 2572        srv - ok
21:06:44.0851 2572        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
21:06:44.0851 2572        srv2 - ok
21:06:44.0882 2572        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
21:06:44.0882 2572        srvnet - ok
21:06:44.0929 2572        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
21:06:44.0960 2572        SSDPSRV - ok
21:06:44.0960 2572        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
21:06:44.0991 2572        SstpSvc - ok
21:06:45.0069 2572        Stereo Service  (c354621b6b94e10ae7f5cdbe745feb86) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
21:06:45.0085 2572        Stereo Service - ok
21:06:45.0116 2572        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys
21:06:45.0116 2572        stexstor - ok
21:06:45.0163 2572        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
21:06:45.0194 2572        stisvc - ok
21:06:45.0210 2572        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
21:06:45.0210 2572        swenum - ok
21:06:45.0256 2572        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
21:06:45.0303 2572        swprv - ok
21:06:45.0366 2572        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
21:06:45.0397 2572        SysMain - ok
21:06:45.0459 2572        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
21:06:45.0490 2572        TabletInputService - ok
21:06:45.0490 2572        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
21:06:45.0522 2572        TapiSrv - ok
21:06:45.0522 2572        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
21:06:45.0553 2572        TBS - ok
21:06:45.0662 2572        Tcpip          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
21:06:45.0693 2572        Tcpip - ok
21:06:45.0771 2572        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
21:06:45.0802 2572        TCPIP6 - ok
21:06:45.0834 2572        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
21:06:45.0849 2572        tcpipreg - ok
21:06:45.0865 2572        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
21:06:45.0880 2572        TDPIPE - ok
21:06:45.0896 2572        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
21:06:45.0896 2572        TDTCP - ok
21:06:45.0927 2572        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
21:06:45.0943 2572        tdx - ok
21:06:45.0974 2572        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
21:06:45.0974 2572        TermDD - ok
21:06:46.0005 2572        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
21:06:46.0036 2572        TermService - ok
21:06:46.0036 2572        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
21:06:46.0052 2572        Themes - ok
21:06:46.0068 2572        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:06:46.0083 2572        THREADORDER - ok
21:06:46.0099 2572        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
21:06:46.0114 2572        TrkWks - ok
21:06:46.0161 2572        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
21:06:46.0208 2572        TrustedInstaller - ok
21:06:46.0224 2572        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
21:06:46.0270 2572        tssecsrv - ok
21:06:46.0286 2572        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
21:06:46.0286 2572        TsUsbFlt - ok
21:06:46.0317 2572        TsUsbGD        (9cc2ccae8a84820eaecb886d477cbcb8) C:\Windows\system32\drivers\TsUsbGD.sys
21:06:46.0317 2572        TsUsbGD - ok
21:06:46.0333 2572        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
21:06:46.0364 2572        tunnel - ok
21:06:46.0380 2572        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys
21:06:46.0395 2572        uagp35 - ok
21:06:46.0411 2572        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
21:06:46.0426 2572        udfs - ok
21:06:46.0442 2572        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
21:06:46.0458 2572        UI0Detect - ok
21:06:46.0489 2572        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
21:06:46.0504 2572        uliagpkx - ok
21:06:46.0520 2572        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
21:06:46.0536 2572        umbus - ok
21:06:46.0551 2572        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys
21:06:46.0551 2572        UmPass - ok
21:06:46.0692 2572        UNS            (fc43877b4625f6eb773c98233eb625c5) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
21:06:46.0723 2572        UNS - ok
21:06:46.0816 2572        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
21:06:46.0848 2572        upnphost - ok
21:06:46.0879 2572        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
21:06:46.0894 2572        usbccgp - ok
21:06:46.0926 2572        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
21:06:46.0941 2572        usbcir - ok
21:06:46.0941 2572        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
21:06:46.0957 2572        usbehci - ok
21:06:46.0972 2572        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
21:06:46.0988 2572        usbhub - ok
21:06:47.0004 2572        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
21:06:47.0019 2572        usbohci - ok
21:06:47.0035 2572        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
21:06:47.0050 2572        usbprint - ok
21:06:47.0082 2572        usbscan        (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
21:06:47.0082 2572        usbscan - ok
21:06:47.0113 2572        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:06:47.0113 2572        USBSTOR - ok
21:06:47.0144 2572        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
21:06:47.0144 2572        usbuhci - ok
21:06:47.0175 2572        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
21:06:47.0191 2572        UxSms - ok
21:06:47.0238 2572        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:06:47.0238 2572        VaultSvc - ok
21:06:47.0269 2572        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
21:06:47.0269 2572        vdrvroot - ok
21:06:47.0300 2572        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
21:06:47.0331 2572        vds - ok
21:06:47.0362 2572        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
21:06:47.0378 2572        vga - ok
21:06:47.0394 2572        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
21:06:47.0425 2572        VgaSave - ok
21:06:47.0456 2572        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
21:06:47.0456 2572        vhdmp - ok
21:06:47.0487 2572        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
21:06:47.0503 2572        viaide - ok
21:06:47.0518 2572        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
21:06:47.0518 2572        volmgr - ok
21:06:47.0550 2572        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
21:06:47.0565 2572        volmgrx - ok
21:06:47.0596 2572        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
21:06:47.0612 2572        volsnap - ok
21:06:47.0628 2572        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys
21:06:47.0643 2572        vsmraid - ok
21:06:47.0706 2572        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
21:06:47.0752 2572        VSS - ok
21:06:47.0846 2572        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
21:06:47.0862 2572        vwifibus - ok
21:06:47.0877 2572        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
21:06:47.0893 2572        vwififlt - ok
21:06:47.0924 2572        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
21:06:47.0955 2572        W32Time - ok
21:06:47.0971 2572        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys
21:06:47.0986 2572        WacomPen - ok
21:06:48.0018 2572        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:06:48.0049 2572        WANARP - ok
21:06:48.0049 2572        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:06:48.0080 2572        Wanarpv6 - ok
21:06:48.0158 2572        WatAdminSvc    (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
21:06:48.0189 2572        WatAdminSvc - ok
21:06:48.0252 2572        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
21:06:48.0267 2572        wbengine - ok
21:06:48.0345 2572        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
21:06:48.0361 2572        WbioSrvc - ok
21:06:48.0376 2572        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
21:06:48.0392 2572        wcncsvc - ok
21:06:48.0408 2572        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
21:06:48.0408 2572        WcsPlugInService - ok
21:06:48.0454 2572        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys
21:06:48.0470 2572        Wd - ok
21:06:48.0517 2572        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
21:06:48.0532 2572        Wdf01000 - ok
21:06:48.0548 2572        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:06:48.0548 2572        WdiServiceHost - ok
21:06:48.0548 2572        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:06:48.0564 2572        WdiSystemHost - ok
21:06:48.0595 2572        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
21:06:48.0610 2572        WebClient - ok
21:06:48.0610 2572        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
21:06:48.0642 2572        Wecsvc - ok
21:06:48.0642 2572        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
21:06:48.0657 2572        wercplsupport - ok
21:06:48.0673 2572        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
21:06:48.0704 2572        WerSvc - ok
21:06:48.0735 2572        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
21:06:48.0782 2572        WfpLwf - ok
21:06:48.0782 2572        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
21:06:48.0798 2572        WIMMount - ok
21:06:48.0829 2572        WinDefend - ok
21:06:48.0829 2572        WinHttpAutoProxySvc - ok
21:06:48.0876 2572        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
21:06:48.0907 2572        Winmgmt - ok
21:06:48.0985 2572        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
21:06:49.0016 2572        WinRM - ok
21:06:49.0125 2572        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
21:06:49.0156 2572        Wlansvc - ok
21:06:49.0281 2572        wlidsvc        (2bacd71123f42cea603f4e205e1ae337) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
21:06:49.0312 2572        wlidsvc - ok
21:06:49.0422 2572        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
21:06:49.0437 2572        WmiAcpi - ok
21:06:49.0484 2572        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
21:06:49.0500 2572        wmiApSrv - ok
21:06:49.0515 2572        WMPNetworkSvc - ok
21:06:49.0546 2572        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
21:06:49.0562 2572        WPCSvc - ok
21:06:49.0578 2572        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
21:06:49.0593 2572        WPDBusEnum - ok
21:06:49.0609 2572        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
21:06:49.0640 2572        ws2ifsl - ok
21:06:49.0656 2572        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
21:06:49.0671 2572        wscsvc - ok
21:06:49.0671 2572        WSearch - ok
21:06:49.0687 2572        wsvd            (82e8f5aa03df7dbdb8a33f700d5d8cda) C:\Windows\system32\DRIVERS\wsvd.sys
21:06:49.0702 2572        wsvd - ok
21:06:49.0796 2572        wuauserv        (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll
21:06:49.0827 2572        wuauserv - ok
21:06:49.0921 2572        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
21:06:49.0968 2572        WudfPf - ok
21:06:49.0983 2572        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
21:06:49.0999 2572        WUDFRd - ok
21:06:50.0014 2572        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
21:06:50.0046 2572        wudfsvc - ok
21:06:50.0046 2572        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
21:06:50.0061 2572        WwanSvc - ok
21:06:50.0077 2572        MBR (0x1B8)    (4624822e540ec83cd0819525c65846ba) \Device\Harddisk0\DR0
21:06:51.0886 2572        \Device\Harddisk0\DR0 - ok
21:06:51.0886 2572        MBR (0x1B8)    (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk4\DR4
21:06:51.0949 2572        \Device\Harddisk4\DR4 - ok
21:06:51.0980 2572        Boot (0x1200)  (0fde04d6cc1f6e4f54c2f20a73cf1e33) \Device\Harddisk0\DR0\Partition0
21:06:51.0980 2572        \Device\Harddisk0\DR0\Partition0 - ok
21:06:51.0996 2572        Boot (0x1200)  (5bbaa6b6ff12245822fc9b92c2195a83) \Device\Harddisk0\DR0\Partition1
21:06:51.0996 2572        \Device\Harddisk0\DR0\Partition1 - ok
21:06:52.0027 2572        Boot (0x1200)  (05b3e66d96f35d87bf620ed76b6d70d4) \Device\Harddisk0\DR0\Partition2
21:06:52.0027 2572        \Device\Harddisk0\DR0\Partition2 - ok
21:06:52.0027 2572        Boot (0x1200)  (7df5c5e9f9bfd98ef4245e6cf5d598ca) \Device\Harddisk4\DR4\Partition0
21:06:52.0042 2572        \Device\Harddisk4\DR4\Partition0 - ok
21:06:52.0042 2572        Boot (0x1200)  (3984f4922ac71dfe2a1ff7bf23177306) \Device\Harddisk4\DR4\Partition1
21:06:52.0042 2572        \Device\Harddisk4\DR4\Partition1 - ok
21:06:52.0042 2572        ============================================================
21:06:52.0042 2572        Scan finished
21:06:52.0042 2572        ============================================================
21:06:52.0058 3736        Detected object count: 1
21:06:52.0058 3736        Actual detected object count: 1

cosinus 11.08.2012 21:48
Log ist leider unvollständig, die untere Zusammenfassung fehlt

Fontana 11.08.2012 22:37
entschuldige... jetzt komplett:

Code:
21:06:17.0286 4052        TDSS rootkit removing tool 2.7.48.0 Jul 24 2012 13:16:32
21:06:17.0551 4052        ============================================================
21:06:17.0551 4052        Current date / time: 2012/08/11 21:06:17.0551
21:06:17.0551 4052        SystemInfo:
21:06:17.0551 4052       
21:06:17.0551 4052        OS Version: 6.1.7601 ServicePack: 1.0
21:06:17.0551 4052        Product type: Workstation
21:06:17.0551 4052        ComputerName: GW-PC
21:06:17.0551 4052        UserName: GW
21:06:17.0551 4052        Windows directory: C:\Windows
21:06:17.0551 4052        System windows directory: C:\Windows
21:06:17.0551 4052        Running under WOW64
21:06:17.0551 4052        Processor architecture: Intel x64
21:06:17.0551 4052        Number of processors: 4
21:06:17.0551 4052        Page size: 0x1000
21:06:17.0551 4052        Boot type: Normal boot
21:06:17.0551 4052        ============================================================
21:06:17.0847 4052        Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
21:06:17.0863 4052        Drive \Device\Harddisk4\DR4 - Size: 0x1D1C1116000 (1863.02 Gb), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
21:06:17.0910 4052        ============================================================
21:06:17.0910 4052        \Device\Harddisk0\DR0:
21:06:17.0910 4052        MBR partitions:
21:06:17.0910 4052        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
21:06:17.0910 4052        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x6E0D3000
21:06:17.0910 4052        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x6E105800, BlocksNum 0x6400000
21:06:17.0910 4052        \Device\Harddisk4\DR4:
21:06:17.0910 4052        MBR partitions:
21:06:17.0910 4052        \Device\Harddisk4\DR4\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x61A80000
21:06:17.0910 4052        \Device\Harddisk4\DR4\Partition1: MBR, Type 0x7, StartLBA 0x61A80800, BlocksNum 0x87387000
21:06:17.0910 4052        ============================================================
21:06:18.0003 4052        C: <-> \Device\Harddisk0\DR0\Partition1
21:06:18.0066 4052        D: <-> \Device\Harddisk0\DR0\Partition2
21:06:18.0112 4052        I: <-> \Device\Harddisk4\DR4\Partition1
21:06:18.0144 4052        J: <-> \Device\Harddisk4\DR4\Partition0
21:06:18.0144 4052        ============================================================
21:06:18.0144 4052        Initialize success
21:06:18.0144 4052        ============================================================
21:06:28.0830 2572        ============================================================
21:06:28.0830 2572        Scan started
21:06:28.0830 2572        Mode: Manual; SigCheck; TDLFS;
21:06:28.0830 2572        ============================================================
21:06:29.0126 2572        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
21:06:29.0173 2572        1394ohci - ok
21:06:29.0204 2572        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
21:06:29.0220 2572        ACPI - ok
21:06:29.0251 2572        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
21:06:29.0251 2572        AcpiPmi - ok
21:06:29.0376 2572        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
21:06:29.0391 2572        AdobeARMservice - ok
21:06:29.0422 2572        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys
21:06:29.0438 2572        adp94xx - ok
21:06:29.0485 2572        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys
21:06:29.0500 2572        adpahci - ok
21:06:29.0532 2572        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys
21:06:29.0547 2572        adpu320 - ok
21:06:29.0578 2572        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
21:06:29.0610 2572        AeLookupSvc - ok
21:06:29.0672 2572        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
21:06:29.0688 2572        AFD - ok
21:06:29.0734 2572        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
21:06:29.0734 2572        agp440 - ok
21:06:29.0750 2572        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
21:06:29.0766 2572        ALG - ok
21:06:29.0781 2572        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
21:06:29.0797 2572        aliide - ok
21:06:29.0812 2572        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
21:06:29.0828 2572        amdide - ok
21:06:29.0844 2572        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys
21:06:29.0859 2572        AmdK8 - ok
21:06:29.0875 2572        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\drivers\amdppm.sys
21:06:29.0890 2572        AmdPPM - ok
21:06:29.0906 2572        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
21:06:29.0922 2572        amdsata - ok
21:06:29.0953 2572        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys
21:06:29.0968 2572        amdsbs - ok
21:06:29.0968 2572        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
21:06:29.0984 2572        amdxata - ok
21:06:30.0062 2572        AntiVirMailService (b9b5dfafea592bd4ca967824ebb42e3d) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
21:06:30.0078 2572        AntiVirMailService - ok
21:06:30.0140 2572        AntiVirSchedulerService (67b1d78711b4386c26241096326ee14a) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
21:06:30.0140 2572        AntiVirSchedulerService - ok
21:06:30.0156 2572        AntiVirService  (845c4e7ae211edad5e0b832126f56932) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
21:06:30.0171 2572        AntiVirService - ok
21:06:30.0187 2572        AntiVirWebService (30d71e0c149943a8985d02ea0944f2fe) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
21:06:30.0202 2572        AntiVirWebService - ok
21:06:30.0234 2572        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
21:06:30.0249 2572        AppID - ok
21:06:30.0265 2572        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
21:06:30.0296 2572        AppIDSvc - ok
21:06:30.0296 2572        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
21:06:30.0327 2572        Appinfo - ok
21:06:30.0358 2572        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys
21:06:30.0358 2572        arc - ok
21:06:30.0358 2572        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys
21:06:30.0374 2572        arcsas - ok
21:06:30.0405 2572        asmthub3        (d6d2bb2f4f5868549dde75f3146bc84e) C:\Windows\system32\drivers\asmthub3.sys
21:06:30.0421 2572        asmthub3 - ok
21:06:30.0452 2572        asmtxhci        (1e758172367dc2a3653f16586d62a3f0) C:\Windows\system32\drivers\asmtxhci.sys
21:06:30.0468 2572        asmtxhci - ok
21:06:30.0483 2572        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
21:06:30.0514 2572        AsyncMac - ok
21:06:30.0546 2572        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
21:06:30.0561 2572        atapi - ok
21:06:30.0608 2572        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:06:30.0639 2572        AudioEndpointBuilder - ok
21:06:30.0655 2572        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:06:30.0670 2572        AudioSrv - ok
21:06:30.0717 2572        avgntflt        (26e38b5a58c6c55fafbc563eeddb0867) C:\Windows\system32\DRIVERS\avgntflt.sys
21:06:30.0717 2572        avgntflt - ok
21:06:30.0733 2572        avipbb          (9d1f00beff84cbbf46d7f052bc7e0565) C:\Windows\system32\DRIVERS\avipbb.sys
21:06:30.0748 2572        avipbb - ok
21:06:30.0748 2572        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys
21:06:30.0764 2572        avkmgr - ok
21:06:30.0826 2572        AVM WLAN Connection Service (c6f4c466b654c1be98af31418bb5ac30) C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
21:06:30.0842 2572        AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - warning
21:06:30.0842 2572        AVM WLAN Connection Service - detected UnsignedFile.Multi.Generic (1)
21:06:30.0858 2572        avmeject        (1dc2f715792cf33428ad7993acbd224d) C:\Windows\system32\drivers\avmeject.sys
21:06:30.0858 2572        avmeject - ok
21:06:30.0904 2572        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
21:06:30.0904 2572        AxInstSV - ok
21:06:30.0951 2572        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys
21:06:30.0967 2572        b06bdrv - ok
21:06:30.0998 2572        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
21:06:31.0014 2572        b57nd60a - ok
21:06:31.0060 2572        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
21:06:31.0076 2572        BDESVC - ok
21:06:31.0076 2572        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
21:06:31.0123 2572        Beep - ok
21:06:31.0138 2572        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
21:06:31.0170 2572        BFE - ok
21:06:31.0216 2572        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
21:06:31.0248 2572        BITS - ok
21:06:31.0310 2572        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\drivers\blbdrive.sys
21:06:31.0326 2572        blbdrive - ok
21:06:31.0357 2572        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
21:06:31.0372 2572        bowser - ok
21:06:31.0388 2572        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys
21:06:31.0404 2572        BrFiltLo - ok
21:06:31.0419 2572        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys
21:06:31.0435 2572        BrFiltUp - ok
21:06:31.0466 2572        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
21:06:31.0513 2572        Browser - ok
21:06:31.0528 2572        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
21:06:31.0544 2572        Brserid - ok
21:06:31.0560 2572        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
21:06:31.0575 2572        BrSerWdm - ok
21:06:31.0591 2572        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
21:06:31.0606 2572        BrUsbMdm - ok
21:06:31.0606 2572        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
21:06:31.0622 2572        BrUsbSer - ok
21:06:31.0638 2572        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\drivers\bthmodem.sys
21:06:31.0638 2572        BTHMODEM - ok
21:06:31.0684 2572        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
21:06:31.0700 2572        bthserv - ok
21:06:31.0731 2572        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
21:06:31.0747 2572        cdfs - ok
21:06:31.0778 2572        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
21:06:31.0794 2572        cdrom - ok
21:06:31.0809 2572        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:06:31.0825 2572        CertPropSvc - ok
21:06:31.0840 2572        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys
21:06:31.0856 2572        circlass - ok
21:06:31.0887 2572        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
21:06:31.0887 2572        CLFS - ok
21:06:31.0934 2572        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:06:31.0950 2572        clr_optimization_v2.0.50727_32 - ok
21:06:31.0981 2572        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:06:31.0981 2572        clr_optimization_v2.0.50727_64 - ok
21:06:32.0059 2572        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:06:32.0074 2572        clr_optimization_v4.0.30319_32 - ok
21:06:32.0090 2572        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:06:32.0106 2572        clr_optimization_v4.0.30319_64 - ok
21:06:32.0121 2572        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\drivers\CmBatt.sys
21:06:32.0121 2572        CmBatt - ok
21:06:32.0137 2572        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
21:06:32.0152 2572        cmdide - ok
21:06:32.0199 2572        CNG            (9ac4f97c2d3e93367e2148ea940cd2cd) C:\Windows\system32\Drivers\cng.sys
21:06:32.0230 2572        CNG - ok
21:06:32.0262 2572        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\drivers\compbatt.sys
21:06:32.0262 2572        Compbatt - ok
21:06:32.0308 2572        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
21:06:32.0324 2572        CompositeBus - ok
21:06:32.0324 2572        COMSysApp - ok
21:06:32.0340 2572        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys
21:06:32.0355 2572        crcdisk - ok
21:06:32.0386 2572        CryptSvc        (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll
21:06:32.0402 2572        CryptSvc - ok
21:06:32.0449 2572        dc3d            (c7259495924d21f1afa26467d9f4dae0) C:\Windows\system32\DRIVERS\dc3d.sys
21:06:32.0464 2572        dc3d - ok
21:06:32.0496 2572        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:06:32.0527 2572        DcomLaunch - ok
21:06:32.0558 2572        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
21:06:32.0589 2572        defragsvc - ok
21:06:32.0605 2572        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
21:06:32.0636 2572        DfsC - ok
21:06:32.0652 2572        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
21:06:32.0667 2572        Dhcp - ok
21:06:32.0698 2572        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
21:06:32.0714 2572        discache - ok
21:06:32.0761 2572        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys
21:06:32.0776 2572        Disk - ok
21:06:32.0808 2572        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
21:06:32.0823 2572        Dnscache - ok
21:06:32.0870 2572        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
21:06:32.0901 2572        dot3svc - ok
21:06:32.0901 2572        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
21:06:32.0917 2572        DPS - ok
21:06:32.0964 2572        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
21:06:32.0964 2572        drmkaud - ok
21:06:33.0010 2572        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
21:06:33.0042 2572        DXGKrnl - ok
21:06:33.0057 2572        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
21:06:33.0088 2572        EapHost - ok
21:06:33.0182 2572        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys
21:06:33.0213 2572        ebdrv - ok
21:06:33.0307 2572        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
21:06:33.0322 2572        EFS - ok
21:06:33.0385 2572        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
21:06:33.0400 2572        ehRecvr - ok
21:06:33.0416 2572        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
21:06:33.0432 2572        ehSched - ok
21:06:33.0494 2572        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys
21:06:33.0525 2572        elxstor - ok
21:06:33.0525 2572        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
21:06:33.0541 2572        ErrDev - ok
21:06:33.0588 2572        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
21:06:33.0619 2572        EventSystem - ok
21:06:33.0650 2572        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
21:06:33.0666 2572        exfat - ok
21:06:33.0681 2572        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
21:06:33.0697 2572        fastfat - ok
21:06:33.0728 2572        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
21:06:33.0744 2572        Fax - ok
21:06:33.0775 2572        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys
21:06:33.0775 2572        fdc - ok
21:06:33.0775 2572        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
21:06:33.0806 2572        fdPHost - ok
21:06:33.0822 2572        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
21:06:33.0837 2572        FDResPub - ok
21:06:33.0868 2572        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
21:06:33.0868 2572        FileInfo - ok
21:06:33.0884 2572        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
21:06:33.0915 2572        Filetrace - ok
21:06:33.0993 2572        FLEXnet Licensing Service (1f63900e2eb00101b9aca2b7a870704e) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
21:06:34.0009 2572        FLEXnet Licensing Service - ok
21:06:34.0040 2572        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys
21:06:34.0056 2572        flpydisk - ok
21:06:34.0087 2572        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
21:06:34.0102 2572        FltMgr - ok
21:06:34.0165 2572        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
21:06:34.0196 2572        FontCache - ok
21:06:34.0258 2572        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:06:34.0274 2572        FontCache3.0.0.0 - ok
21:06:34.0305 2572        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
21:06:34.0321 2572        FsDepends - ok
21:06:34.0352 2572        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
21:06:34.0352 2572        Fs_Rec - ok
21:06:34.0383 2572        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
21:06:34.0399 2572        fvevol - ok
21:06:34.0446 2572        fwlanusbn      (15585492e45e2f30768b2d5b57929d99) C:\Windows\system32\DRIVERS\fwlanusbn.sys
21:06:34.0461 2572        fwlanusbn - ok
21:06:34.0492 2572        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys
21:06:34.0508 2572        gagp30kx - ok
21:06:34.0555 2572        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
21:06:34.0586 2572        gpsvc - ok
21:06:34.0617 2572        gupdate - ok
21:06:34.0617 2572        gupdatem - ok
21:06:34.0648 2572        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
21:06:34.0664 2572        hcw85cir - ok
21:06:34.0711 2572        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
21:06:34.0726 2572        HdAudAddService - ok
21:06:34.0773 2572        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
21:06:34.0789 2572        HDAudBus - ok
21:06:34.0804 2572        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys
21:06:34.0820 2572        HidBatt - ok
21:06:34.0836 2572        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys
21:06:34.0851 2572        HidBth - ok
21:06:34.0882 2572        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys
21:06:34.0898 2572        HidIr - ok
21:06:34.0914 2572        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
21:06:34.0929 2572        hidserv - ok
21:06:34.0976 2572        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
21:06:34.0976 2572        HidUsb - ok
21:06:34.0992 2572        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
21:06:35.0023 2572        hkmsvc - ok
21:06:35.0023 2572        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
21:06:35.0038 2572        HomeGroupListener - ok
21:06:35.0054 2572        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
21:06:35.0070 2572        HomeGroupProvider - ok
21:06:35.0070 2572        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
21:06:35.0085 2572        HpSAMD - ok
21:06:35.0132 2572        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
21:06:35.0179 2572        HTTP - ok
21:06:35.0179 2572        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
21:06:35.0194 2572        hwpolicy - ok
21:06:35.0226 2572        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
21:06:35.0241 2572        i8042prt - ok
21:06:35.0272 2572        iaStor          (2fdaec4b02729c48c0fd1b0b4695995b) C:\Windows\system32\drivers\iaStor.sys
21:06:35.0304 2572        iaStor - ok
21:06:35.0366 2572        IAStorDataMgrSvc (d41861e56e7552c13674d7f147a02464) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
21:06:35.0382 2572        IAStorDataMgrSvc - ok
21:06:35.0413 2572        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
21:06:35.0444 2572        iaStorV - ok
21:06:35.0522 2572        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:06:35.0538 2572        idsvc - ok
21:06:35.0725 2572        igfx            (a87261ef1546325b559374f5689cf5bc) C:\Windows\system32\DRIVERS\igdkmd64.sys
21:06:35.0787 2572        igfx - ok
21:06:35.0896 2572        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys
21:06:35.0896 2572        iirsp - ok
21:06:35.0959 2572        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
21:06:35.0990 2572        IKEEXT - ok
21:06:36.0130 2572        IntcAzAudAddService (cb7dadef3d83fe2c12655a0bdcba99f2) C:\Windows\system32\drivers\RTKVHD64.sys
21:06:36.0162 2572        IntcAzAudAddService - ok
21:06:36.0255 2572        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
21:06:36.0271 2572        intelide - ok
21:06:36.0286 2572        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
21:06:36.0302 2572        intelppm - ok
21:06:36.0318 2572        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
21:06:36.0349 2572        IPBusEnum - ok
21:06:36.0364 2572        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:06:36.0396 2572        IpFilterDriver - ok
21:06:36.0411 2572        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
21:06:36.0442 2572        iphlpsvc - ok
21:06:36.0474 2572        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
21:06:36.0474 2572        IPMIDRV - ok
21:06:36.0474 2572        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
21:06:36.0505 2572        IPNAT - ok
21:06:36.0505 2572        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
21:06:36.0520 2572        IRENUM - ok
21:06:36.0536 2572        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
21:06:36.0552 2572        isapnp - ok
21:06:36.0567 2572        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
21:06:36.0598 2572        iScsiPrt - ok
21:06:36.0614 2572        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
21:06:36.0630 2572        kbdclass - ok
21:06:36.0645 2572        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
21:06:36.0645 2572        kbdhid - ok
21:06:36.0676 2572        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:06:36.0692 2572        KeyIso - ok
21:06:36.0723 2572        KSecDD          (97a7070aea4c058b6418519e869a63b4) C:\Windows\system32\Drivers\ksecdd.sys
21:06:36.0739 2572        KSecDD - ok
21:06:36.0754 2572        KSecPkg        (26c43a7c2862447ec59deda188d1da07) C:\Windows\system32\Drivers\ksecpkg.sys
21:06:36.0770 2572        KSecPkg - ok
21:06:36.0786 2572        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
21:06:36.0817 2572        ksthunk - ok
21:06:36.0848 2572        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
21:06:36.0864 2572        KtmRm - ok
21:06:36.0895 2572        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
21:06:36.0926 2572        LanmanServer - ok
21:06:36.0942 2572        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
21:06:36.0973 2572        LanmanWorkstation - ok
21:06:37.0004 2572        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
21:06:37.0020 2572        lltdio - ok
21:06:37.0051 2572        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
21:06:37.0082 2572        lltdsvc - ok
21:06:37.0082 2572        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
21:06:37.0113 2572        lmhosts - ok
21:06:37.0191 2572        LMS            (1584deeae5aa0e3fb045f3d0eac585ea) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
21:06:37.0207 2572        LMS - ok
21:06:37.0238 2572        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys
21:06:37.0254 2572        LSI_FC - ok
21:06:37.0285 2572        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys
21:06:37.0300 2572        LSI_SAS - ok
21:06:37.0332 2572        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys
21:06:37.0332 2572        LSI_SAS2 - ok
21:06:37.0363 2572        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys
21:06:37.0378 2572        LSI_SCSI - ok
21:06:37.0410 2572        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
21:06:37.0456 2572        luafv - ok
21:06:37.0488 2572        MBAMProtector  (dc8490812a3b72811ae534f423b4c206) C:\Windows\system32\drivers\mbam.sys
21:06:37.0503 2572        MBAMProtector - ok
21:06:37.0550 2572        MBAMService    (43683e970f008c93c9429ef428147a54) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
21:06:37.0566 2572        MBAMService - ok
21:06:37.0597 2572        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
21:06:37.0612 2572        Mcx2Svc - ok
21:06:37.0628 2572        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys
21:06:37.0644 2572        megasas - ok
21:06:37.0675 2572        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys
21:06:37.0706 2572        MegaSR - ok
21:06:37.0722 2572        MEIx64          (a6518dcc42f7a6e999bb3bea8fd87567) C:\Windows\system32\drivers\HECIx64.sys
21:06:37.0737 2572        MEIx64 - ok
21:06:37.0784 2572        MemeoBackgroundService (8a43d23ace2e8c95a2d87b6e9599deda) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
21:06:37.0800 2572        MemeoBackgroundService - ok
21:06:37.0815 2572        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:06:37.0846 2572        MMCSS - ok
21:06:37.0862 2572        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
21:06:37.0893 2572        Modem - ok
21:06:37.0909 2572        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
21:06:37.0909 2572        monitor - ok
21:06:37.0940 2572        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
21:06:37.0956 2572        mouclass - ok
21:06:37.0971 2572        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
21:06:37.0987 2572        mouhid - ok
21:06:38.0018 2572        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
21:06:38.0034 2572        mountmgr - ok
21:06:38.0049 2572        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
21:06:38.0065 2572        mpio - ok
21:06:38.0065 2572        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
21:06:38.0096 2572        mpsdrv - ok
21:06:38.0127 2572        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
21:06:38.0158 2572        MpsSvc - ok
21:06:38.0190 2572        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
21:06:38.0190 2572        MRxDAV - ok
21:06:38.0221 2572        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
21:06:38.0236 2572        mrxsmb - ok
21:06:38.0252 2572        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:06:38.0268 2572        mrxsmb10 - ok
21:06:38.0283 2572        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:06:38.0283 2572        mrxsmb20 - ok
21:06:38.0299 2572        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
21:06:38.0314 2572        msahci - ok
21:06:38.0330 2572        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
21:06:38.0346 2572        msdsm - ok
21:06:38.0361 2572        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
21:06:38.0377 2572        MSDTC - ok
21:06:38.0392 2572        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
21:06:38.0408 2572        Msfs - ok
21:06:38.0439 2572        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
21:06:38.0455 2572        mshidkmdf - ok
21:06:38.0470 2572        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
21:06:38.0470 2572        msisadrv - ok
21:06:38.0486 2572        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
21:06:38.0517 2572        MSiSCSI - ok
21:06:38.0517 2572        msiserver - ok
21:06:38.0548 2572        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
21:06:38.0564 2572        MSKSSRV - ok
21:06:38.0580 2572        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
21:06:38.0611 2572        MSPCLOCK - ok
21:06:38.0611 2572        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
21:06:38.0626 2572        MSPQM - ok
21:06:38.0642 2572        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
21:06:38.0658 2572        MsRPC - ok
21:06:38.0673 2572        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
21:06:38.0673 2572        mssmbios - ok
21:06:38.0673 2572        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
21:06:38.0704 2572        MSTEE - ok
21:06:38.0720 2572        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys
21:06:38.0720 2572        MTConfig - ok
21:06:38.0736 2572        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
21:06:38.0751 2572        Mup - ok
21:06:38.0782 2572        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
21:06:38.0798 2572        napagent - ok
21:06:38.0829 2572        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
21:06:38.0845 2572        NativeWifiP - ok
21:06:38.0892 2572        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
21:06:38.0923 2572        NDIS - ok
21:06:38.0923 2572        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
21:06:38.0954 2572        NdisCap - ok
21:06:38.0970 2572        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
21:06:38.0985 2572        NdisTapi - ok
21:06:39.0016 2572        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
21:06:39.0032 2572        Ndisuio - ok
21:06:39.0063 2572        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
21:06:39.0079 2572        NdisWan - ok
21:06:39.0094 2572        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
21:06:39.0126 2572        NDProxy - ok
21:06:39.0126 2572        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
21:06:39.0141 2572        NetBIOS - ok
21:06:39.0157 2572        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
21:06:39.0172 2572        NetBT - ok
21:06:39.0219 2572        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:06:39.0235 2572        Netlogon - ok
21:06:39.0266 2572        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
21:06:39.0313 2572        Netman - ok
21:06:39.0328 2572        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
21:06:39.0360 2572        netprofm - ok
21:06:39.0422 2572        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
21:06:39.0438 2572        NetTcpPortSharing - ok
21:06:39.0453 2572        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys
21:06:39.0469 2572        nfrd960 - ok
21:06:39.0500 2572        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
21:06:39.0531 2572        NlaSvc - ok
21:06:39.0547 2572        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
21:06:39.0562 2572        Npfs - ok
21:06:39.0578 2572        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
21:06:39.0594 2572        nsi - ok
21:06:39.0609 2572        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
21:06:39.0625 2572        nsiproxy - ok
21:06:39.0703 2572        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
21:06:39.0734 2572        Ntfs - ok
21:06:39.0828 2572        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
21:06:39.0859 2572        Null - ok
21:06:39.0906 2572        NVENETFD        (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys
21:06:39.0921 2572        NVENETFD - ok
21:06:39.0968 2572        NVHDA          (102806b360d0e6bc6e55bf47ef655d43) C:\Windows\system32\drivers\nvhda64v.sys
21:06:39.0984 2572        NVHDA - ok
21:06:40.0374 2572        nvlddmkm        (ba0b4889c40380a01ecdf84c227a89c9) C:\Windows\system32\DRIVERS\nvlddmkm.sys
21:06:40.0530 2572        nvlddmkm - ok
21:06:40.0623 2572        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
21:06:40.0639 2572        nvraid - ok
21:06:40.0654 2572        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
21:06:40.0670 2572        nvstor - ok
21:06:40.0717 2572        nvsvc          (06633cf95bea62164c3bfca24bce6b11) C:\Windows\system32\nvvsvc.exe
21:06:40.0748 2572        nvsvc - ok
21:06:40.0842 2572        nvUpdatusService (53b629ce436b110c5689c2f6439e567b) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
21:06:40.0873 2572        nvUpdatusService - ok
21:06:40.0966 2572        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
21:06:40.0982 2572        nv_agp - ok
21:06:41.0076 2572        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
21:06:41.0091 2572        odserv - ok
21:06:41.0122 2572        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
21:06:41.0138 2572        ohci1394 - ok
21:06:41.0154 2572        ose            (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:06:41.0169 2572        ose - ok
21:06:41.0200 2572        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:06:41.0216 2572        p2pimsvc - ok
21:06:41.0232 2572        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
21:06:41.0247 2572        p2psvc - ok
21:06:41.0278 2572        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys
21:06:41.0278 2572        Parport - ok
21:06:41.0310 2572        partmgr        (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
21:06:41.0310 2572        partmgr - ok
21:06:41.0325 2572        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
21:06:41.0341 2572        PcaSvc - ok
21:06:41.0356 2572        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
21:06:41.0356 2572        pci - ok
21:06:41.0372 2572        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
21:06:41.0388 2572        pciide - ok
21:06:41.0419 2572        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys
21:06:41.0419 2572        pcmcia - ok
21:06:41.0434 2572        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
21:06:41.0450 2572        pcw - ok
21:06:41.0481 2572        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
21:06:41.0512 2572        PEAUTH - ok
21:06:41.0575 2572        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
21:06:41.0590 2572        PerfHost - ok
21:06:41.0637 2572        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
21:06:41.0684 2572        pla - ok
21:06:41.0731 2572        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
21:06:41.0746 2572        PlugPlay - ok
21:06:41.0778 2572        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
21:06:41.0793 2572        PNRPAutoReg - ok
21:06:41.0809 2572        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:06:41.0824 2572        PNRPsvc - ok
21:06:41.0871 2572        Point64        (32d374c60778253b81fa76c2fe19e155) C:\Windows\system32\DRIVERS\point64.sys
21:06:41.0887 2572        Point64 - ok
21:06:41.0918 2572        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
21:06:41.0965 2572        PolicyAgent - ok
21:06:41.0996 2572        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
21:06:42.0012 2572        Power - ok
21:06:42.0043 2572        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
21:06:42.0074 2572        PptpMiniport - ok
21:06:42.0090 2572        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys
21:06:42.0105 2572        Processor - ok
21:06:42.0136 2572        ProfSvc        (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll
21:06:42.0152 2572        ProfSvc - ok
21:06:42.0168 2572        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:06:42.0183 2572        ProtectedStorage - ok
21:06:42.0214 2572        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
21:06:42.0230 2572        Psched - ok
21:06:42.0292 2572        PSI_SVC_2      (543a4ef0923bf70d126625b034ef25af) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
21:06:42.0308 2572        PSI_SVC_2 - ok
21:06:42.0386 2572        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys
21:06:42.0417 2572        ql2300 - ok
21:06:42.0480 2572        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys
21:06:42.0495 2572        ql40xx - ok
21:06:42.0511 2572        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
21:06:42.0542 2572        QWAVE - ok
21:06:42.0558 2572        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
21:06:42.0573 2572        QWAVEdrv - ok
21:06:42.0573 2572        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
21:06:42.0604 2572        RasAcd - ok
21:06:42.0620 2572        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
21:06:42.0636 2572        RasAgileVpn - ok
21:06:42.0651 2572        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
21:06:42.0682 2572        RasAuto - ok
21:06:42.0682 2572        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
21:06:42.0714 2572        Rasl2tp - ok
21:06:42.0729 2572        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
21:06:42.0760 2572        RasMan - ok
21:06:42.0760 2572        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
21:06:42.0776 2572        RasPppoe - ok
21:06:42.0792 2572        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
21:06:42.0823 2572        RasSstp - ok
21:06:42.0838 2572        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
21:06:42.0854 2572        rdbss - ok
21:06:42.0885 2572        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\drivers\rdpbus.sys
21:06:42.0885 2572        rdpbus - ok
21:06:42.0901 2572        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
21:06:42.0916 2572        RDPCDD - ok
21:06:42.0932 2572        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
21:06:42.0948 2572        RDPENCDD - ok
21:06:42.0963 2572        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
21:06:42.0994 2572        RDPREFMP - ok
21:06:43.0026 2572        RDPWD          (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys
21:06:43.0041 2572        RDPWD - ok
21:06:43.0088 2572        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
21:06:43.0104 2572        rdyboost - ok
21:06:43.0119 2572        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
21:06:43.0150 2572        RemoteAccess - ok
21:06:43.0166 2572        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
21:06:43.0197 2572        RemoteRegistry - ok
21:06:43.0197 2572        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
21:06:43.0213 2572        RpcEptMapper - ok
21:06:43.0228 2572        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
21:06:43.0228 2572        RpcLocator - ok
21:06:43.0244 2572        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:06:43.0275 2572        RpcSs - ok
21:06:43.0291 2572        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
21:06:43.0306 2572        rspndr - ok
21:06:43.0369 2572        RTL8167        (ee082e06a82ff630351d1e0ebbd3d8d0) C:\Windows\system32\DRIVERS\Rt64win7.sys
21:06:43.0384 2572        RTL8167 - ok
21:06:43.0447 2572        RTL8192su      (b3f36b4b3f192ea87ddc119f3a0b3e45) C:\Windows\system32\DRIVERS\RTL8192su.sys
21:06:43.0478 2572        RTL8192su - ok
21:06:43.0478 2572        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:06:43.0494 2572        SamSs - ok
21:06:43.0509 2572        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
21:06:43.0525 2572        sbp2port - ok
21:06:43.0540 2572        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
21:06:43.0556 2572        SCardSvr - ok
21:06:43.0587 2572        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
21:06:43.0603 2572        scfilter - ok
21:06:43.0634 2572        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
21:06:43.0665 2572        Schedule - ok
21:06:43.0681 2572        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:06:43.0712 2572        SCPolicySvc - ok
21:06:43.0728 2572        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
21:06:43.0728 2572        SDRSVC - ok
21:06:43.0774 2572        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
21:06:43.0790 2572        secdrv - ok
21:06:43.0821 2572        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
21:06:43.0837 2572        seclogon - ok
21:06:43.0852 2572        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
21:06:43.0868 2572        SENS - ok
21:06:43.0884 2572        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
21:06:43.0899 2572        SensrSvc - ok
21:06:43.0915 2572        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\drivers\serenum.sys
21:06:43.0930 2572        Serenum - ok
21:06:43.0946 2572        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys
21:06:43.0946 2572        Serial - ok
21:06:43.0962 2572        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys
21:06:43.0962 2572        sermouse - ok
21:06:43.0993 2572        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
21:06:44.0008 2572        SessionEnv - ok
21:06:44.0024 2572        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
21:06:44.0040 2572        sffdisk - ok
21:06:44.0055 2572        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
21:06:44.0055 2572        sffp_mmc - ok
21:06:44.0071 2572        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
21:06:44.0071 2572        sffp_sd - ok
21:06:44.0118 2572        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys
21:06:44.0118 2572        sfloppy - ok
21:06:44.0149 2572        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
21:06:44.0180 2572        SharedAccess - ok
21:06:44.0211 2572        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
21:06:44.0258 2572        ShellHWDetection - ok
21:06:44.0274 2572        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys
21:06:44.0289 2572        SiSRaid2 - ok
21:06:44.0289 2572        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys
21:06:44.0305 2572        SiSRaid4 - ok
21:06:44.0336 2572        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
21:06:44.0383 2572        Smb - ok
21:06:44.0414 2572        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
21:06:44.0414 2572        SNMPTRAP - ok
21:06:44.0430 2572        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
21:06:44.0430 2572        spldr - ok
21:06:44.0461 2572        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
21:06:44.0492 2572        Spooler - ok
21:06:44.0601 2572        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
21:06:44.0648 2572        sppsvc - ok
21:06:44.0710 2572        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
21:06:44.0742 2572        sppuinotify - ok
21:06:44.0804 2572        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
21:06:44.0835 2572        srv - ok
21:06:44.0851 2572        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
21:06:44.0851 2572        srv2 - ok
21:06:44.0882 2572        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
21:06:44.0882 2572        srvnet - ok
21:06:44.0929 2572        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
21:06:44.0960 2572        SSDPSRV - ok
21:06:44.0960 2572        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
21:06:44.0991 2572        SstpSvc - ok
21:06:45.0069 2572        Stereo Service  (c354621b6b94e10ae7f5cdbe745feb86) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
21:06:45.0085 2572        Stereo Service - ok
21:06:45.0116 2572        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys
21:06:45.0116 2572        stexstor - ok
21:06:45.0163 2572        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
21:06:45.0194 2572        stisvc - ok
21:06:45.0210 2572        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
21:06:45.0210 2572        swenum - ok
21:06:45.0256 2572        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
21:06:45.0303 2572        swprv - ok
21:06:45.0366 2572        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
21:06:45.0397 2572        SysMain - ok
21:06:45.0459 2572        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
21:06:45.0490 2572        TabletInputService - ok
21:06:45.0490 2572        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
21:06:45.0522 2572        TapiSrv - ok
21:06:45.0522 2572        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
21:06:45.0553 2572        TBS - ok
21:06:45.0662 2572        Tcpip          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
21:06:45.0693 2572        Tcpip - ok
21:06:45.0771 2572        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
21:06:45.0802 2572        TCPIP6 - ok
21:06:45.0834 2572        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
21:06:45.0849 2572        tcpipreg - ok
21:06:45.0865 2572        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
21:06:45.0880 2572        TDPIPE - ok
21:06:45.0896 2572        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
21:06:45.0896 2572        TDTCP - ok
21:06:45.0927 2572        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
21:06:45.0943 2572        tdx - ok
21:06:45.0974 2572        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
21:06:45.0974 2572        TermDD - ok
21:06:46.0005 2572        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
21:06:46.0036 2572        TermService - ok
21:06:46.0036 2572        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
21:06:46.0052 2572        Themes - ok
21:06:46.0068 2572        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:06:46.0083 2572        THREADORDER - ok
21:06:46.0099 2572        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
21:06:46.0114 2572        TrkWks - ok
21:06:46.0161 2572        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
21:06:46.0208 2572        TrustedInstaller - ok
21:06:46.0224 2572        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
21:06:46.0270 2572        tssecsrv - ok
21:06:46.0286 2572        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
21:06:46.0286 2572        TsUsbFlt - ok
21:06:46.0317 2572        TsUsbGD        (9cc2ccae8a84820eaecb886d477cbcb8) C:\Windows\system32\drivers\TsUsbGD.sys
21:06:46.0317 2572        TsUsbGD - ok
21:06:46.0333 2572        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
21:06:46.0364 2572        tunnel - ok
21:06:46.0380 2572        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys
21:06:46.0395 2572        uagp35 - ok
21:06:46.0411 2572        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
21:06:46.0426 2572        udfs - ok
21:06:46.0442 2572        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
21:06:46.0458 2572        UI0Detect - ok
21:06:46.0489 2572        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
21:06:46.0504 2572        uliagpkx - ok
21:06:46.0520 2572        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
21:06:46.0536 2572        umbus - ok
21:06:46.0551 2572        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys
21:06:46.0551 2572        UmPass - ok
21:06:46.0692 2572        UNS            (fc43877b4625f6eb773c98233eb625c5) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
21:06:46.0723 2572        UNS - ok
21:06:46.0816 2572        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
21:06:46.0848 2572        upnphost - ok
21:06:46.0879 2572        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
21:06:46.0894 2572        usbccgp - ok
21:06:46.0926 2572        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
21:06:46.0941 2572        usbcir - ok
21:06:46.0941 2572        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
21:06:46.0957 2572        usbehci - ok
21:06:46.0972 2572        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
21:06:46.0988 2572        usbhub - ok
21:06:47.0004 2572        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
21:06:47.0019 2572        usbohci - ok
21:06:47.0035 2572        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
21:06:47.0050 2572        usbprint - ok
21:06:47.0082 2572        usbscan        (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
21:06:47.0082 2572        usbscan - ok
21:06:47.0113 2572        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:06:47.0113 2572        USBSTOR - ok
21:06:47.0144 2572        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
21:06:47.0144 2572        usbuhci - ok
21:06:47.0175 2572        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
21:06:47.0191 2572        UxSms - ok
21:06:47.0238 2572        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:06:47.0238 2572        VaultSvc - ok
21:06:47.0269 2572        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
21:06:47.0269 2572        vdrvroot - ok
21:06:47.0300 2572        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
21:06:47.0331 2572        vds - ok
21:06:47.0362 2572        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
21:06:47.0378 2572        vga - ok
21:06:47.0394 2572        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
21:06:47.0425 2572        VgaSave - ok
21:06:47.0456 2572        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
21:06:47.0456 2572        vhdmp - ok
21:06:47.0487 2572        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
21:06:47.0503 2572        viaide - ok
21:06:47.0518 2572        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
21:06:47.0518 2572        volmgr - ok
21:06:47.0550 2572        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
21:06:47.0565 2572        volmgrx - ok
21:06:47.0596 2572        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
21:06:47.0612 2572        volsnap - ok
21:06:47.0628 2572        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys
21:06:47.0643 2572        vsmraid - ok
21:06:47.0706 2572        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
21:06:47.0752 2572        VSS - ok
21:06:47.0846 2572        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
21:06:47.0862 2572        vwifibus - ok
21:06:47.0877 2572        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
21:06:47.0893 2572        vwififlt - ok
21:06:47.0924 2572        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
21:06:47.0955 2572        W32Time - ok
21:06:47.0971 2572        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys
21:06:47.0986 2572        WacomPen - ok
21:06:48.0018 2572        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:06:48.0049 2572        WANARP - ok
21:06:48.0049 2572        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:06:48.0080 2572        Wanarpv6 - ok
21:06:48.0158 2572        WatAdminSvc    (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
21:06:48.0189 2572        WatAdminSvc - ok
21:06:48.0252 2572        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
21:06:48.0267 2572        wbengine - ok
21:06:48.0345 2572        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
21:06:48.0361 2572        WbioSrvc - ok
21:06:48.0376 2572        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
21:06:48.0392 2572        wcncsvc - ok
21:06:48.0408 2572        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
21:06:48.0408 2572        WcsPlugInService - ok
21:06:48.0454 2572        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys
21:06:48.0470 2572        Wd - ok
21:06:48.0517 2572        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
21:06:48.0532 2572        Wdf01000 - ok
21:06:48.0548 2572        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:06:48.0548 2572        WdiServiceHost - ok
21:06:48.0548 2572        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:06:48.0564 2572        WdiSystemHost - ok
21:06:48.0595 2572        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
21:06:48.0610 2572        WebClient - ok
21:06:48.0610 2572        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
21:06:48.0642 2572        Wecsvc - ok
21:06:48.0642 2572        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
21:06:48.0657 2572        wercplsupport - ok
21:06:48.0673 2572        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
21:06:48.0704 2572        WerSvc - ok
21:06:48.0735 2572        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
21:06:48.0782 2572        WfpLwf - ok
21:06:48.0782 2572        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
21:06:48.0798 2572        WIMMount - ok
21:06:48.0829 2572        WinDefend - ok
21:06:48.0829 2572        WinHttpAutoProxySvc - ok
21:06:48.0876 2572        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
21:06:48.0907 2572        Winmgmt - ok
21:06:48.0985 2572        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
21:06:49.0016 2572        WinRM - ok
21:06:49.0125 2572        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
21:06:49.0156 2572        Wlansvc - ok
21:06:49.0281 2572        wlidsvc        (2bacd71123f42cea603f4e205e1ae337) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
21:06:49.0312 2572        wlidsvc - ok
21:06:49.0422 2572        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
21:06:49.0437 2572        WmiAcpi - ok
21:06:49.0484 2572        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
21:06:49.0500 2572        wmiApSrv - ok
21:06:49.0515 2572        WMPNetworkSvc - ok
21:06:49.0546 2572        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
21:06:49.0562 2572        WPCSvc - ok
21:06:49.0578 2572        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
21:06:49.0593 2572        WPDBusEnum - ok
21:06:49.0609 2572        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
21:06:49.0640 2572        ws2ifsl - ok
21:06:49.0656 2572        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
21:06:49.0671 2572        wscsvc - ok
21:06:49.0671 2572        WSearch - ok
21:06:49.0687 2572        wsvd            (82e8f5aa03df7dbdb8a33f700d5d8cda) C:\Windows\system32\DRIVERS\wsvd.sys
21:06:49.0702 2572        wsvd - ok
21:06:49.0796 2572        wuauserv        (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll
21:06:49.0827 2572        wuauserv - ok
21:06:49.0921 2572        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
21:06:49.0968 2572        WudfPf - ok
21:06:49.0983 2572        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
21:06:49.0999 2572        WUDFRd - ok
21:06:50.0014 2572        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
21:06:50.0046 2572        wudfsvc - ok
21:06:50.0046 2572        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
21:06:50.0061 2572        WwanSvc - ok
21:06:50.0077 2572        MBR (0x1B8)    (4624822e540ec83cd0819525c65846ba) \Device\Harddisk0\DR0
21:06:51.0886 2572        \Device\Harddisk0\DR0 - ok
21:06:51.0886 2572        MBR (0x1B8)    (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk4\DR4
21:06:51.0949 2572        \Device\Harddisk4\DR4 - ok
21:06:51.0980 2572        Boot (0x1200)  (0fde04d6cc1f6e4f54c2f20a73cf1e33) \Device\Harddisk0\DR0\Partition0
21:06:51.0980 2572        \Device\Harddisk0\DR0\Partition0 - ok
21:06:51.0996 2572        Boot (0x1200)  (5bbaa6b6ff12245822fc9b92c2195a83) \Device\Harddisk0\DR0\Partition1
21:06:51.0996 2572        \Device\Harddisk0\DR0\Partition1 - ok
21:06:52.0027 2572        Boot (0x1200)  (05b3e66d96f35d87bf620ed76b6d70d4) \Device\Harddisk0\DR0\Partition2
21:06:52.0027 2572        \Device\Harddisk0\DR0\Partition2 - ok
21:06:52.0027 2572        Boot (0x1200)  (7df5c5e9f9bfd98ef4245e6cf5d598ca) \Device\Harddisk4\DR4\Partition0
21:06:52.0042 2572        \Device\Harddisk4\DR4\Partition0 - ok
21:06:52.0042 2572        Boot (0x1200)  (3984f4922ac71dfe2a1ff7bf23177306) \Device\Harddisk4\DR4\Partition1
21:06:52.0042 2572        \Device\Harddisk4\DR4\Partition1 - ok
21:06:52.0042 2572        ============================================================
21:06:52.0042 2572        Scan finished
21:06:52.0042 2572        ============================================================
21:06:52.0058 3736        Detected object count: 1
21:06:52.0058 3736        Actual detected object count: 1
21:36:51.0907 3736        AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - skipped by user
21:36:51.0907 3736        AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:37:17.0912 4060        Deinitialize success

cosinus 12.08.2012 13:12
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Fontana 12.08.2012 13:44
Hier der nächste Riesencode. Der IE geht jetzt nicht mehr, vermiss ihn aber nicht; werde mal versuchen "von Hand ?!" zu starten

Code:
Combofix Logfile:

       
Code:

       
ComboFix 12-08-10.02 - MaxMustermann 12.08.2012  14:21:28.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4078.2513 [GMT 2:00]
ausgeführt von:: c:\users\MaxMustermann\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-07-12 bis 2012-08-12  ))))))))))))))))))))))))))))))
.
.
2012-08-12 12:25 . 2012-08-12 12:25        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-08-10 20:25 . 2012-08-10 20:25        --------        d-----w-        C:\_OTL
2012-08-10 08:21 . 2012-07-16 00:40        9133488        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{2FB299A6-94FA-4D9F-9BBA-30513F32BBC6}\mpengine.dll
2012-08-09 07:33 . 2012-08-09 07:33        --------        d-----w-        c:\program files\Microsoft Device Center
2012-08-05 20:05 . 2012-08-05 20:05        --------        d-----w-        c:\program files (x86)\ESET
2012-08-03 21:45 . 2012-08-04 20:42        --------        d-----w-        c:\program files (x86)\MozBackup
2012-08-02 19:45 . 2012-08-02 19:45        --------        d-----w-        c:\windows\de
2012-08-02 19:45 . 2012-08-02 19:45        --------        d-----w-        c:\windows\da
2012-08-02 19:44 . 2012-08-02 19:44        --------        d-----w-        c:\windows\el
2012-08-02 19:43 . 2012-08-02 19:43        --------        d-----w-        c:\windows\en
2012-08-02 19:42 . 2012-08-02 19:42        --------        d-----w-        c:\windows\es
2012-08-02 19:42 . 2012-08-02 19:42        --------        d-----w-        c:\windows\fr
2012-08-02 19:41 . 2012-08-02 19:41        --------        d-----w-        c:\windows\hu
2012-08-02 19:40 . 2012-08-02 19:40        --------        d-----w-        c:\windows\it
2012-08-02 19:39 . 2012-08-02 19:39        --------        d-----w-        c:\windows\nl
2012-08-02 19:39 . 2012-08-02 19:39        --------        d-----w-        c:\windows\pl
2012-08-02 19:38 . 2012-08-02 19:38        --------        d-----w-        c:\windows\sl
2012-08-02 19:37 . 2012-08-02 19:37        --------        d-----w-        c:\windows\tr
2012-08-02 19:34 . 2012-08-02 19:34        89944        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\d855eb161cd70e501\DSETUP.dll
2012-08-02 19:34 . 2012-08-02 19:34        537432        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\d855eb161cd70e501\DXSETUP.exe
2012-08-02 19:34 . 2012-08-02 19:34        1801048        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\d855eb161cd70e501\dsetup32.dll
2012-08-02 17:52 . 2012-08-02 17:52        --------        d-----w-        c:\program files (x86)\avmwlanstick
2012-08-02 17:51 . 2012-08-02 17:51        --------        d-----w-        c:\program files (x86)\AVM_update
2012-08-02 12:19 . 2012-06-30 06:46        95744        ----a-w-        c:\windows\system32\pdfcmon.dll
2012-08-02 12:19 . 2012-05-05 09:54        662288        ----a-w-        c:\windows\SysWow64\MSCOMCT2.OCX
2012-08-02 12:19 . 2012-05-05 09:54        137000        ----a-w-        c:\windows\SysWow64\MSMAPI32.OCX
2012-08-02 12:19 . 2012-08-02 12:19        --------        d-----w-        c:\program files (x86)\PDFCreator
2012-08-02 12:19 . 2012-05-05 09:54        23552        ----a-w-        c:\windows\SysWow64\MSMPIDE.DLL
2012-08-02 12:19 . 1998-07-06 16:56        125712        ----a-w-        c:\windows\SysWow64\VB6DE.DLL
2012-08-02 12:19 . 1998-07-06 16:55        158208        ----a-w-        c:\windows\SysWow64\MSCMCDE.DLL
2012-08-02 12:19 . 1998-07-06 16:55        64512        ----a-w-        c:\windows\SysWow64\MSCC2DE.DLL
2012-08-01 21:31 . 2012-08-01 21:31        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-08-01 21:31 . 2012-08-01 21:31        --------        d-----w-        c:\programdata\Malwarebytes
2012-08-01 21:31 . 2012-07-03 11:46        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-08-01 17:37 . 2012-08-01 17:37        --------        d-----w-        c:\program files (x86)\Mozilla Thunderbird
2012-08-01 17:14 . 2012-08-01 17:14        --------        d-----w-        c:\program files (x86)\Microsoft
2012-08-01 16:45 . 2012-08-01 17:13        --------        d-----w-        c:\program files (x86)\Microsoft Works
2012-08-01 16:41 . 2012-08-01 16:41        --------        d-----w-        c:\program files\Microsoft Office
2012-08-01 16:40 . 2012-08-01 18:27        --------        d-----w-        c:\programdata\Microsoft Help
2012-08-01 16:40 . 2012-08-01 16:40        --------        d-----r-        C:\MSOCache
2012-08-01 16:27 . 2012-08-01 16:27        --------        d-----w-        c:\users\UpdatusUser
2012-08-01 16:27 . 2012-08-12 12:11        --------        d-----w-        c:\programdata\NVIDIA
2012-08-01 16:26 . 2012-05-15 09:29        889664        ----a-w-        c:\windows\system32\nvvsvc.exe
2012-08-01 16:26 . 2012-05-15 09:29        63296        ----a-w-        c:\windows\system32\nvshext.dll
2012-08-01 16:26 . 2012-05-15 09:29        2561856        ----a-w-        c:\windows\system32\nvsvcr.dll
2012-08-01 16:26 . 2012-05-15 09:29        118080        ----a-w-        c:\windows\system32\nvmctray.dll
2012-08-01 16:26 . 2012-05-15 09:29        2621723        ----a-w-        c:\windows\system32\nvcoproc.bin
2012-08-01 16:26 . 2012-05-15 09:29        3149632        ----a-w-        c:\windows\system32\nvsvc64.dll
2012-08-01 16:26 . 2012-05-15 09:28        6151488        ----a-w-        c:\windows\system32\nvcpl.dll
2012-08-01 16:26 . 2012-05-15 10:48        68928        ----a-w-        c:\windows\system32\OpenCL.dll
2012-08-01 16:26 . 2012-05-15 10:48        61248        ----a-w-        c:\windows\SysWow64\OpenCL.dll
2012-08-01 16:26 . 2012-08-01 16:26        --------        d-----w-        c:\programdata\NVIDIA Corporation
2012-07-31 19:12 . 2012-07-31 19:12        --------        d-----w-        c:\users\Public\CyberLink
2012-07-31 18:29 . 2012-07-31 18:29        --------        d-----w-        c:\program files\CCleaner
2012-07-31 15:38 . 2012-07-31 15:31        98848        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2012-07-31 15:38 . 2012-07-31 15:31        27760        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2012-07-31 15:38 . 2012-07-31 15:31        132832        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-07-31 15:38 . 2012-07-31 15:38        --------        d-----w-        c:\programdata\Avira
2012-07-31 15:38 . 2012-07-31 15:38        --------        d-----w-        c:\program files (x86)\Avira
2012-07-31 11:31 . 2012-08-04 22:50        --------        d-----w-        c:\users\MaxMustermann
2012-07-31 08:36 . 2012-08-02 22:02        --------        d-----w-        c:\programdata\FLEXnet
2012-07-31 07:40 . 2009-07-14 01:41        258048        ----a-w-        c:\windows\system32\Spool\prtprocs\x64\hpfppw73.dll
2012-07-30 23:28 . 2012-07-30 23:28        --------        d-----w-        c:\program files (x86)\Adobe Media Player
2012-07-30 23:26 . 2012-07-30 23:26        --------        d-----w-        c:\program files\Common Files\Adobe
2012-07-30 23:25 . 2012-07-30 23:25        --------        d-----w-        c:\program files (x86)\Common Files\Macrovision Shared
2012-07-30 23:16 . 2012-07-30 23:16        --------        d-----w-        c:\program files (x86)\Common Files\Macromedia Shared
2012-07-30 23:16 . 2012-07-30 23:16        --------        d-----w-        c:\windows\Downloaded Installations
2012-07-30 23:15 . 2012-07-30 23:15        401408        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Driver\9\Intel 32\ISRT.dll
2012-07-30 23:15 . 2012-07-30 23:15        32768        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Driver\9\Intel 32\objpscnv.dll
2012-07-30 23:15 . 2012-07-30 23:15        266240        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Driver\9\Intel 32\IScrCnv.dll
2012-07-30 23:15 . 2012-07-30 23:15        188416        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Driver\9\Intel 32\iGdiCnv.dll
2012-07-30 23:15 . 2012-07-30 23:15        761856        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Driver\9\Intel 32\IDriver.exe
2012-07-30 23:15 . 2012-07-30 23:15        299008        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Driver\9\Intel 32\_ISRES1033.dll
2012-07-30 23:15 . 2012-07-30 23:15        192512        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Driver\9\Intel 32\IUserCnv.dll
2012-07-30 23:14 . 2012-07-30 23:14        --------        d-----w-        c:\windows\SysWow64\QuickTime
2012-07-30 23:11 . 2012-07-30 23:22        --------        d-----w-        c:\program files (x86)\Common Files\Macromedia
2012-07-30 23:11 . 2012-07-30 23:22        --------        d-----w-        c:\program files (x86)\Macromedia
2012-07-30 23:11 . 2012-07-30 23:14        409600        ------w-        c:\program files (x86)\Common Files\InstallShield\Driver\10\Intel 32\ISRT.dll
2012-07-30 23:11 . 2012-07-30 23:14        32768        ------w-        c:\program files (x86)\Common Files\InstallShield\Driver\10\Intel 32\objpscnv.dll
2012-07-30 23:11 . 2012-07-30 23:14        266240        ------w-        c:\program files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IScrCnv.dll
2012-07-30 23:11 . 2012-07-30 23:14        180224        ------w-        c:\program files (x86)\Common Files\InstallShield\Driver\10\Intel 32\iGdiCnv.dll
2012-07-30 23:11 . 2012-07-30 23:14        761856        ------w-        c:\program files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IDriver.exe
2012-07-30 23:11 . 2012-07-30 23:14        172032        ------w-        c:\program files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IUserCnv.dll
2012-07-30 23:11 . 2012-07-30 23:14        540772        ------w-        c:\program files (x86)\Common Files\InstallShield\Driver\10\Intel 32\_ISRES1033.dll
2012-07-30 22:59 . 2012-05-04 11:00        366592        ----a-w-        c:\windows\system32\qdvd.dll
2012-07-30 22:59 . 2012-05-04 09:59        514560        ----a-w-        c:\windows\SysWow64\qdvd.dll
2012-07-30 22:49 . 2012-06-12 03:08        3148800        ----a-w-        c:\windows\system32\win32k.sys
2012-07-30 22:43 . 2010-02-23 08:16        294912        ----a-w-        c:\windows\system32\browserchoice.exe
2012-07-30 22:31 . 2012-06-06 06:06        2004480        ----a-w-        c:\windows\system32\msxml6.dll
2012-07-30 22:28 . 2012-03-30 11:35        1918320        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2012-07-30 22:28 . 2011-12-16 08:46        634880        ----a-w-        c:\windows\system32\msvcrt.dll
2012-07-30 22:28 . 2011-12-16 07:52        690688        ----a-w-        c:\windows\SysWow64\msvcrt.dll
2012-07-30 22:17 . 2012-02-17 06:38        1031680        ----a-w-        c:\windows\system32\rdpcore.dll
2012-07-30 22:17 . 2012-02-17 05:34        826880        ----a-w-        c:\windows\SysWow64\rdpcore.dll
2012-07-30 22:17 . 2012-02-17 04:57        23552        ----a-w-        c:\windows\system32\drivers\tdtcp.sys
2012-07-30 22:10 . 2012-06-02 22:19        2428952        ----a-w-        c:\windows\system32\wuaueng.dll
2012-07-30 22:10 . 2012-06-02 22:19        57880        ----a-w-        c:\windows\system32\wuauclt.exe
2012-07-30 22:10 . 2012-06-02 22:19        44056        ----a-w-        c:\windows\system32\wups2.dll
2012-07-30 22:10 . 2012-06-02 22:15        2622464        ----a-w-        c:\windows\system32\wucltux.dll
2012-07-30 22:10 . 2012-06-02 22:19        38424        ----a-w-        c:\windows\system32\wups.dll
2012-07-30 22:10 . 2012-06-02 22:19        701976        ----a-w-        c:\windows\system32\wuapi.dll
2012-07-30 22:10 . 2012-06-02 22:15        99840        ----a-w-        c:\windows\system32\wudriver.dll
2012-07-30 22:09 . 2012-06-02 13:19        186752        ----a-w-        c:\windows\system32\wuwebv.dll
2012-07-30 22:09 . 2012-06-02 13:15        36864        ----a-w-        c:\windows\system32\wuapp.exe
2012-07-30 21:51 . 2012-07-30 21:51        --------        d--h--w-        c:\programdata\Medion Reminder
2012-07-30 21:50 . 2012-08-02 17:51        --------        d-----w-        c:\users\MaxMustermann
2012-07-30 21:50 . 2012-07-30 21:50        --------        d-----w-        c:\programdata\Kaspersky Rescue Disk 10
2012-07-30 21:49 . 2012-07-30 21:49        --------        d-----w-        c:\program files (x86)\Common Files\Memeo
2012-07-30 21:49 . 2012-07-30 21:49        --------        d-----w-        c:\program files (x86)\Memeo
2012-07-30 21:49 . 2012-07-30 21:49        --------        d-----w-        c:\program files (x86)\MARKEMENT
2012-07-30 21:49 . 2012-07-30 21:49        --------        d-----w-        c:\program files (x86)\Mediathek
2012-07-30 21:48 . 2012-07-30 21:48        --------        d-----w-        c:\program files (x86)\Common Files\Corel
2012-07-30 21:48 . 2012-07-30 21:48        --------        d-----w-        c:\program files\PlayReady
2012-07-30 21:47 . 2012-07-30 21:47        --------        d-----w-        c:\program files (x86)\Common Files\Protexis
2012-07-30 21:47 . 2012-07-30 21:47        --------        d-----w-        c:\programdata\Corel
2012-07-30 21:46 . 2012-07-30 21:46        --------        d-----w-        c:\program files (x86)\Corel
2012-07-30 21:46 . 2012-07-30 22:21        --------        d-----w-        c:\program files\Google
2012-07-30 21:45 . 2012-07-30 22:21        --------        d-----w-        c:\program files (x86)\Google
2012-07-30 21:44 . 2012-07-30 21:44        --------        d-sh--we        C:\Documents and Settings
2012-07-30 21:44 . 2012-07-30 21:44        --------        d-----w-        C:\Recovery
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-03 01:19 . 2011-07-18 20:31        59701280        ----a-w-        c:\windows\system32\MRT.exe
2012-06-26 19:38 . 2012-06-26 19:38        46176        ----a-w-        c:\windows\system32\drivers\point64.sys
2012-06-24 20:24 . 2012-06-24 20:24        52320        ----a-w-        c:\windows\system32\drivers\dc3d.sys
2012-05-31 10:25 . 2010-11-21 03:27        279656        ------w-        c:\windows\system32\MpSigStub.exe
2012-05-28 05:09 . 2012-05-28 05:09        2168416        ----a-w-        c:\windows\system32\coin91.dll
2012-05-15 00:21 . 2012-05-15 00:21        423744        ----a-w-        c:\windows\SysWow64\nvStreaming.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-05-20 284440]
"AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"AVMWlanClient"="c:\program files (x86)\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"OTL"="c:\users\MaxMustermann\Downloads\OTL.exe" [2012-08-09 596480]
.
c:\users\MaxMustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-30 136176]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2010-10-22 14120]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-30 136176]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2012-01-24 1255736]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2010-09-23 129008]
R4 AntiVirWebService;Avira Browser Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [2012-07-31 465360]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-07-31 27760]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [2012-07-31 375760]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-07-31 86224]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-05-20 13592]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [2011-09-28 25824]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-05-15 1262400]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-05-15 382272]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-03-11 2656280]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\drivers\asmthub3.sys [2011-08-02 129000]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\drivers\asmtxhci.sys [2011-08-02 391144]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2012-06-24 52320]
S3 fwlanusbn;FRITZ!WLAN N;c:\windows\system32\DRIVERS\fwlanusbn.sys [2010-10-22 714368]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys [2011-03-11 56344]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-04-18 188736]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2012-06-26 46176]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-11-25 694888]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-08-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-30 21:45]
.
2012-08-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-30 21:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-08-16 12673128]
"MedionReminder"="c:\program files (x86)\CyberLink\PowerRecover\Reminder.exe" [2011-05-25 443688]
"IntelliType Pro"="c:\program files\Microsoft Device Center\itype.exe" [2012-06-26 1464928]
"IntelliPoint"="c:\program files\Microsoft Device Center\ipoint.exe" [2012-06-26 2004584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MedionReminder"="c:\program files (x86)\CyberLink\PowerRecover\Reminder.exe" [2011-05-25 443688]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.aldi.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Adobe Photoshop 6.0 - c:\windows\ISUN0407.EXE
AddRemove-Adobe SVG Viewer - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-08-12  14:26:35
ComboFix-quarantined-files.txt  2012-08-12 12:26
.
Vor Suchlauf: 7 Verzeichnis(se), 830.065.917.952 Bytes frei
Nach Suchlauf: 11 Verzeichnis(se), 834.503.208.960 Bytes frei
.
- - End Of File - - 654919A4666ED30BEC3AC8BDD6FC1786

--- --- ---

cosinus 13.08.2012 12:44
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Fontana 13.08.2012 21:17
Hallo,

GMER meldete "didn´t found any modification". Logs konnte ich nicht abrufen, auch wenn man auf copy klickt und die Zwischenablage ansieht.

Hier OSAM, danach mach ich mich an aswMBR

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 22:11:08 on 13.08.2012

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 64-bit
Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"AVM Eject" (avmeject) - "AVM Berlin" - C:\Windows\System32\drivers\avmeject.sys
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"wsvd" (wsvd) - "CyberLink" - C:\Windows\System32\DRIVERS\wsvd.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} "Album Download IE Asynchronous Pluggable Protocol Interface" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{DE902992-61FC-4A01-8091-53E1895C9775} "CDR Icon Handler" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell\Extension\x86\ShellXP.dll
{7AD101F2-0B93-4D66-A1CA-DF73F3C4377B} "CDR preview provider" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell\Extension\x86\ShellVista.dll
{7FA63AC0-F5BC-4F3B-A9CF-94328D812B62} "CDR Property Handler" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell\Extension\x86\ShellVista.dll
{1462EBAA-96E7-4D93-9A66-0E4068DE4FCF} "CDR Thumbnail provider" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell\Extension\x86\ShellXP.dll
{DE902994-61FC-4A01-8091-53E1895C9775} "CMX Icon Handler" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell\Extension\x86\ShellXP.dll
{1462EBAC-96E7-4D93-9A66-0E4068DE4FCF} "CMX Thumbnail provider" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell\Extension\x86\ShellXP.dll
{DE902993-61FC-4A01-8091-53E1895C9775} "CPT Icon Handler" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell\Extension\x86\ShellXP.dll
{7FA63AC1-F5BC-4F3B-A9CF-94328D812B62} "CPT Property Handler" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell\Extension\x86\ShellVista.dll
{1462EBAB-96E7-4D93-9A66-0E4068DE4FCF} "CPT Thumbnail provider" - "Corel Corporation" - c:\Program Files (x86)\Common Files\Corel\Shared\Shell\Extension\x86\ShellXP.dll
{9DED7A30-D572-4D21-8D82-6945EA697400} "FlashPaperContextHandler Class" - ? - C:\Program Files (x86)\Macromedia\FlashPaper 2\FlashPaperContextMenu.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4  (HTTP value)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} "Java Plug-in 1.7.0_02" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.7.0_02" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\ssv.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 10.2.0" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4  (HTTP value)
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corp." - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Security Packages" - "Microsoft Corp." - C:\Windows\system32\livessp.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\GW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"AdobeCS4ServiceManager" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
"AVMWlanClient" - "AVM Berlin" - C:\Program Files (x86)\avmwlanstick\wlangui.exe
"IAStorIcon" - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce )-----
"OTL" - "OldTimer Tools" - "C:\Users\GaWi\Downloads\OTL.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"pdfcmon" - "pdfforge GbR" - C:\Windows\system32\pdfcmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
"Avira Email Schutz" (AntiVirMailService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
"AVM WLAN Connection Service" (AVM WLAN Connection Service) - "AVM Berlin" - C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"Google Update-Dienst (gupdate)" (gupdate) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
"Intel(R) Management and Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
"Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
"MemeoBackgroundService" (MemeoBackgroundService) - "Memeo" - C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe
"NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
"NVIDIA Update Service Daemon" (nvUpdatusService) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Protexis Licensing V2" (PSI_SVC_2) - "Protexis Inc." - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"WindowsLive Local NSP" - "Microsoft Corp." - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
"WindowsLive NSP" - "Microsoft Corp." - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----
"AVSDA" - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Hier aswMBR

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-13 22:20:14
-----------------------------
22:20:14.784    OS Version: Windows x64 6.1.7601 Service Pack 1
22:20:14.784    Number of processors: 4 586 0x2A07
22:20:14.784    ComputerName: MaxMustermann-PC  UserName: MaxMustermann
22:20:15.767    Initialize success
22:23:48.183    AVAST engine defs: 12081301
22:42:33.834    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
22:42:33.834    Disk 0 Vendor: Hitachi_ MS2O Size: 953869MB BusType: 3
22:42:33.834    Disk 0 MBR read successfully
22:42:33.850    Disk 0 MBR scan
22:42:33.850    Disk 0 unknown MBR code
22:42:33.850    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
22:42:33.865    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      901542 MB offset 206848
22:42:33.896    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        51200 MB offset 1846564864
22:42:33.912    Disk 0 Partition 4 00    12  Compaq diag NTFS        1025 MB offset 1951422464
22:42:33.959    Disk 0 scanning C:\Windows\system32\drivers
22:42:40.370    Service scanning
22:42:58.014    Modules scanning
22:42:58.014    Disk 0 trace - called modules:
22:42:58.544    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
22:42:58.544    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006f92060]
22:42:58.560    3 CLASSPNP.SYS[fffff88001d5243f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800470a050]
22:42:59.449    AVAST engine scan C:\Windows
22:43:01.976    AVAST engine scan C:\Windows\system32
22:44:32.347    AVAST engine scan C:\Windows\system32\drivers
22:44:42.378    AVAST engine scan C:\Users\MaxMustermann
22:45:02.112    AVAST engine scan C:\ProgramData
22:45:45.933    Scan finished successfully
22:52:39.084    Disk 0 MBR has been saved successfully to "C:\Users\MaxMustermann\Downloads\MBR.dat"
22:52:39.084    The log file has been saved successfully to "C:\Users\MaxMustermann\Downloads\aswMBR.txt"

cosinus 14.08.2012 14:49
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

Fontana 15.08.2012 18:44
Logs nach dem MBR-Fix

... ich fahre am Freitag für 2-3 Wochen Richtung Süden, arbeite nur mehr morgen :-) Kann ich danach den thread einfach wieder hochschieben zum weitermachen, oder wie soll ich das machen? Wie viele Schritte müssen wir noch machen, bis der Rechner unverdächtig ist? War da viele verdächtiges Zeug drauf, ich erkenn ja immer nur chinesische Zeichen...

Auf jeden Fall möchte ich mir bei Dir bedanken. Das ist toll, das Du (Ihr) so etwas macht; es kostet ja auch viel Zeit und es ist absolut nicht selbstverständlich, über einen so langen Zeitraum so geduldig zu antworten... Ihr solltet auch so eine Ehrenamts-Medaille wie im analogen Leben bekommen, als PC und Nerven-Retter.


Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-13 22:20:14
-----------------------------
22:20:14.784    OS Version: Windows x64 6.1.7601 Service Pack 1
22:20:14.784    Number of processors: 4 586 0x2A07
22:20:14.784    ComputerName: MaxMustermann-PC  UserName: MaxMustermann
22:20:15.767    Initialize success
22:23:48.183    AVAST engine defs: 12081301
22:42:33.834    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
22:42:33.834    Disk 0 Vendor: Hitachi_ MS2O Size: 953869MB BusType: 3
22:42:33.834    Disk 0 MBR read successfully
22:42:33.850    Disk 0 MBR scan
22:42:33.850    Disk 0 unknown MBR code
22:42:33.850    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
22:42:33.865    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      901542 MB offset 206848
22:42:33.896    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        51200 MB offset 1846564864
22:42:33.912    Disk 0 Partition 4 00    12  Compaq diag NTFS        1025 MB offset 1951422464
22:42:33.959    Disk 0 scanning C:\Windows\system32\drivers
22:42:40.370    Service scanning
22:42:58.014    Modules scanning
22:42:58.014    Disk 0 trace - called modules:
22:42:58.544    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
22:42:58.544    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006f92060]
22:42:58.560    3 CLASSPNP.SYS[fffff88001d5243f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800470a050]
22:42:59.449    AVAST engine scan C:\Windows
22:43:01.976    AVAST engine scan C:\Windows\system32
22:44:32.347    AVAST engine scan C:\Windows\system32\drivers
22:44:42.378    AVAST engine scan C:\Users\MaxMustermann
22:45:02.112    AVAST engine scan C:\ProgramData
22:45:45.933    Scan finished successfully
22:52:39.084    Disk 0 MBR has been saved successfully to "C:\Users\MaxMustermann\Downloads\MBR.dat"
22:52:39.084    The log file has been saved successfully to "C:\Users\MaxMustermann\Downloads\aswMBR.txt"


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-15 19:08:59
-----------------------------
19:08:59.322    OS Version: Windows x64 6.1.7601 Service Pack 1
19:08:59.322    Number of processors: 4 586 0x2A07
19:08:59.322    ComputerName: MaxMustermann-PC  UserName: MaxMustermann
19:09:01.491    Initialize success
19:09:54.470    AVAST engine defs: 12081503
19:10:15.109    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
19:10:15.109    Disk 0 Vendor: Hitachi_ MS2O Size: 953869MB BusType: 3
19:10:15.109    Disk 0 MBR read successfully
19:10:15.109    Disk 0 MBR scan
19:10:15.124    Disk 0 Windows 7 default MBR code
19:10:15.124    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
19:10:15.140    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      901542 MB offset 206848
19:10:15.171    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        51200 MB offset 1846564864
19:10:15.187    Disk 0 Partition 4 00    12  Compaq diag NTFS        1025 MB offset 1951422464
19:10:15.234    Disk 0 scanning C:\Windows\system32\drivers
19:10:22.612    Service scanning
19:10:42.487    Modules scanning
19:10:42.487    Disk 0 trace - called modules:
19:10:42.518    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
19:10:42.534    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006f92060]
19:10:42.534    3 CLASSPNP.SYS[fffff88001d8643f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004747050]
19:10:43.735    AVAST engine scan C:\Windows
19:10:45.997    AVAST engine scan C:\Windows\system32
19:12:17.366    AVAST engine scan C:\Windows\system32\drivers
19:12:25.432    AVAST engine scan C:\Users\MaxMustermann
19:12:45.587    AVAST engine scan C:\ProgramData
19:13:35.351    Scan finished successfully
19:26:21.671    Disk 0 MBR has been saved successfully to "C:\Users\MaxMustermann\Downloads\MBR.dat"
19:26:21.702    The log file has been saved successfully to "C:\Users\MaxMustermann\Downloads\aswMBR.txt"

cosinus 16.08.2012 08:35
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Fontana 16.08.2012 11:12
Hier Malwarebyte

Code:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.15.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
MaxMustermann :: MaxMustermann-PC [limited]

16.08.2012 11:20:17
mbam-log-2012-08-16 (11-20-17).txt

Scan type: Full scan (C:\|D:\|I:\|J:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 374474
Time elapsed: 33 minute(s), 12 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
Hier SUPERAntiSpyware

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 08/16/2012 at 12:55 PM

Application Version : 5.5.1012

Core Rules Database Version : 9067
Trace Rules Database Version: 6879

Scan type      : Complete Scan
Total Scan Time : 00:35:34

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned      : 612
Memory threats detected  : 0
Registry items scanned    : 73834
Registry threats detected : 0
File items scanned        : 80216
File threats detected    : 143

Adware.Tracking Cookie
        C:\USERS\MaxMustermann\AppData\Roaming\Microsoft\Windows\Cookies\VG0W6DGX.txt [ Cookie:MaxMustermann@microsoftsto.112.2o7.net/ ]
        C:\USERS\MaxMustermann\AppData\Roaming\Microsoft\Windows\Cookies\Low\AUH7RCUQ.txt [ Cookie:MaxMustermann@atdmt.com/ ]
        C:\USERS\MaxMustermann\AppData\Roaming\Microsoft\Windows\Cookies\Low\8MZDUM6S.txt [ Cookie:MaxMustermann@fl01.ct2.comclick.com/ ]
        C:\USERS\MaxMustermann\AppData\Roaming\Microsoft\Windows\Cookies\Low\B2LWBE40.txt [ Cookie:MaxMustermann@ad.yieldmanager.com/ ]
        C:\USERS\MaxMustermann\AppData\Roaming\Microsoft\Windows\Cookies\Low\TJ5N6LW1.txt [ Cookie:MaxMustermann@apmebf.com/ ]
        C:\USERS\MaxMustermann\AppData\Roaming\Microsoft\Windows\Cookies\Low\W2MAG69S.txt [ Cookie:MaxMustermann@adfarm1.adition.com/ ]
        C:\USERS\MaxMustermann\Cookies\VG0W6DGX.txt [ Cookie:MaxMustermann@microsoftsto.112.2o7.net/ ]
        .statcounter.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        de.sitestat.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .doubleclick.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .atdmt.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .amazon-adsystem.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .specificclick.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .amazon-adsystem.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.googleadservices.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adtech.de [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zanox-affiliate.de [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        track.adform.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tracking.quisma.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .media6degrees.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .media6degrees.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .smartadserver.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad3.adfarm1.adition.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .apmebf.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .mediaplex.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .mediaplex.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .imrworldwide.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .imrworldwide.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .c1.atdmt.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.googleadservices.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .media6degrees.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .media6degrees.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        server.adformdsp.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adformdsp.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adform.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.zanox.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tracking.quisma.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .atdmt.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .c.atdmt.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .c.atdmt.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .olympiaverlag.122.2o7.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adserv.cinecitta.de [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .im.banner.t-online.de [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adviva.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adxpose.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .im.banner.t-online.de [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adform.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tracker.vinsight.de [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adx.chip.de [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        track.adform.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adform.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adx.chip.de [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tribalfusion.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .smartadserver.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .smartadserver.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .smartadserver.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .smartadserver.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad4.adfarm1.adition.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        de.sitestat.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zanox.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .traffictrack.de [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad2.adfarm1.adition.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .quartermedia.de [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .quartermedia.de [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        accounts.youtube.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        accounts.google.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        accounts.youtube.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .accounts.google.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .accounts.google.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .microsoftsto.112.2o7.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tracking.quisma.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        tracking.quisma.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .pumaonlinestorede.112.2o7.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        de.sitestat.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad1.adfarm1.adition.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ww251.smartadserver.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adtech.de [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .doubleclick.net [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .doubleclick.net [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .tracker.vinsight.de [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .a.revenuemax.de [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\MaxMustermann\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F1QSEJLY.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\MaxMustermann\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

cosinus 16.08.2012 12:35
Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Fontana 16.08.2012 15:35
Hallo,


alles läuft wie frisch geölt :-)

Gestern hab ich mir Winmail Opener installiert, da kommt bei Avira jetzt eine Warnung , ist das kritisch?
C:\Program Files (x86)\Winmail Opener\uninst.exe
[WARNUNG] Unerwartetes Dateiende erreicht

Kann man eigentlich sehen, wo man sich diese Trojaner etc. geholt hat? Habe zwar einen Verdacht (evtl. nach F*reSh*t-download; da kam vor dem Download ein Malware-Meldung. Es war aber ein Download von der Herstellerseite und der Support meinte, das wäre ein Fehler von Avira. Nützt ein Link etwas, um das zu sehen?) aber da kenn ich mich nicht besonders gut aus...

cosinus 17.08.2012 18:13
Zitat:
evtl. nach F*reSh*t-download; da kam vor dem Download ein Malware-Meldung
FireShot? Bitte genauer beschrieben

Fontana 01.09.2012 23:44
...sorry für die verspätete Antwort, war im Urlaub :-)

Hier habe ich eine Malware-Meldung bekommen, als ich Fireshot für Firefox herunterladen wollte. Der Supporter von Fireshot meinte, das könne schon mal passieren ?!

hxxp://screenshot-program.com/downloads.php

cosinus 03.09.2012 15:51
ja schonmal was von Fehlalarme gehört?


Was ist nun mit deinem Rechner, alles nun ok oder ist noch was offen?

Fontana 03.09.2012 19:21
... Fehlalarm jaa ... aber man erwägt natürlich nach so einem Befall alle Möglichkeiten, wo das herkommen kann.

Vielen, vielen Dank für Deine Hilfe!!! Alles passt jetzt, bin sehr erleichtert! Werde dem Trojanerboard noch eine Spende zukommen lassen

cosinus 03.09.2012 20:50
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Fontana 05.09.2012 23:58
:daumenhoc
Alles auf dem neuesten Stand jetzt und läuft astrein
:applaus::applaus::applaus:


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:13 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131