Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   GVU eingefangen (https://www.trojaner-board.de/121326-gvu-eingefangen.html)

jonnyk 05.08.2012 17:42
GVU eingefangen
 
Hallo Forumsteam,
habe mir am 03.08.2012 auch den GVU-Trojaner gefangen.

Mein System:
siehe Anhang "20120805_klein_Report-DrHard.txt".

Wie später gelesen, sollte man zwar nichts selbst tun, habe ich aber, denn:

Mein System enthält 2 Festplatten, auf einer ist VISTA, auf der zweiten WIN7/64!
Der GVU schlug auf dem WIN7-System zu.
Anschließend habe ich mit VISTA gebootet und zuerst die "ctfmon.lnk" und dann die "*.pad" (weiß nicht mehr genau, wie sie hieß) gelöscht.
Anschließend ließ sich WIN7 wieder starten.
Habe dann einen Komplettscan mit AVIRA Premium 2012 laufen lassen.
Dieser ergab 20 Funde! Diese in Quarantäne verschoben und gelöscht.
Report siehe Anhang "AVSCAN-20120804-145420-42D947A7.txt".
Darauf habe ich mit TuneUpUtilitys 2010 die Registry aufgeräumt.

Da ich jedoch nicht sicher bin, ob das alles war (wie ja bei euch auch geschrieben) öffne ich das Thema und bitte um Prüfung.

Hier der Report von Malwarebytes:
---------------------------------------------
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.05.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jonny :: JONNY-BUERO-7 [Administrator]

Schutz: Aktiviert

05.08.2012 17:47:09
mbam-log-2012-08-05 (17-47-09).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 273659
Laufzeit: 2 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F99BD4F5-D402-4c21-A8BC-510830B6BE37} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Hijack.UserInit) -> Bösartig: (userinit.exeC:\Users\Jonny\AppData\Roaming\appconf32.exe,) Gut: (userinit.exe) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
---------------------------------------------

Im Voraus schon mal vielen Dank für eure Hilfe.

LG jonnyk

cosinus 09.08.2012 20:29
Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

jonnyk 10.08.2012 17:20
Hallo Cosinus,
vielen Dank für die Antwort.

Nein, habe Malwarebytes ertmals (nachdem ich es hier bei anderen Fällen gelesen habe) verwendet!

Habe auch die anderen Tools heruntergeladen und kann z.B. auch OTL-Log noch liefern!

mfG jonnyk

cosinus 11.08.2012 16:02
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

jonnyk 13.08.2012 19:58
Hallo cosinus,
sorry, hat etwas gedauert, da ich am Wochenende nicht da war.

Hier nun die Logs:
1. mbam-log-2012-08-05 (17-47-09).txt
Code:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org
Datenbank Version: v2012.08.05.06
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jonny :: JONNY-BUERO-7 [Administrator]
Schutz: Aktiviert
05.08.2012 17:47:09
mbam-log-2012-08-05 (17-47-09).txt
Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 273659
Laufzeit: 2 Minute(n), 55 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F99BD4F5-D402-4c21-A8BC-510830B6BE37} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Hijack.UserInit) -> Bösartig: (userinit.exeC:\Users\Jonny\AppData\Roaming\appconf32.exe,) Gut: (userinit.exe) -> Erfolgreich ersetzt und in Quarantäne gestellt.
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)
(Ende)
2. mbam-log-2012-08-11 (19-31-37).txt
Code:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org
Datenbank Version: v2012.08.11.03
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jonny :: JONNY-BUERO-7 [Administrator]
Schutz: Aktiviert
11.08.2012 19:31:37
mbam-log-2012-08-11 (19-31-37).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|R:\|S:\|X:\|Y:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 700309
Laufzeit: 3 Stunde(n), 8 Minute(n), 29 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 22
D:\Programme_sicherung\Netz-Tools\Netzmanager\SoftonicDownloader_fuer_netzmanager.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt.
F:\Web\Fun_PGM\schnippi.exe (PUP.Joke.SmallWilly) -> Keine Aktion durchgeführt.
F:\Web\Fun_PGM\fakedelete\fakedelete.exe (PUP.Joke.RJLSoftware) -> Keine Aktion durchgeführt.
S:\Nero_Sync\Kopieren_D\Programme_sicherung\Netz-Tools\Netzmanager\SoftonicDownloader_fuer_netzmanager.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt.
S:\Nero_Sync\Kopieren_F\Web\Fun_PGM\schnippi.exe (PUP.Joke.SmallWilly) -> Keine Aktion durchgeführt.
S:\Nero_Sync\Kopieren_F\Web\Fun_PGM\fakedelete\fakedelete.exe (PUP.Joke.RJLSoftware) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\DesktopDot\reddot.exe (PUP.Joke.RJLSoftware) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\Launcher\launcher.exe (PUP.Joke.RJLSoftware) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\Y2K-Fun\Y2k.exe.XXX (PUP.Joke.RJLSoftware) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\Video-Konverter\SoftonicDownloader_fuer_virtualdub.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\Video-Konverter\Audio-Video Converter\SoftonicDownloader_fuer_audio-video-converter.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\Video-Schnitt\VirtualDub_Cut-Assistent\SoftonicDownloader_fuer_ffdshow.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Internet\Ultrasurf-anonym\U1104.exe (PUP.UltraSurf) -> Keine Aktion durchgeführt.
F:\Web\Fun_PGM\elchtest\elchtest.exe (Application.Joke) -> Erfolgreich gelöscht und in Quarantäne gestellt.
F:\Web\Fun_PGM\stress\stressreducers.exe (Joke.Stressreducer) -> Erfolgreich gelöscht und in Quarantäne gestellt.
S:\Nero_Sync\Kopieren_F\Web\Fun_PGM\elchtest\elchtest.exe (Application.Joke) -> Erfolgreich gelöscht und in Quarantäne gestellt.
S:\Nero_Sync\Kopieren_F\Web\Fun_PGM\stress\stressreducers.exe (Joke.Stressreducer) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\DownHoax\downhoax.exe (Trojan.Joke) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\drunkMouse\DrunkMouse.exe.XXX (BadJoke.MovingMouse) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\Finger\finger.exe.XXX (BadJoke.Finger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\ExactAudioCopy\eac-0.99pb4.exe (Adware.Yabector) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Registry_Cleaner\Registry_Convoy\RegistryConvoy_Setup.exe (Rogue.RegTidy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
(Ende)
3. ESET - log.txt
Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=acbf00daaf4f4d43b6acf68dd7c66b81
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-13 05:59:58
# local_time=2012-08-13 07:59:58 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 19342475 19342475 0 0
# compatibility_mode=5893 16776574 100 94 236791 96492488 0 0
# compatibility_mode=8192 67108863 100 0 724 724 0 0
# scanned=442509
# found=18
# cleaned=18
# scan_time=18160
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\54052633-28517505 Java/Exploit.CVE-2012-1723.AD Trojaner (gelöscht - in Quarantäne kopiert) 00000000000000000000000000000000 C
D:\Programme_sicherung\Netz-Tools\Netzmanager\SoftonicDownloader_fuer_netzmanager.exe Variante von Win32/SoftonicDownloader.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
D:\Programme_sicherung\Treiber_VISTA\Tastatur_Genius_KWD-910\installer_driver_genius_kwd910_kwd910.exe Win32/Toggle Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
F:\Web\Fun_PGM\fakedelete\fakedelete.exe Win32/FakeDel.A Joke (Scherzprogramm) (gelöscht - in Quarantäne kopiert) 00000000000000000000000000000000 C
S:\Nero_Sync\Kopieren_D\Programme_sicherung\Netz-Tools\Netzmanager\SoftonicDownloader_fuer_netzmanager.exe Variante von Win32/SoftonicDownloader.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
S:\Nero_Sync\Kopieren_D\Programme_sicherung\Treiber_VISTA\Tastatur_Genius_KWD-910\installer_driver_genius_kwd910_kwd910.exe Win32/Toggle Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
S:\Nero_Sync\Kopieren_F\Web\Fun_PGM\fakedelete\fakedelete.exe Win32/FakeDel.A Joke (Scherzprogramm) (gelöscht - in Quarantäne kopiert) 00000000000000000000000000000000 C
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\DOS\DRAIN_X.EXE.XXX möglicherweise Variante von Win32/Agent.NSHXHXE Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\Y2K-Fun\Y2k.exe.XXX möglicherweise Variante von Win32/Agent.ETDHYPQ Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\Alltunes\SoftonicDownloader51289.exe Variante von Win32/SoftonicDownloader.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\Video-Konverter\SoftonicDownloader_fuer_free-youtube-download.exe Variante von Win32/SoftonicDownloader.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\Video-Konverter\SoftonicDownloader_fuer_virtualdub.exe Variante von Win32/SoftonicDownloader.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\Video-Konverter\Audio-Video Converter\SoftonicDownloader_fuer_audio-video-converter.exe Variante von Win32/SoftonicDownloader.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\Video-Schnitt\VirtualDub_Cut-Assistent\SoftonicDownloader_fuer_ffdshow.exe Variante von Win32/SoftonicDownloader.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Bios\Passwort\Kill-CMOS-Tool\KILLCMOS.COM KillCMOS.A Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Bios\Passwort\Kill-CMOS-Tool\killcmos.zip KillCMOS.A Trojaner (gelöscht - in Quarantäne kopiert) 00000000000000000000000000000000 C
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Office\Office_2010_Büro\VisualBasic_6.0\SoftonicDownloader6823.exe Variante von Win32/SoftonicDownloader.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Ultramixer\2.3.2\UltraMixer-2.3.2-win.exe Mehrere Bedrohungen (Gesäubert durch Löschen - in Quarantäne kopiert) 00000000000000000000000000000000 C
Hoffe, dass ich das mit dem "code" richtig verstanden habe.

LG jonnyk

cosinus 14.08.2012 13:53
Code:
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\Video-Schnitt\VirtualDub_Cut-Assistent\SoftonicDownloader_fuer_ffdshow.exe
Vermüllte Software von Softonic scheint gerade stark in Mode zu sein! http://cosgan.de/images/midi/boese/a040.gif

Finger weg von Softonic!! :pfui:

Softonic ist eine Toolbar- und Adwareschleuder! Finger weg! Software lädt man sich mit oberster Priorität direkt vom Hersteller und nicht von solchen Toolbarklitschen wie Softonic! Im Notfall würde natürlich chip.de gehen

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

jonnyk 14.08.2012 14:45
Hi cosinus,
vielen Dank für die schnelle Antwort.
Werde Deinen Hinweis hinsichtlich Softonic beachten.
Habe allerdings bisher versucht, Toolbars nicht zu installieren bzw. diese wieder zu deinstallieren.
Wohl einiges übersehen!

Hier das Log von AdwCleaner:

Code:
# AdwCleaner v1.801 - Logfile created 08/14/2012 at 15:33:42
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : Jonny - JONNY-BUERO-7
# Boot Mode : Normal
# Running from : C:\users\Jonny\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****

Found : vToolbarUpdater11.2.0

***** [Files / Folders] *****

Folder Found : C:\Users\Jonny\AppData\Local\AVG Secure Search
Folder Found : C:\Users\Anneliese\AppData\Local\AVG Secure Search
Folder Found : C:\Users\Carolin\AppData\Local\AVG Secure Search
Folder Found : C:\Users\Jonny\AppData\LocalLow\AskToolbar
Folder Found : C:\Users\Jonny\AppData\LocalLow\AVG Secure Search
Folder Found : C:\Users\Anneliese\AppData\LocalLow\AVG Secure Search
Folder Found : C:\Users\Carolin\AppData\LocalLow\AVG Secure Search
Folder Found : C:\Users\Jonny\AppData\Roaming\OpenCandy
Folder Found : C:\ProgramData\AVG Secure Search
Folder Found : C:\Program Files (x86)\Ask.com
Folder Found : C:\Program Files (x86)\AVG Secure Search
Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Found : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
File Found : C:\user.js

***** [Registry] *****

Key Found : HKCU\Software\APN
Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\Ask.com
Key Found : HKCU\Software\AVG Secure Search
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\IGearSettings
Key Found : HKCU\Software\IM
Key Found : HKCU\Software\ImInstaller
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\APN
Key Found : HKLM\SOFTWARE\AskToolbar
Key Found : HKLM\SOFTWARE\AVG Secure Search
Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Found : HKLM\SOFTWARE\Software
Key Found : HKLM\SOFTWARE\Web Assistant
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
[x64] Key Found : HKCU\Software\APN
[x64] Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
[x64] Key Found : HKCU\Software\AppDataLow\Software\SmartBar
[x64] Key Found : HKCU\Software\Ask.com
[x64] Key Found : HKCU\Software\AVG Secure Search
[x64] Key Found : HKCU\Software\Conduit
[x64] Key Found : HKCU\Software\IGearSettings
[x64] Key Found : HKCU\Software\IM
[x64] Key Found : HKCU\Software\ImInstaller
[x64] Key Found : HKCU\Software\Softonic
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
[x64] Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
[x64] Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
[x64] Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
[x64] Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
[x64] Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
[x64] Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
[x64] Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
[x64] Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Found : HKLM\SOFTWARE\Web Assistant
[x64] Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Found : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
[x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
[x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F25AF245-4A81-40DC-92F9-E9021F207706}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
[x64] Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
[x64] Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [14989 octets] - [14/08/2012 15:33:42]

########## EOF - C:\AdwCleaner[R1].txt - [15118 octets] ##########
Habe zunächst mal nichts gelöscht!

LG Jonny

cosinus 14.08.2012 16:50
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

jonnyk 14.08.2012 17:59
Hi,

hier das Log nach "Delete":

Code:
# AdwCleaner v1.801 - Logfile created 08/14/2012 at 18:51:23
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : Jonny - JONNY-BUERO-7
# Boot Mode : Normal
# Running from : C:\users\Jonny\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : vToolbarUpdater11.2.0

***** [Files / Folders] *****

Folder Deleted : C:\Users\Jonny\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Anneliese\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Carolin\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Jonny\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\Jonny\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Anneliese\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Carolin\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Jonny\AppData\Roaming\OpenCandy
Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\Program Files (x86)\Ask.com
Folder Deleted : C:\Program Files (x86)\AVG Secure Search
Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
File Deleted : C:\user.js

***** [Registry] *****

Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\IGearSettings
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\APN
Key Deleted : HKLM\SOFTWARE\AskToolbar
Key Deleted : HKLM\SOFTWARE\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SOFTWARE\Software
Key Deleted : HKLM\SOFTWARE\Web Assistant
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
[x64] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
[x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Deleted : HKLM\SOFTWARE\Web Assistant

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [14970 octets] - [14/08/2012 15:33:42]
AdwCleaner[R2].txt - [15031 octets] - [14/08/2012 18:51:09]
AdwCleaner[S1].txt - [11284 octets] - [14/08/2012 18:51:23]

########## EOF - C:\AdwCleaner[S1].txt - [11413 octets] ##########

cosinus 14.08.2012 18:08
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

jonnyk 15.08.2012 11:01
Hi,

zu 1.: Windows läuft sauber, gefühlt sogar etwas schneller (Hochfahren + WIN-Anmeldung) :daumenhoc

zu 2.: Habe mal überschlägig getestet. Scheint alles da zu sein. Keine leeren Ordner. Eine genaue Prüfung wäre allerdings sehr aufwendig, da doch einige Installationen vorhanden sind (Audio-, Video- und Fotobearbeitung)!
Habe hierzu eigene Desktop-Ordner, deren Inhalt aber einwandfrei läuft! :daumenhoc

Ich denke soweit passt alles und wir können weiter machen.

Bis hierher schon mal vielen vielen Dank. http://www.trojaner-board.de/images/icons/icon24.gif

cosinus 15.08.2012 19:57
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

jonnyk 16.08.2012 13:00
Da kommt auch eine "Extra.txt" die ich mal auf dem Desktop stehen lasse.

Hier die OTL.txt:
OTL Logfile:
Code:
OTL logfile created on: 16.08.2012 13:41:11 - Run 1
OTL by OldTimer - Version 3.2.57.0    Folder = C:\Users\Jonny\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,43 Gb Available Physical Memory | 60,82% Memory free
8,00 Gb Paging File | 6,09 Gb Available in Paging File | 76,16% Paging File free
Paging file location(s): d:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 243,15 Gb Total Space | 183,73 Gb Free Space | 75,56% Space Free | Partition Type: NTFS
Drive D: | 68,36 Gb Total Space | 35,99 Gb Free Space | 52,65% Space Free | Partition Type: NTFS
Drive E: | 48,83 Gb Total Space | 37,50 Gb Free Space | 76,81% Space Free | Partition Type: NTFS
Drive F: | 105,42 Gb Total Space | 87,38 Gb Free Space | 82,89% Space Free | Partition Type: NTFS
Drive N: | 457,95 Gb Total Space | 270,45 Gb Free Space | 59,06% Space Free | Partition Type: NTFS
Drive O: | 457,95 Gb Total Space | 270,45 Gb Free Space | 59,06% Space Free | Partition Type: NTFS
Drive P: | 457,95 Gb Total Space | 270,45 Gb Free Space | 59,06% Space Free | Partition Type: NTFS
Drive R: | 97,66 Gb Total Space | 23,95 Gb Free Space | 24,53% Space Free | Partition Type: NTFS
Drive S: | 200,43 Gb Total Space | 141,72 Gb Free Space | 70,71% Space Free | Partition Type: NTFS
Drive T: | 457,95 Gb Total Space | 21,27 Gb Free Space | 4,64% Space Free | Partition Type: NTFS
Drive U: | 457,95 Gb Total Space | 21,27 Gb Free Space | 4,64% Space Free | Partition Type: NTFS
Drive V: | 457,95 Gb Total Space | 21,27 Gb Free Space | 4,64% Space Free | Partition Type: NTFS
Drive X: | 453,52 Gb Total Space | 101,54 Gb Free Space | 22,39% Space Free | Partition Type: NTFS
Drive Y: | 943,74 Gb Total Space | 124,60 Gb Free Space | 13,20% Space Free | Partition Type: NTFS
 
Computer Name: JONNY-BUERO-7 | User Name: Jonny | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.11 17:01:22 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Jonny\Desktop\OTL.exe
PRC - [2012.08.08 18:29:04 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.11 17:51:24 | 000,557,056 | ---- | M] (Orbitdownloader.com) -- C:\Program Files (x86)\Orbitdownloader\orbitnet.exe
PRC - [2012.07.05 18:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.06.28 18:31:12 | 000,692,432 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) -- C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe
PRC - [2012.05.15 18:53:58 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.15 18:53:56 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
PRC - [2012.05.15 18:53:56 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
PRC - [2012.05.15 18:53:55 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.03.19 21:58:12 | 000,514,128 | ---- | M] (REINER SCT) -- C:\Windows\SysWOW64\cjpcsc.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.11.04 15:40:06 | 000,687,400 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2011.10.15 10:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.03.01 16:47:56 | 002,296,696 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2010.08.03 03:55:00 | 000,582,312 | ---- | M] ( ) -- C:\Programme\Lexmark\ErrorApp\lmab1err.exe
PRC - [2009.09.05 18:29:06 | 000,385,024 | ---- | M] (shbox.de) -- C:\Program Files (x86)\FreePDF_XP\fpassist.exe
PRC - [2008.05.30 15:51:06 | 000,344,064 | ---- | M] () -- C:\Program Files (x86)\Microtek\ScanWizard 5\ScannerFinder.exe
PRC - [2007.08.01 16:37:28 | 001,085,440 | ---- | M] (T-Systems Enterprise Services GmbH) -- C:\Program Files (x86)\T-Online\DSL-Manager\DslMgr.exe
PRC - [2007.08.01 16:36:58 | 000,290,816 | ---- | M] (T-Systems Enterprise Services GmbH) -- C:\Program Files (x86)\T-Online\DSL-Manager\DslMgrSvc.exe
PRC - [2006.11.17 11:42:46 | 000,053,341 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTSched.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2008.05.30 15:51:06 | 000,344,064 | ---- | M] () -- C:\Program Files (x86)\Microtek\ScanWizard 5\ScannerFinder.exe
MOD - [2007.08.27 13:44:58 | 000,049,152 | ---- | M] () -- C:\Program Files (x86)\Microtek\ScanWizard 5\scanners\MPHASE32.DLL
MOD - [2006.05.03 14:16:00 | 000,249,856 | ---- | M] () -- C:\Program Files (x86)\Microtek\ScanWizard 5\SFRes.dll
MOD - [2005.05.04 15:26:10 | 000,045,056 | ---- | M] () -- C:\Program Files (x86)\Microtek\ScanWizard 5\scanners\MS32RES.DLL
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.11.21 16:10:10 | 000,036,160 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysNative\uxtuneup.dll -- (UxTuneUp)
SRV:64bit: - [2010.08.03 03:55:00 | 001,048,576 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lmabcoms.exe -- (lmab_device)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.08.03 15:17:20 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.05 18:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.06.28 18:31:12 | 000,692,432 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto | Running] -- C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 8.0 OnlineUpdate)
SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.15 18:53:58 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.15 18:53:56 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2012.05.15 18:53:56 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2012.05.15 18:53:55 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.03.19 21:58:12 | 000,514,128 | ---- | M] (REINER SCT) [Auto | Running] -- C:\Windows\SysWOW64\cjpcsc.exe -- (cjpcsc)
SRV - [2012.01.04 15:10:14 | 000,607,040 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2012.01.04 14:32:36 | 000,718,888 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.11.21 16:12:56 | 001,403,200 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011.11.21 16:10:04 | 000,030,016 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp)
SRV - [2011.11.04 15:40:06 | 000,687,400 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2011.10.24 09:53:38 | 002,565,632 | ---- | M] (Deutsche Telekom AG) [Auto | Running] -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe -- (Netzmanager Service)
SRV - [2011.10.15 10:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.03.01 16:47:56 | 002,296,696 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2010.08.03 03:55:00 | 000,593,920 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lmabcoms.exe -- (lmab_device)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 22:20:56 | 000,174,440 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose64)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007.08.01 16:36:58 | 000,290,816 | ---- | M] (T-Systems Enterprise Services GmbH) [On_Demand | Running] -- C:\Program Files (x86)\T-Online\DSL-Manager\DslMgrSvc.exe -- (TDslMgrService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.05.15 18:53:59 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.15 18:53:59 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.03 17:28:54 | 000,047,208 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tbhsd.sys -- (tbhsd)
DRV:64bit: - [2012.01.03 17:28:47 | 000,037,480 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rrnetcap.sys -- (RRNetCapMP)
DRV:64bit: - [2012.01.03 17:28:47 | 000,037,480 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rrnetcap.sys -- (RRNetCap)
DRV:64bit: - [2011.11.01 11:07:26 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)
DRV:64bit: - [2011.11.01 11:07:26 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev)
DRV:64bit: - [2011.11.01 11:07:24 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)
DRV:64bit: - [2011.11.01 11:07:24 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)
DRV:64bit: - [2011.10.11 16:06:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.07.29 13:54:56 | 000,016,776 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\epmntdrv.sys -- (epmntdrv)
DRV:64bit: - [2011.07.29 13:54:56 | 000,009,096 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\EuGdiDrv.sys -- (EuGdiDrv)
DRV:64bit: - [2011.03.29 10:50:26 | 000,034,672 | ---- | M] (REINER SCT) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cjusb.sys -- (cjusb)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010.11.21 05:23:48 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.03.04 19:26:58 | 000,349,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2010.01.12 06:19:32 | 000,095,744 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NmPar.sys -- (NmPar)
DRV:64bit: - [2009.09.02 11:29:06 | 000,626,688 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emOEM64.sys -- (USB28xxOEM)
DRV:64bit: - [2009.09.01 15:31:42 | 000,649,984 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emBDA64.sys -- (USB28xxBGA)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.07.14 02:09:02 | 000,120,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\irda.sys -- (irda)
DRV:64bit: - [2009.07.14 01:31:06 | 000,142,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mf.sys -- (mf)
DRV:64bit: - [2009.06.15 18:01:00 | 000,321,376 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\V0540Vid.sys -- (V0540Dev)
DRV:64bit: - [2009.06.10 22:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.08.28 12:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2008.08.06 15:42:26 | 000,022,216 | ---- | M] (Licensed for Gebhard Software) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\DRHARD64.sys -- (DRHARD64)
DRV:64bit: - [2008.05.07 12:20:28 | 000,169,472 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:64bit: - [2008.01.19 06:28:36 | 000,033,792 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\irstusb.sys -- (STIrUsb)
DRV:64bit: - [2007.08.01 16:49:02 | 000,019,008 | ---- | M] (T-Systems Enterprise Services GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dslmnlwf.sys -- (DslMNLwf)
DRV:64bit: - [2007.02.05 18:36:48 | 000,049,664 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\livecamv.sys -- (RLDesignVirtualAudioCableWdm)
DRV - [2012.01.23 14:58:15 | 000,008,864 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\CDAC15BA.SYS -- (CdaC15BA)
DRV - [2011.07.29 13:54:56 | 000,014,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\epmntdrv.sys -- (epmntdrv)
DRV - [2011.07.29 13:54:56 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2010.09.16 17:02:59 | 000,045,664 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Running] -- C:\Programme\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys -- (TelekomNM6)
DRV - [2009.10.14 08:24:44 | 000,011,856 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2008.08.06 15:42:26 | 000,022,216 | ---- | M] (Licensed for Gebhard Software) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\DRHARD64.sys -- (DRHARD64)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = N:\PC\Programme_Sicherung\USB-Fehler
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://portal.sska.de/portal/portal/StartenIPSTANDARD
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C0 6E 20 D1 B7 C7 CC 01  [binary data]
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\..\SearchScopes\{196C1E5A-D5BA-47F8-BF8F-5E81F6C67A99}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1587&src=kw&q={searchTerms}&locale=de_US&apn_ptnrs=^AA9&apn_dtid=^YYYYYY^YY^US&apn_uid=DAA7821A-9D02-4DDB-8F6A-4546A57E7680&apn_sauid=5E635920-C329-42C5-A81C-754FD59B7C86
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGHP_deDE464
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
 
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = N:\PC\Programme_Sicherung\USB-Fehler
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C0 6E 20 D1 B7 C7 CC 01  [binary data]
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - No CLSID value found
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\..\SearchScopes\{196C1E5A-D5BA-47F8-BF8F-5E81F6C67A99}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1587&src=kw&q={searchTerms}&locale=de_US&apn_ptnrs=^AA9&apn_dtid=^YYYYYY^YY^US&apn_uid=DAA7821A-9D02-4DDB-8F6A-4546A57E7680&apn_sauid=5E635920-C329-42C5-A81C-754FD59B7C86
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGHP_deDE464
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.2.1: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.2.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fe_9.0@nokia.com: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_9.0 [2012.03.06 13:21:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\te_9.0@nokia.com: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0 [2012.03.06 13:21:51 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
O3:64bit: - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
O3:64bit: - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Live! Central] C:\Program Files (x86)\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NBAgent] C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001..\Run: []  File not found
O4 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001..\Run: [CreativeTaskScheduler] C:\Program Files (x86)\Creative\Shared Files\CTSched.exe (Creative Technology Ltd)
O4 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001..\Run: [LMab1err] C:\Programme\Lexmark\ErrorApp\lmab1err.exe ( )
O4 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003..\Run: []  File not found
O4 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003..\Run: [CreativeTaskScheduler] C:\Program Files (x86)\Creative\Shared Files\CTSched.exe (Creative Technology Ltd)
O4 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003..\Run: [LMab1err] C:\Programme\Lexmark\ErrorApp\lmab1err.exe ( )
O4 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_270_ActiveX.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003..\RunOnce: [CTPostBootSequencer] "C:\Users\Jonny\AppData\Local\Temp\CTPBSeq.exe" /reglaunch /self_destruct File not found
O4 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files (x86)\T-Online\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
O4 - Startup: C:\Users\Anneliese\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files (x86)\T-Online\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
O4 - Startup: C:\Users\Carolin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files (x86)\T-Online\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files (x86)\T-Online\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
O4 - Startup: C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files (x86)\T-Online\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
O4 - Startup: C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk =  File not found
O4 - Startup: C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShellFolderFix.lnk = C:\Program Files (x86)\ShellFolderFix\ShellFolderFixUI.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 00 00 00 02  [binary data]
O7 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O7 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 00 00 00 02  [binary data]
O7 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O8:64bit: - Extra context menu item: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8:64bit: - Extra context menu item: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8:64bit: - Extra context menu item: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jonny\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jonny\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.1)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {39ED5386-A900-4D6C-B564-20BFDE5402CF} hxxp://www.medion.com/de/service/download/MEDION_Treibersuche.ocx (Medion Control)
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB (CInstallLPCtrl Object)
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} hxxp://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab (HPSDDX Class)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{24FCAC7F-6A7A-421B-ABA4-19D863B35595}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.01.12 20:09:32 | 000,000,000 | ---D | M] - E:\Auto -- [ NTFS ]
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - R:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - State: "bootini" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5F8288E0-31CC-4047-A004-B2B831141FF6} - msiexec /fus {5F8288E0-31CC-4047-A004-B2B831141FF6} /quiet
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.avis - C:\Windows\SysWow64\ff_acm.acm ()
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: VIDC.CSCD - C:\Windows\SysWow64\camcodec.dll (RenderSoft Software)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.16 13:37:21 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Jonny\Desktop\OTL.exe
[2012.08.14 18:29:47 | 000,000,000 | ---D | C] -- C:\Users\Jonny\Desktop\Documents\Outlook-Dateien
[2012.08.13 14:45:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.08.10 18:29:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TSDoctor
[2012.08.10 13:42:07 | 000,000,000 | R--D | C] -- C:\Users\Jonny\Desktop\Server Printer Fritz
[2012.08.05 17:44:45 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Roaming\Malwarebytes
[2012.08.05 17:43:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.05 17:43:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.05 17:43:03 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.05 17:43:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.03 14:10:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microtek ScanWizard 5 für Windows
[2012.08.03 14:10:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microtek
[2012.08.03 13:58:58 | 000,000,000 | ---D | C] -- C:\ProgramData\ABBYY
[2012.07.28 16:25:51 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Local\Macromedia
[2012.07.28 16:19:41 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Local\Mozilla
[2012.07.28 16:19:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.07.28 15:04:38 | 000,000,000 | ---D | C] -- C:\Users\Jonny\Desktop\Documents\Anvsoft
[2012.07.28 15:04:38 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Roaming\Anvsoft
[2012.07.28 15:04:07 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnvSoft
[2012.07.28 15:04:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AnvSoft
[2012.07.27 16:15:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Incomedia WebSite X5 v8 - Evolution
[2012.07.27 16:09:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WebSite X5 v8 - Evolution
[2012.07.27 16:00:30 | 000,000,000 | R--D | C] -- C:\Users\Jonny\Desktop\WEB-Site
[2012.07.27 13:43:24 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Roaming\ABBYY FineReader Engine 9.0
[2012.07.27 13:43:24 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Local\ABBYY FineReader Engine 9.0
[2012.07.23 17:56:17 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Roaming\Serif
[2012.07.23 17:55:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Serif Applications
[2012.07.23 17:55:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\MSSoap
[2012.07.23 17:55:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Serif
[2012.07.23 17:16:17 | 000,000,000 | ---D | C] -- C:\Users\Jonny\Desktop\Documents\Web Creator
[2012.07.23 17:16:16 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Roaming\LMSOFT
[2012.07.23 17:13:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LMSOFT
[2012.07.23 17:07:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.07.23 15:57:30 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Roaming\Nvu
[2012.07.23 15:57:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nvu
[2012.07.23 14:17:54 | 000,000,000 | ---D | C] -- C:\ProgramData\vsosdk
[2012.07.23 13:42:50 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Roaming\BuddyW
[2012.07.23 13:42:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BuddyW
[2012.07.23 13:42:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BuddyW
[2012.07.23 13:38:41 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Roaming\dvdcss
[2012.07.23 13:36:14 | 000,000,000 | ---D | C] -- C:\ProgramData\MagicSoftware
[2012.07.23 13:35:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDx 4.0
[2012.07.23 13:34:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDx 4.0 Open Edition
[2012.07.23 13:34:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Magic DVD Copier
[2012.07.23 13:34:16 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Local\MagicSoftware
[2012.07.23 13:34:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MagicDVDCopier
[2012.07.23 12:34:52 | 000,000,000 | -H-D | C] -- C:\Users\Jonny\Desktop\Documents\Freemake_do_not_remove_this_folder
[2012.07.22 19:11:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\phase5
[2012.07.22 17:34:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PhotonFX
[2012.07.22 17:33:38 | 000,000,000 | ---D | C] -- C:\Users\Jonny\Desktop\Documents\Easy Website Pro 5
[2012.07.22 17:33:37 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Local\Easy Website Pro 5
[2012.07.21 18:25:57 | 000,213,856 | ---- | C] (Incomedia -  www.websitex5.com) -- C:\Windows\SysWow64\iwpsetup.exe
[2012.07.17 15:43:11 | 000,000,000 | ---D | C] -- C:\Users\Jonny\AppData\Roaming\Utherverse
[2012.07.17 15:30:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Utherverse Digital Inc
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[1 C:\Users\Jonny\AppData\Roaming\*.tmp files -> C:\Users\Jonny\AppData\Roaming\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.16 13:40:36 | 000,021,680 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.16 13:40:36 | 000,021,680 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.16 13:36:55 | 000,001,895 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Orbit.lnk
[2012.08.16 13:32:04 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.16 13:31:25 | 000,488,408 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.16 13:31:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.16 13:30:56 | 3220,627,456 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.15 16:33:48 | 000,001,105 | ---- | M] () -- C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
[2012.08.15 16:25:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.15 16:17:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.15 14:44:38 | 000,000,412 | ---- | M] () -- C:\Users\Jonny\Desktop\Documents\spider.sav
[2012.08.15 11:43:41 | 000,000,600 | ---- | M] () -- C:\Users\Jonny\PUTTY.RND
[2012.08.14 15:33:15 | 000,618,227 | ---- | M] () -- C:\Users\Jonny\Desktop\adwcleaner.exe
[2012.08.12 20:20:33 | 000,000,274 | ---- | M] () -- C:\Windows\tasks\AdvancedDriverUpdater.job
[2012.08.11 17:01:22 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Jonny\Desktop\OTL.exe
[2012.08.05 17:43:05 | 000,001,119 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.03 14:22:07 | 000,000,119 | ---- | M] () -- C:\Windows\Ulead32.INI
[2012.08.03 14:10:47 | 000,002,133 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microtek Scanner Finder.lnk
[2012.08.01 12:45:09 | 000,038,494 | ---- | M] () -- C:\Users\Jonny\AppData\Roaming\Kommagetrennte Werte (DOS).ADR
[2012.07.24 20:05:12 | 000,000,131 | ---- | M] () -- C:\Windows\EurekaLog.ini
[2012.07.23 17:52:27 | 000,000,009 | ---- | M] () -- C:\END
[2012.07.18 19:39:10 | 000,000,290 | ---- | M] () -- C:\Windows\tasks\AdvancedDriverUpdater_UPDATES.job
[2012.07.18 18:58:10 | 001,621,244 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.18 18:58:10 | 000,700,168 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.18 18:58:10 | 000,654,880 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.18 18:58:10 | 000,148,964 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.18 18:58:10 | 000,121,752 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[1 C:\Users\Jonny\AppData\Roaming\*.tmp files -> C:\Users\Jonny\AppData\Roaming\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.14 15:33:14 | 000,618,227 | ---- | C] () -- C:\Users\Jonny\Desktop\adwcleaner.exe
[2012.08.09 18:42:34 | 000,000,412 | ---- | C] () -- C:\Users\Jonny\Desktop\Documents\spider.sav
[2012.08.05 17:43:05 | 000,001,119 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.03 14:10:47 | 000,002,133 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microtek Scanner Finder.lnk
[2012.08.01 12:45:06 | 000,038,494 | ---- | C] () -- C:\Users\Jonny\AppData\Roaming\Kommagetrennte Werte (DOS).ADR
[2012.07.24 19:43:43 | 000,000,131 | ---- | C] () -- C:\Windows\EurekaLog.ini
[2012.07.23 17:55:41 | 000,002,489 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Serif WebPlus Starter Edition.lnk
[2012.07.23 17:41:24 | 000,000,009 | ---- | C] () -- C:\END
[2012.07.21 18:25:57 | 000,006,114 | ---- | C] () -- C:\Windows\SysWow64\SHELLLNK.TLB
[2012.06.25 17:55:21 | 002,469,760 | ---- | C] () -- C:\Windows\SysWow64\BootMan.exe
[2012.06.25 17:55:21 | 000,086,408 | ---- | C] () -- C:\Windows\SysWow64\setupempdrv03.exe
[2012.06.25 17:55:21 | 000,019,840 | ---- | C] () -- C:\Windows\SysWow64\EuEpmGdi.dll
[2012.06.25 17:55:21 | 000,014,216 | ---- | C] () -- C:\Windows\SysWow64\epmntdrv.sys
[2012.06.25 17:55:21 | 000,008,456 | ---- | C] () -- C:\Windows\SysWow64\EuGdiDrv.sys
[2012.05.30 18:25:48 | 000,000,016 | ---- | C] () -- C:\Users\Jonny\AppData\Roaming\blckdom.res
[2012.04.17 14:30:10 | 000,167,936 | ---- | C] () -- C:\Windows\SysWow64\SerialXP.dll
[2012.04.11 19:11:31 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2012.03.11 20:43:11 | 000,000,354 | ---- | C] () -- C:\Users\Jonny\AppData\Roaming\dpdhl.versandhelfer_state.xml
[2012.02.25 13:22:35 | 000,004,608 | ---- | C] () -- C:\Users\Jonny\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.24 18:22:01 | 000,316,928 | ---- | C] () -- C:\Windows\SysWow64\hpcc3118.dll
[2012.02.24 14:07:28 | 000,000,000 | ---- | C] () -- C:\Windows\HPMProp.INI
[2012.02.09 17:56:11 | 000,007,606 | ---- | C] () -- C:\Users\Jonny\AppData\Local\resmon.resmoncfg
[2012.02.01 13:26:48 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2012.01.24 17:06:01 | 000,285,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\Onsio.sys
[2012.01.24 17:06:01 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\drivers\Onsreged.sys
[2012.01.23 20:43:32 | 000,000,600 | ---- | C] () -- C:\Users\Jonny\PUTTY.RND
[2012.01.23 14:48:41 | 000,008,864 | ---- | C] () -- C:\Windows\SysWow64\drivers\CDAC15BA.SYS
[2012.01.20 18:40:00 | 000,000,119 | ---- | C] () -- C:\Windows\Ulead32.INI
[2012.01.20 15:52:28 | 001,044,480 | ---- | C] ( ) -- C:\Windows\SysWow64\lmabserv.dll
[2012.01.20 15:52:28 | 000,802,816 | ---- | C] ( ) -- C:\Windows\SysWow64\lmabcomc.dll
[2012.01.20 15:52:28 | 000,593,920 | ---- | C] ( ) -- C:\Windows\SysWow64\lmabcoms.exe
[2012.01.20 15:52:28 | 000,376,832 | ---- | C] ( ) -- C:\Windows\SysWow64\lmabcomm.dll
[2012.01.20 15:52:28 | 000,356,352 | ---- | C] ( ) -- C:\Windows\SysWow64\lmabhcp.dll
[2012.01.10 19:36:16 | 000,079,360 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2012.01.08 15:22:34 | 001,598,202 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.01.07 19:34:31 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll
[2011.12.31 13:16:09 | 000,000,574 | ---- | C] () -- C:\Windows\hbcikrnl.ini
[2011.12.31 13:14:48 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\win32com.dll
[2011.10.15 01:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
 
========== LOP Check ==========
 
[2012.01.13 14:36:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Orbit
[2012.01.13 14:36:39 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\ProgSense
[2012.01.13 14:36:51 | 000,000,000 | ---D | M] -- C:\Users\Anneliese\AppData\Roaming\GHISLER
[2012.08.07 17:37:50 | 000,000,000 | ---D | M] -- C:\Users\Anneliese\AppData\Roaming\Orbit
[2012.01.13 14:36:54 | 000,000,000 | ---D | M] -- C:\Users\Anneliese\AppData\Roaming\ProgSense
[2012.01.13 14:36:54 | 000,000,000 | ---D | M] -- C:\Users\Anneliese\AppData\Roaming\TuneUp Software
[2012.01.13 14:37:33 | 000,000,000 | ---D | M] -- C:\Users\Carolin\AppData\Roaming\GHISLER
[2012.08.06 16:25:21 | 000,000,000 | ---D | M] -- C:\Users\Carolin\AppData\Roaming\Orbit
[2012.01.13 14:37:39 | 000,000,000 | ---D | M] -- C:\Users\Carolin\AppData\Roaming\ProgSense
[2012.07.16 10:06:23 | 000,000,000 | ---D | M] -- C:\Users\Carolin\AppData\Roaming\T-Online
[2012.01.13 14:37:39 | 000,000,000 | ---D | M] -- C:\Users\Carolin\AppData\Roaming\TuneUp Software
[2012.01.13 14:41:49 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\allTunes
[2012.07.28 15:04:38 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Anvsoft
[2012.08.10 16:53:54 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\avidemux
[2012.07.23 14:46:05 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\BuddyW
[2012.01.13 14:41:49 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Cuttermaran
[2012.01.13 14:41:49 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\DeviceDoctorSoftware
[2012.03.11 20:40:33 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\dpdhl.versandhelfer
[2012.08.09 16:26:25 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\DVDVideoSoft
[2012.01.13 14:41:51 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.04.11 18:00:01 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\GetRightToGo
[2012.01.13 14:41:51 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\GHISLER
[2012.01.02 18:51:26 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\GrabPro
[2012.03.09 12:07:06 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\KeePass
[2012.05.30 18:25:38 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\kock
[2012.07.23 17:16:16 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\LMSOFT
[2012.01.13 14:41:53 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\MAGIX
[2012.08.15 11:32:12 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Mp3tag
[2012.06.30 18:29:14 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Nokia
[2012.07.23 15:57:30 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Nvu
[2012.08.16 13:40:22 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Orbit
[2012.03.05 17:36:15 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\PC Suite
[2012.01.13 14:42:09 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\ProgSense
[2012.07.23 17:56:17 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Serif
[2012.08.10 14:00:55 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\ShellFolderFix
[2012.03.08 13:33:33 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\SmartTools
[2012.02.12 18:09:15 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\SpiritON TV Software
[2012.01.13 14:42:10 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Systweak
[2012.04.01 17:25:59 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\T-Online
[2012.01.13 14:42:17 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Tipp4u
[2012.01.13 14:42:17 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\TuneUp Software
[2012.05.30 18:31:21 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\UAs
[2012.02.12 13:35:08 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\UBitMenu
[2012.07.17 15:43:11 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Utherverse
[2012.08.15 11:40:34 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\XBMC
[2012.04.04 14:16:04 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\XMedia Recode
[2012.05.30 18:31:40 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\xmldm
[2012.08.12 20:20:33 | 000,000,274 | ---- | M] () -- C:\Windows\Tasks\AdvancedDriverUpdater.job
[2012.07.18 19:39:10 | 000,000,290 | ---- | M] () -- C:\Windows\Tasks\AdvancedDriverUpdater_UPDATES.job
[2012.06.26 11:26:31 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.01.23 14:42:04 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\ABBYY
[2012.07.27 13:43:24 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\ABBYY FineReader Engine 9.0
[2012.03.11 20:39:44 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Adobe
[2012.01.13 14:41:49 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\allTunes
[2012.07.28 15:04:38 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Anvsoft
[2012.08.10 16:53:54 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\avidemux
[2012.01.13 14:41:49 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Avira
[2012.07.23 14:46:05 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\BuddyW
[2012.01.13 14:41:49 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Creative
[2012.01.13 14:41:49 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Cuttermaran
[2012.01.13 14:41:49 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\DeviceDoctorSoftware
[2012.03.11 20:40:33 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\dpdhl.versandhelfer
[2012.07.23 14:27:26 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\dvdcss
[2012.08.09 16:26:25 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\DVDVideoSoft
[2012.01.13 14:41:51 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.04.11 18:00:01 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\GetRightToGo
[2012.01.13 14:41:51 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\GHISLER
[2012.01.13 14:41:51 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Google
[2012.01.02 18:51:26 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\GrabPro
[2012.01.13 14:41:52 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Identities
[2012.01.13 14:41:52 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\InstallShield
[2012.03.09 12:07:06 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\KeePass
[2012.05.30 18:25:38 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\kock
[2012.07.23 17:16:16 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\LMSOFT
[2012.01.13 14:41:52 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Macromedia
[2012.01.13 14:41:53 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\MAGIX
[2012.08.05 17:44:45 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Malwarebytes
[2011.04.12 09:54:56 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Media Center Programs
[2012.02.21 13:00:23 | 000,000,000 | --SD | M] -- C:\Users\Jonny\AppData\Roaming\Microsoft
[2012.08.15 11:32:12 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Mp3tag
[2012.03.23 17:40:41 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Nero
[2012.06.30 18:29:14 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Nokia
[2012.02.25 19:08:30 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\NVIDIA
[2012.07.23 15:57:30 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Nvu
[2012.08.16 13:40:22 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Orbit
[2012.03.05 17:36:15 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\PC Suite
[2012.01.13 14:42:09 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\ProgSense
[2012.07.23 17:56:17 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Serif
[2012.08.10 14:00:55 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\ShellFolderFix
[2012.08.16 13:40:14 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Skype
[2012.03.08 13:33:33 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\SmartTools
[2012.02.12 18:09:15 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\SpiritON TV Software
[2012.01.13 14:42:10 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Systweak
[2012.04.01 17:25:59 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\T-Online
[2012.01.13 14:42:17 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Tipp4u
[2012.01.13 14:42:17 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\TuneUp Software
[2012.02.01 18:59:16 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\U3
[2012.05.30 18:31:21 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\UAs
[2012.02.12 13:35:08 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\UBitMenu
[2012.07.17 15:43:11 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\Utherverse
[2012.08.15 11:32:53 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\vlc
[2012.08.15 11:40:34 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\XBMC
[2012.04.04 14:16:04 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\XMedia Recode
[2012.05.30 18:31:40 | 000,000,000 | ---D | M] -- C:\Users\Jonny\AppData\Roaming\xmldm
 
< %APPDATA%\*.exe /s >
[2011.06.27 09:42:12 | 000,742,111 | ---- | M] () -- C:\Users\Jonny\AppData\Roaming\Anvsoft\Photo Flash Maker Free Version\template\premium\swftools\as3compile.exe
[2012.07.23 13:42:52 | 001,514,619 | ---- | M] () -- C:\Users\Jonny\AppData\Roaming\BuddyW\bin\Plugins\Fotoeditor\Fotoeditor.exe
[2012.04.05 18:16:58 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Jonny\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2012.01.07 18:53:51 | 000,010,134 | R--- | M] () -- C:\Users\Jonny\AppData\Roaming\Microsoft\Installer\{5F499D33-546A-442B-B0F9-4C58F3B5B6E3}\_098231E8AF6507C191677C.exe
[2012.01.07 18:53:51 | 000,002,238 | R--- | M] () -- C:\Users\Jonny\AppData\Roaming\Microsoft\Installer\{5F499D33-546A-442B-B0F9-4C58F3B5B6E3}\_6FEFF9B68218417F98F549.exe
[2012.01.07 18:53:51 | 000,002,238 | R--- | M] () -- C:\Users\Jonny\AppData\Roaming\Microsoft\Installer\{5F499D33-546A-442B-B0F9-4C58F3B5B6E3}\_AC5D6544F4892BDBD4043C.exe
[2012.01.07 18:53:51 | 000,002,238 | R--- | M] () -- C:\Users\Jonny\AppData\Roaming\Microsoft\Installer\{5F499D33-546A-442B-B0F9-4C58F3B5B6E3}\_D28C1E9A54DE09F40958F2.exe
[2012.01.07 18:53:51 | 000,010,134 | R--- | M] () -- C:\Users\Jonny\AppData\Roaming\Microsoft\Installer\{5F499D33-546A-442B-B0F9-4C58F3B5B6E3}\_FDD89BD3451E0373300C7A.exe
[2012.04.01 17:28:40 | 000,010,134 | R--- | M] () -- C:\Users\Jonny\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
[2012.01.04 14:03:42 | 239,382,288 | ---- | M] (NVIDIA Corporation                                          ) -- C:\Users\Jonny\AppData\Roaming\Systweak\ADU\Advanced Driver Updater\Download\pciven_10de&dev_07da.exe
[2012.01.04 14:42:39 | 239,382,288 | ---- | M] (NVIDIA Corporation                                          ) -- C:\Users\Jonny\AppData\Roaming\Systweak\ADU\Advanced Driver Updater\Download\pciven_10de&dev_07dc.exe
[2012.04.01 13:02:30 | 011,300,288 | ---- | M] () -- C:\Users\Jonny\AppData\Roaming\Systweak\ADU\Advanced Driver Updater\Download\usbvid_1131&pid_1001&rev_0373.EXE
[2012.02.12 13:34:42 | 000,696,341 | ---- | M] () -- C:\Users\Jonny\AppData\Roaming\UBitMenu\unins000.exe
 
< %SYSTEMDRIVE%\*.exe >
[2007.11.07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:C7D0F96D

< End of report >
--- --- ---


LG Jonny

cosinus 16.08.2012 14:07
Poste die Extras auch bitte

jonnyk 16.08.2012 14:40
Hier die "Extras":
OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 16.08.2012 13:41:12 - Run 1
OTL by OldTimer - Version 3.2.57.0    Folder = C:\Users\Jonny\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,43 Gb Available Physical Memory | 60,82% Memory free
8,00 Gb Paging File | 6,09 Gb Available in Paging File | 76,16% Paging File free
Paging file location(s): d:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 243,15 Gb Total Space | 183,73 Gb Free Space | 75,56% Space Free | Partition Type: NTFS
Drive D: | 68,36 Gb Total Space | 35,99 Gb Free Space | 52,65% Space Free | Partition Type: NTFS
Drive E: | 48,83 Gb Total Space | 37,50 Gb Free Space | 76,81% Space Free | Partition Type: NTFS
Drive F: | 105,42 Gb Total Space | 87,38 Gb Free Space | 82,89% Space Free | Partition Type: NTFS
Drive N: | 457,95 Gb Total Space | 270,45 Gb Free Space | 59,06% Space Free | Partition Type: NTFS
Drive O: | 457,95 Gb Total Space | 270,45 Gb Free Space | 59,06% Space Free | Partition Type: NTFS
Drive P: | 457,95 Gb Total Space | 270,45 Gb Free Space | 59,06% Space Free | Partition Type: NTFS
Drive R: | 97,66 Gb Total Space | 23,95 Gb Free Space | 24,53% Space Free | Partition Type: NTFS
Drive S: | 200,43 Gb Total Space | 141,72 Gb Free Space | 70,71% Space Free | Partition Type: NTFS
Drive T: | 457,95 Gb Total Space | 21,27 Gb Free Space | 4,64% Space Free | Partition Type: NTFS
Drive U: | 457,95 Gb Total Space | 21,27 Gb Free Space | 4,64% Space Free | Partition Type: NTFS
Drive V: | 457,95 Gb Total Space | 21,27 Gb Free Space | 4,64% Space Free | Partition Type: NTFS
Drive X: | 453,52 Gb Total Space | 101,54 Gb Free Space | 22,39% Space Free | Partition Type: NTFS
Drive Y: | 943,74 Gb Total Space | 124,60 Gb Free Space | 13,20% Space Free | Partition Type: NTFS
 
Computer Name: JONNY-BUERO-7 | User Name: Jonny | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()
"C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\Orbitdownloader\orbitdm.exe" = C:\Program Files (x86)\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files (x86)\Orbitdownloader\orbitnet.exe" = C:\Program Files (x86)\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()
"C:\Program Files (x86)\Orbitdownloader\orbitdm.exe" = C:\Program Files (x86)\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files (x86)\Orbitdownloader\orbitnet.exe" = C:\Program Files (x86)\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07D615DC-389D-4721-B370-78AD5C955882}" = rport=138 | protocol=17 | dir=out | app=system |
"{0F05C7C2-8159-41E2-BC10-ABEA04BF3480}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{107F6D11-478F-4FDC-9E71-C68D8905B920}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{25809EA8-BECE-4E43-8518-692C8C7A93BF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2DC860E5-803C-42BA-8738-FEC147D0FC7B}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{2F12FAC4-737C-486D-8CDB-E1257547927C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3D695348-07EE-4E41-8738-B210285BCF2A}" = rport=10243 | protocol=6 | dir=out | app=system |
"{4B2138B8-18A3-4A3C-8E8A-361692EC9437}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4E014388-3CD6-4290-9CA9-260C7A730841}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{562C0AA3-7AD9-48AE-A3B1-F420817EAF27}" = lport=10245 | protocol=6 | dir=in | app=system |
"{62F584C2-5E98-4E5E-90A8-199A4E2A86CE}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe |
"{665E8A44-0730-4A42-9E79-952A58D22415}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6A8EF402-E9C7-472B-988B-22047001F95E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6C725F7F-094D-4070-916C-70F98AEAB2B1}" = rport=137 | protocol=17 | dir=out | app=system |
"{6F1C3DC4-5FD1-4F74-B1D3-D593288D3E53}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{784768F9-E4EE-46A6-B7CF-17B15E7FEF98}" = rport=80 | protocol=6 | dir=out | app=system |
"{7BB9D24F-4E96-4A75-BC48-312244651449}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8900B2A8-BF04-4F2B-B6DA-B40545ED24FF}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8B27CF9D-3178-4737-AD30-8A37B13730FB}" = rport=445 | protocol=6 | dir=out | app=system |
"{95ED344B-1CB1-48A6-BA21-2963351A3E37}" = lport=80 | protocol=6 | dir=in | app=system |
"{9C0CCDF2-1319-48C0-AD9C-E6476CD35CEA}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A0BF29B4-1D9D-4910-B6E1-6915ED14253D}" = lport=445 | protocol=6 | dir=in | app=system |
"{AC73AD92-94E1-4E79-A361-297613063E70}" = lport=3389 | protocol=6 | dir=in | svc=termservice | app=%systemroot%\system32\svchost.exe |
"{B075769A-CFB9-4BED-A2D1-BB4D04A07E72}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B4367762-B670-4E59-AE95-EE8E9CD2A2FF}" = lport=138 | protocol=17 | dir=in | app=system |
"{B502C398-82DD-45C6-9F83-10FD3B547E73}" = lport=10243 | protocol=6 | dir=in | app=system |
"{B612ADA0-1F39-43ED-B0A2-563484E65748}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{BD928C6D-3355-44BD-8D10-A26CBB77496B}" = lport=139 | protocol=6 | dir=in | app=system |
"{BF445717-F80F-4DC5-B6ED-2EC35564DE83}" = lport=137 | protocol=17 | dir=in | app=system |
"{DE1CD8B1-F29D-48AE-A9A4-765D5F63DBE9}" = lport=2869 | protocol=6 | dir=in | app=system |
"{E7A99FFA-212D-4033-988A-31ABBF48ADEF}" = rport=139 | protocol=6 | dir=out | app=system |
"{F052431D-FF71-460D-A288-C4CD537676DA}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{F8C726E9-A2B2-4A9B-883F-97BC94B129F9}" = lport=3389 | protocol=6 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A347A17-FB7B-4B77-A805-D5AAF72CD08D}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{0CCC248D-1B0A-48C8-8EEA-232A22DB96E2}" = protocol=6 | dir=in | app=c:\program files (x86)\logitech\logitech harmony remote software 7\harmonyremote.exe |
"{0CD833A4-762E-4200-AF9C-53F2965F96AE}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer_service.exe |
"{18BE20B1-6706-492F-804D-3C5AB2B24DFA}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1AE7CFFB-BC67-457B-A741-76DA257B6EFF}" = protocol=17 | dir=in | app=n:\pc\programme_sicherung\tv_sat\mediathek\zdf\mediathekview.exe |
"{20A67FCB-AC41-49CC-B8C3-7B9ABD4D8F06}" = protocol=17 | dir=in | app=c:\program files (x86)\ultramixer\jre\launch4j-tmp\ultramixer.exe |
"{219A7469-0783-465D-B9AC-036171E1F480}" = protocol=6 | dir=in | app=c:\program files (x86)\ultramixer\jre\bin\javaw.exe |
"{26A81AEB-BDD4-44D7-A010-300BCEC45281}" = dir=in | app=c:\program files (x86)\nokia\nokia suite\nokiasuite.exe |
"{2F85CC43-38BA-4AFA-8B49-2EB74154F62D}" = protocol=17 | dir=in | app=c:\program files (x86)\ultramixer\jre\bin\javaw.exe |
"{323D5490-1D52-4173-8618-3EE44130E1CB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{3C9BED4C-B789-426D-99FB-1D2458084DA2}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{448EF38B-99EA-4B7E-84C2-47703A0DC765}" = protocol=17 | dir=in | app=c:\program files (x86)\starmoney 8.0 s-edition\app\starmoney.exe |
"{503C26BF-97B1-49AB-B2D7-29D4FD756985}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer_service.exe |
"{5271E80B-5672-470B-9B99-44A1906A3987}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{53285FFC-78FD-4912-A9D4-6623DB02388D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{585B3648-48D3-4B29-8E4F-FA02A6ED8354}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5F9D5F25-3820-4C27-BFA1-4C1EE3166C9A}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{6F921C60-8EE0-42B8-A984-698E4AF95CEF}" = protocol=6 | dir=in | app=n:\pc\programme_sicherung\tv_sat\mediathek\zdf\mediathekview.exe |
"{72A79129-D9DE-4E99-AC90-B3864DCF4389}" = protocol=6 | dir=in | app=\\server\jonny\pc\programme_sicherung\usb-fehler\sweetimsetup.exe |
"{757AA9C8-0990-4514-BB41-CE931AE1716C}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer.exe |
"{7E2912E1-EC47-4B62-9910-6BC875B37D90}" = protocol=6 | dir=out | app=system |
"{83183704-387D-4E71-BA0E-4497E26899FD}" = protocol=17 | dir=in | app=c:\program files (x86)\starmoney 8.0 s-edition\ouservice\starmoneyonlineupdate.exe |
"{875D3B5F-474D-419B-A203-31F794CE5905}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer.exe |
"{8E3D46F4-AF04-4E9A-830E-A62E16B7FDDA}" = protocol=17 | dir=in | app=c:\program files (x86)\logitech\logitech harmony remote software 7\harmonyremote.exe |
"{9ECB3932-12DE-40A4-A3AB-43B065C2B2A8}" = protocol=6 | dir=in | app=c:\program files (x86)\starmoney 8.0 s-edition\app\starmoney.exe |
"{A35A7309-6D95-4D71-848A-835940E7630C}" = protocol=6 | dir=in | app=c:\program files (x86)\starmoney 8.0 s-edition\ouservice\starmoneyonlineupdate.exe |
"{A3A77031-9334-4F1D-81EF-608C65A5B715}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{AC93C361-C05E-47E0-9A1F-1EFDB5F0F4F1}" = protocol=17 | dir=in | app=\\server\jonny\pc\programme_sicherung\usb-fehler\sweetimsetup.exe |
"{B18D5B25-89A5-4B97-AA0E-EEB913A6982F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B4A6264A-1645-42BE-B448-F4A32F62EF87}" = dir=in | app=c:\windows\system32\lmabcoms.exe |
"{BA21C812-FDD9-4F9B-B653-1B7F99C7A4D0}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{C2B75A6B-8142-4A78-8531-34A6C722AE82}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{D0C60150-607C-45B7-B8AE-4C05BFE2C014}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D4F5C20C-531F-4488-B254-DC7528C3E23B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{E39DA57D-89CE-4C89-B33E-BA0BBD9F132D}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{E96BF60D-B313-4B7A-A4E0-ADB8960E9B1B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E9B9107E-EDF7-4B6A-9286-21C5F99D89EE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{ECB1D1A2-287E-4024-8A21-2758BF8380D4}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{ED7C967A-B7A5-4AD1-A886-99E6C8448CA9}" = protocol=6 | dir=in | app=c:\program files (x86)\ultramixer\jre\launch4j-tmp\ultramixer.exe |
"{F222BB49-5294-4875-9112-4CFAD9AF81C2}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{F2ABDC29-FD0E-4DAA-A7BF-441D278676DB}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{F454CCC3-669D-4E30-8BB7-34875BADD444}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FAABFF04-5AA4-4C18-8115-293EBE3D07D7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FAB7A9D3-72A5-4483-A464-8FE809A858CE}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{FEA0B069-B70E-49D0-9CE5-9A1F7BA39BEC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{10914A3F-DD29-43A9-B832-10FE48E9F94A}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"TCP Query User{124BAA50-45F9-4219-9C7D-1B4783DAB108}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{12BAD1C5-836B-4786-8278-47675EEAE0AD}C:\program files (x86)\orbitdownloader\orbitnet.exe" = protocol=6 | dir=in | app=c:\program files (x86)\orbitdownloader\orbitnet.exe |
"TCP Query User{41633FB4-8638-4F8E-8123-7C1A47668581}C:\program files (x86)\orbitdownloader\orbitdm.exe" = protocol=6 | dir=in | app=c:\program files (x86)\orbitdownloader\orbitdm.exe |
"TCP Query User{41B2D37E-38AC-40BA-9281-E2E5B373E9E9}C:\program files (x86)\orbitdownloader\orbitnet.exe" = protocol=6 | dir=in | app=c:\program files (x86)\orbitdownloader\orbitnet.exe |
"TCP Query User{67DB2159-E464-4C2B-BD3F-C2178B720911}C:\program files\microsoft office\office14\winword.exe" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\winword.exe |
"TCP Query User{96DD1E1D-EC0B-4801-8F1C-A3AA8641FB4E}C:\hp universal print driver\pcl6-x64-5.4.0.11744\install.exe" = protocol=6 | dir=in | app=c:\hp universal print driver\pcl6-x64-5.4.0.11744\install.exe |
"TCP Query User{97662E27-59E3-45F9-8040-BE6B4BA2B7AF}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{B9EDC67C-A325-4FDB-85C6-C932F2B03810}C:\program files (x86)\xbmc\xbmc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\xbmc\xbmc.exe |
"TCP Query User{DA7990E0-DD54-4314-A4FB-54AC8AA449D9}C:\program files (x86)\website x5 v8 - evolution\website.exe" = protocol=6 | dir=in | app=c:\program files (x86)\website x5 v8 - evolution\website.exe |
"TCP Query User{F601609C-2908-4B95-B189-3EDC8A78CF51}C:\program files (x86)\rapidsolution\audials 9\audials.exe" = protocol=6 | dir=in | app=c:\program files (x86)\rapidsolution\audials 9\audials.exe |
"TCP Query User{FDA674A7-9245-4610-9A6A-8490CA274FF8}C:\program files (x86)\buddyw\buddyw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\buddyw\buddyw.exe |
"UDP Query User{0883F53A-EABA-4C5A-B3A2-1CE9EB2D3E01}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{1C2CB6E2-6953-4A8E-8E70-2BF43EB6B626}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"UDP Query User{26B74CE7-96E0-4473-94DC-2EB989C3DFCE}C:\program files (x86)\rapidsolution\audials 9\audials.exe" = protocol=17 | dir=in | app=c:\program files (x86)\rapidsolution\audials 9\audials.exe |
"UDP Query User{30967E2E-0DE8-4126-AF79-E25C92EE083D}C:\program files (x86)\orbitdownloader\orbitnet.exe" = protocol=17 | dir=in | app=c:\program files (x86)\orbitdownloader\orbitnet.exe |
"UDP Query User{40393D9F-2A4D-4799-93E2-E67E8A6B54DB}C:\hp universal print driver\pcl6-x64-5.4.0.11744\install.exe" = protocol=17 | dir=in | app=c:\hp universal print driver\pcl6-x64-5.4.0.11744\install.exe |
"UDP Query User{52D55E4A-3B62-482F-A977-2C88E0B18BBC}C:\program files (x86)\orbitdownloader\orbitdm.exe" = protocol=17 | dir=in | app=c:\program files (x86)\orbitdownloader\orbitdm.exe |
"UDP Query User{6A84788E-140B-4C4A-93BE-D8AD16C2753C}C:\program files (x86)\buddyw\buddyw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\buddyw\buddyw.exe |
"UDP Query User{7530E00A-8902-4681-A720-EA36FCD801EB}C:\program files (x86)\website x5 v8 - evolution\website.exe" = protocol=17 | dir=in | app=c:\program files (x86)\website x5 v8 - evolution\website.exe |
"UDP Query User{7F066B57-A90B-48D7-9107-FDA022868EA7}C:\program files (x86)\orbitdownloader\orbitnet.exe" = protocol=17 | dir=in | app=c:\program files (x86)\orbitdownloader\orbitnet.exe |
"UDP Query User{7F9C5131-8E6C-4AF6-B4E1-E081B7FBD547}C:\program files\microsoft office\office14\winword.exe" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\winword.exe |
"UDP Query User{CB7B9123-53CE-4C7A-BDD3-C4CBB39B89C3}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"UDP Query User{D04BBAFE-62B5-4668-A85E-477B9DE1A243}C:\program files (x86)\xbmc\xbmc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\xbmc\xbmc.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1111706F-666A-4037-7777-202648764D10}" = JavaFX 2.0.2 (64-bit)
"{2222706F-666A-4037-7777-202648764D10}" = JavaFX 2.0.2 SDK (64-bit)
"{26A24AE4-039D-4CA4-87B4-2F86417002FF}" = Java(TM) 7 Update 2 (64-bit)
"{43B74FAB-FB58-447D-8D3A-5F638AF36FD1}" = Netzmanager
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{5F8288E0-31CC-4047-A004-B2B831141FF6}" = Deutsche Post E-Porto
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{64A3A4F4-B792-11D6-A78A-00B0D0170020}" = Java(TM) SE Development Kit 7 Update 2 (64-bit)
"{680EDA59-9266-44B4-949E-0C24F65DFF82}" = Microsoft_VC100_CRT_SP1_x64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-0015-0407-1000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-1000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-1000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-1000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{70A3169E-288F-454F-A08D-20DF66639B50}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUSR_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-1000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-1000-0000000FF1CE}_Office14.PROPLUSR_{3013A793-10A7-4D1F-B8B4-2FAA82F4D259}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-1000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{98782D5D-A9EE-43C6-88AD-B50AD8530E78}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010
"{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0407-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (German) 2010
"{90140000-0043-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{8DFD91C7-66AE-4E54-9901-5D5F401AD329}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-1000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{8299B64F-1537-4081-974C-033EAB8F098E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-1000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{BC741628-0AFC-405C-8946-DD46D1005A0A}" = 64 Bit HP CIO Components Installer
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"72A50F48CC5601190B9C4E74D81161693133E7F7" = Windows-Treiberpaket - Nokia Modem  (02/25/2011 7.01.0.9)
"Creative VF0540" = Creative Live! Cam Video IM/Video Chat (VF0540) (1.01.03.00)
"E0AC723A3DE3A04256288CADBBB011B112AED454" = Windows-Treiberpaket - Nokia Modem  (02/25/2011 4.7)
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"Lexmark_HostCD" = Lexmark Software deinstallieren
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00107ED7-7DB8-47CD-A50F-E2422D13298F}" = Serif WebPlus Starter Edition 3.0
"{01E9B2FF-DAF4-4529-9CC9-2101625517C7}" = nero.prerequisites.msi
"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)
"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18613ADB-2125-4C71-BBD7-D56136683509}" = MAGIX Audio Cleaning Lab 17 deluxe
"{1DE42AD8-867A-41ED-90BB-2AAB42021ADC}" = MAGIX Speed burnR (MSI)
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FCBD504-AB7D-4757-9A14-850348384B08}" = StarMoney
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 30
"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10
"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)
"{32E2F180-247C-4077-B06A-20F9868568E0}_is1" = UltraMixer 2.4.4
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{345C90FB-FA10-11D5-9C2A-0080C85A0C2D}" = ABBYY FineReader OCR Engine for Microtek
"{3C8B5BE2-8540-47FD-BDAB-24A78E289FB9}" = MAGIX Screenshare
"{4281435C-AD1D-4C8A-B9C0-3961C11EF142}_is1" = YouTube Song Downloader
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AA68A73-DB9C-439D-9481-981C82BD008B}" = Nokia Connectivity Cable Driver
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5C6F884D-680C-448B-B4C9-22296EE1B206}" = Logitech Harmony Remote Software 7
"{5F499D33-546A-442B-B0F9-4C58F3B5B6E3}" = Cuttermaran 1.70
"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)
"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{80F19EAA-44C4-47C2-AE87-1C7628E858D6}" = Logitech Harmony Remote Software 7
"{8471021C-F529-43DE-84DF-3612E10F58C4}" = Remote Control USB Driver
"{85BEC8F6-9AA3-43FF-B56B-8276277137B3}" = Nero 10 Video TransitionPack 1
"{8A0A39D0-9768-43DB-A6AB-1DC30EB06BEA}" = StarMoney 8.0 S-Edition
"{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1" = ClipGrab 3.1.0.2
"{8ABEEC21-B23C-4610-B57A-BE94345D4096}" = Audials
"{8D85149E-D7A0-4920-BEBF-B6CEDFED8D1E}" = MAGIX USB-Videowandler 2
"{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10
"{8F93C410-D762-482B-B2D9-934C475F71FA}" = Nero 10 Creative CollectionPack 1
"{90A455A7-0FC8-4508-B7FA-8F135B8F041A}" = DSL-Manager
"{9193490D-5229-4FC4-9BB9-A6D63C09574A}" = High-Definition Video Playback
"{92D1CEBC-7C72-4ECF-BFC6-C131EF3FE6A7}" = Nokia Suite
"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10
"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C4E03BC-974B-45ED-A0FB-E369E83C45DA}" = MAGIX Video easy Retten Sie Ihre Videokassetten! Edition
"{9DF9C0D4-93AE-4768-A22D-7193B17E821F}" = TSDoctor
"{A2AA4204-C05A-4013-888A-AD153139297F}" = PC Connectivity Solution
"{A70B0C7B-3527-4D53-A694-E9492ECE9EE1}" = Nero 10 Kwik Themes 4
"{A7A0BF2E-31CC-49E3-9913-52C503EB969D}" = Nero Audio Pack 1
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B08D262E-D902-11D5-9C28-0080C85A0C2D}" = ScanWizard 5
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49
"{B9B1BA7F-7E07-49DD-A713-5B397A5BB66B}" = Nero Kwik Media Help (CHM)
"{BE814218-3919-4EA3-868A-2F60BC135CB4}" = Nero Kwik Media
"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components 11
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)
"{C82C515A-CAE3-44B3-B5CC-81C5E4A92E8F}" = Nero Prerequisite Installer 1.0
"{CBCFD97D-FE82-43F4-A978-996CACF71E6B}_is1" = UBitMenuDE
"{D0D14551-3A2D-433B-861F-F4DCE5422759}" = Nokia PC Suite
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)
"{DD238642-14C7-4D54-8BD7-FAD6DEA9999B}" = Nero 10 Kwik Themes 3
"{DDA3C325-47B2-4730-9672-BF3771C08799}_is1" = XMedia Recode Version 3.1.0.5
"{E0825D0B-634F-D1E1-259E-F09FE557B57E}" = Versandhelfer
"{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10
"{E2F2B987-F2BC-4969-95F2-92099486B811}" = StarMoney
"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10
"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EF3A4DAE-F16F-4AC1-87BB-FE00A784084F}" = Nero 10 PiP EffectPack 1
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{FC338210-F594-11D3-BA24-00001C3AB4DF}" = cyberJack Base Components
"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Advanced Driver Updater_is1" = Advanced Driver Updater
"allTunes" = allTunes
"AnvSoft Photo Flash Maker Free" = AnvSoft Photo Flash Maker Free 5.47
"Avidemux 2.5" = Avidemux 2.5
"Avira AntiVir Desktop" = Avira Antivirus Premium 2012
"BuddyW_is1" = BuddyW 1.1.10
"Creative Live! Central" = Creative Live! Central
"dpdhl.versandhelfer" = Versandhelfer
"Dr. Hardware 2011_is1" = Dr. Hardware 2011 11.0d
"DVDx 4.0 Open Edition" = DVDx 4.0 Open Edition
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 9.1.1 Home Edition
"ESET Online Scanner" = ESET Online Scanner v3
"ffdshow_is1" = ffdshow v1.1.4225 [2012-01-05]
"Free 3GP Video Converter_is1" = Free 3GP Video Converter version 5.0.3.1206
"Free Audio Converter_is1" = Free Audio Converter version 2.3.815
"Free DVD Video Converter_is1" = Free DVD Video Converter version 1.5.15.727
"Free Video Dub_is1" = Free Video Dub version 2.0.3.1228
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 5.0.7.403
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.26.706
"Freemake Video Converter_is1" = Freemake Video Converter Version 3.0.1
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"HaaliMkx" = Haali Media Splitter
"Incomedia WebSite X5 v8 - Evolution" = Incomedia WebSite X5 v8 - Evolution
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.0.4 (Basic)
"Magic DVD Copier_is1" = Magic DVD Copier V7.1.0
"MAGIX_MSI_mclab_17dlx" = MAGIX Audio Cleaning Lab 17 deluxe
"MAGIX_MSI_Video_easy_3_RYVT" = MAGIX Video easy Retten Sie Ihre Videokassetten! Edition
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"MKVtoolnix" = MKVtoolnix 5.0.1
"MP3 Cutter_is1" = MP3 Cutter 1.1.1
"Mp3tag" = Mp3tag v2.51
"Netzmanager" = Netzmanager
"Nokia PC Suite" = Nokia PC Suite
"Nokia Suite" = Nokia Suite
"Orbit_is1" = Orbit Downloader
"Picasa 3" = Picasa 3
"SmartToolseBook DAO, ADO Recordsetsv1.00" = SmartTools Publishing • Access eBook DAO, ADO Recordsets
"ST6UNST #1" = Lottoauswertung
"SysInfo" = Creative Systeminformationen
"TeamViewer 6" = TeamViewer 6
"Totalcmd" = Total Commander (Remove or Repair)
"TuneUp Utilities" = TuneUp Utilities
"VLC media player" = VLC media player 2.0.2
"XMedia Recode" = XMedia Recode 3.0.8.8
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1876380478-2552088986-1969383942-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"XBMC" = XBMC
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1876380478-2552088986-1969383942-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"XBMC" = XBMC
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 12.08.2012 13:00:09 | Computer Name = Jonny-Buero-7 | Source = Windows Backup | ID = 4103
Description =
 
Error - 12.08.2012 14:30:49 | Computer Name = Jonny-Buero-7 | Source = WinMgmt | ID = 10
Description =
 
Error - 13.08.2012 08:42:43 | Computer Name = Jonny-Buero-7 | Source = WinMgmt | ID = 10
Description =
 
Error - 13.08.2012 15:00:34 | Computer Name = Jonny-Buero-7 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: TOTALCMD.EXE, Version: 8.0.1.0, Zeitstempel:
 0x2a425e19  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel:
 0x4ec49b8f  Ausnahmecode: 0xc0000374  Fehleroffset: 0x000ce6c3  ID des fehlerhaften Prozesses:
 0x19c  Startzeit der fehlerhaften Anwendung: 0x01cd7982ff23ca9c  Pfad der fehlerhaften
 Anwendung: C:\totalcmd\TOTALCMD.EXE  Pfad des fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll
Berichtskennung:
 28e636c8-e579-11e1-a622-0021859dd54d
 
Error - 14.08.2012 09:24:08 | Computer Name = Jonny-Buero-7 | Source = WinMgmt | ID = 10
Description =
 
Error - 14.08.2012 12:55:32 | Computer Name = Jonny-Buero-7 | Source = WinMgmt | ID = 10
Description =
 
Error - 15.08.2012 05:18:07 | Computer Name = Jonny-Buero-7 | Source = WinMgmt | ID = 10
Description =
 
Error - 15.08.2012 07:24:51 | Computer Name = Jonny-Buero-7 | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "c:\program files
 (x86)\ESET\eset online scanner\ESETSmartInstaller.exe". Fehler in  Manifest- oder
 Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion
 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt
 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 16.08.2012 07:32:31 | Computer Name = Jonny-Buero-7 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: orbitdm.exe, Version: 4.1.1.1, Zeitstempel:
 0x4ffd4d51  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel:
 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00036a98  ID des fehlerhaften Prozesses:
 0xf80  Startzeit der fehlerhaften Anwendung: 0x01cd7ba2c8058600  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Orbitdownloader\orbitdm.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: 1093d32c-e796-11e1-8384-0021859dd54d
 
Error - 16.08.2012 07:32:48 | Computer Name = Jonny-Buero-7 | Source = WinMgmt | ID = 10
Description =
 
[ System Events ]
Error - 19.06.2012 05:09:04 | Computer Name = Jonny-Buero-7 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "CdaC15BA" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%1275
 
Error - 20.06.2012 13:40:32 | Computer Name = Jonny-Buero-7 | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\SysWow64\drivers\CDAC15BA.SYS
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 20.06.2012 13:40:32 | Computer Name = Jonny-Buero-7 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "CdaC15BA" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%1275
 
Error - 22.06.2012 08:33:44 | Computer Name = Jonny-Buero-7 | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\SysWow64\drivers\CDAC15BA.SYS
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 22.06.2012 08:33:44 | Computer Name = Jonny-Buero-7 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "CdaC15BA" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%1275
 
Error - 24.06.2012 07:47:23 | Computer Name = Jonny-Buero-7 | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\SysWow64\drivers\CDAC15BA.SYS
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 24.06.2012 07:47:23 | Computer Name = Jonny-Buero-7 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "CdaC15BA" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%1275
 
Error - 25.06.2012 05:38:21 | Computer Name = Jonny-Buero-7 | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\SysWow64\drivers\CDAC15BA.SYS
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 25.06.2012 05:38:21 | Computer Name = Jonny-Buero-7 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "CdaC15BA" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%1275
 
Error - 25.06.2012 11:06:45 | Computer Name = Jonny-Buero-7 | Source = VDS Dynamic Provider | ID = 16908310
Description =
 
 
< End of report >
--- --- ---

cosinus 17.08.2012 17:36
Ist das rein zufällig ein Büro- bzw. hauptsächlich gewerblich genutzer PC?

jonnyk 18.08.2012 10:15
Hallo,

Büro bezeichnet nur den Standort, also rein privat!
Hatte früher mal Vermietung und home-Office und immer schon PC's und die stehen halt jetzt im "Büro"

Jonny

cosinus 18.08.2012 13:41
Und was ist das für ein Plattenzirkus was du da in deinem Rechner hast von Laufwerk C bis Y :confused:
Oder sind die meisten davon Netzwerlaufwerke, die auch nicht in dieser Anzahl besonders typisch sind für reine Heimanwender?

Zitat:
64bit- Professional Service Pack 1
Professional Editiion als Heimanwender ist nicht gerade üblich - war das früher mal dein Arbeitsrechner, also nicht privat?

jonnyk 18.08.2012 14:11
Hallo,
mal ganz vorsichtig gefragt:
ist Deine Anfrage wesentlich für die Bereinigung des Systems?

Aber, ich habe keine Geheimnisse, hier die Verwendung der LW's:

C:\ = Systempartition WIN7
D:\ = Datenpartition WIN7
E:\ = Musikpartition WIN7
F:\ = Grafik- bzw Fotopartition WIN7
G:\ = DVD-LW
I - L = Kartenslots
N:\ = Netzlaufwerk (meins)
O:\ = Netzlaufwerk (meiner Frau)
P:\ = Netzlaufwerk (meiner Tochter)
R:\ = Systempartition VISTA auf zweiter Platte (dort C:\)
S:\ = Sicherungspartition für WIN7 Systemsicherung auf zweiter Platte (dort D:\)
T:\ = Netzlaufwerk (AktivityMediaCenter) Fotos, verbunden mit HUMAX
U:\ = Netzlaufwerk (AktivityMediaCenter) Musik, verbunden mit HUMAX
V:\ = Netzlaufwerk (AktivityMediaCenter) Videoas, verbunden mit HUMAX
X:\ = externe Festplatte, Video-Vearbeitungspartition
Y:\ = externe Festplasse, Sicherungspartition für Netzlaufwerke N, O, P, T, U und V

Das mag evtl. wie ein Zirkus aussehen, hat aber m.E. durchaus System.
Da die Rechner meiner Frau und meiner Tochter lokal nicht gesichert werden, arbeiten sie jeweils nur auf den Netzlaufwerken.

Nochmals, wir sind nicht gewerblich, sondern eben nur ein Haushalt mit mehreren PC's und ich lege halt nun mal wert auf korekte Sicherung unserer Daten, da mir schon zweimal Festplatten abgeraucht sind!

Zu Deier Frage hinsichtlich 64 Bit:
Der Sohn meiner Frau war bis 2011 bei Fujitsu beschäftigt und hatte offiziellen Zugang zu mehreren WIN7 Lizenzen.
Warum sollte ich da bei meinem Rechner nicht die 64 Bit Version einsetzen?

Ich hoffe Deine Fragen ausreichend beantwortet zu haben.

LG Jonny

cosinus 18.08.2012 14:29
Danke - ich muss einfach Sachen auf den Grund gehen wenn sie mir komisch vorkommen, Büro-PCs werden nämlich idR nicht bereinigt


Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
IE - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\..\SearchScopes\{196C1E5A-D5BA-47F8-BF8F-5E81F6C67A99}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1587&src=kw&q={searchTerms}&locale=de_US&apn_ptnrs=^AA9&apn_dtid=^YYYYYY^YY^US&apn_uid=DAA7821A-9D02-4DDB-8F6A-4546A57E7680&apn_sauid=5E635920-C329-42C5-A81C-754FD59B7C86
O4 - HKLM..\Run: []  File not found
O4 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001..\Run: []  File not found
O4 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003..\Run: []  File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 00 00 00 02  [binary data]
O7 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O7 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 00 00 00 02  [binary data]
O7 - HKU\S-1-5-21-1876380478-2552088986-1969383942-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.01.12 20:09:32 | 000,000,000 | ---D | M] - E:\Auto -- [ NTFS ]
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - R:\autoexec.bat -- [ NTFS ]
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:C7D0F96D
:Files
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache
D:\Programme_sicherung\Netz-Tools\Netzmanager\SoftonicDownloader_fuer_netzmanager.exe
C:\Users\Jonny\AppData\Roaming\kock
C:\Users\Jonny\AppData\Roaming\UAs
C:\Users\Jonny\AppData\Roaming\xmldm
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

jonnyk 19.08.2012 12:36
Hi,
sorry, wusste ich nicht, dass nur private Rechner bereinigt, verstehe ich natütrlich!

Hier das Log:

Code:
All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-1876380478-2552088986-1969383942-1003\Software\Microsoft\Internet Explorer\SearchScopes\{196C1E5A-D5BA-47F8-BF8F-5E81F6C67A99}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{196C1E5A-D5BA-47F8-BF8F-5E81F6C67A99}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1876380478-2552088986-1969383942-1001\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1876380478-2552088986-1969383942-1003\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1876380478-2552088986-1969383942-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLinkedConnections deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1876380478-2552088986-1969383942-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1876380478-2552088986-1969383942-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1876380478-2552088986-1969383942-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1876380478-2552088986-1969383942-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File  not found.
R:\autoexec.bat moved successfully.
ADS C:\ProgramData\TEMP:C7D0F96D deleted successfully.
========== FILES ==========
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\users\Jonny\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File\Folder D:\Programme_sicherung\Netz-Tools\Netzmanager\SoftonicDownloader_fuer_netzmanager.exe not found.
C:\Users\Jonny\AppData\Roaming\kock folder moved successfully.
C:\Users\Jonny\AppData\Roaming\UAs folder moved successfully.
C:\Users\Jonny\AppData\Roaming\xmldm folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Anneliese
->Temp folder emptied: 130627 bytes
->Temporary Internet Files folder emptied: 27749316 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 979 bytes
 
User: Carolin
->Temp folder emptied: 112612 bytes
->Temporary Internet Files folder emptied: 144991794 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 1674 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56466 bytes
 
User: Jonny
->Temp folder emptied: 24552601 bytes
->Temporary Internet Files folder emptied: 3911301933 bytes
->Flash cache emptied: 144158 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 1871354 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 508928 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2380838 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67899 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 3.923,00 mb
 
 
[EMPTYFLASH]
 
User: Administrator
 
User: Anneliese
->Flash cache emptied: 0 bytes
 
User: Carolin
->Flash cache emptied: 0 bytes
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Jonny
->Flash cache emptied: 0 bytes
 
User: Public
 
User: UpdatusUser
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.57.0 log created on 08192012_132515

Files\Folders moved on Reboot...
C:\Users\Jonny\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\Jonny\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...
LG Jonny

cosinus 20.08.2012 17:12
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

jonnyk 21.08.2012 12:07
Hi,
hier TDSSKilleer:

Code:
12:58:17.0453 3020  TDSS rootkit removing tool 2.8.7.0 Aug 20 2012 17:30:03
12:58:17.0640 3020  ============================================================
12:58:17.0640 3020  Current date / time: 2012/08/21 12:58:17.0640
12:58:17.0640 3020  SystemInfo:
12:58:17.0640 3020 
12:58:17.0640 3020  OS Version: 6.1.7601 ServicePack: 1.0
12:58:17.0640 3020  Product type: Workstation
12:58:17.0640 3020  ComputerName: JONNY-BUERO-7
12:58:17.0640 3020  UserName: Jonny
12:58:17.0640 3020  Windows directory: C:\Windows
12:58:17.0640 3020  System windows directory: C:\Windows
12:58:17.0640 3020  Running under WOW64
12:58:17.0640 3020  Processor architecture: Intel x64
12:58:17.0640 3020  Number of processors: 4
12:58:17.0640 3020  Page size: 0x1000
12:58:17.0640 3020  Boot type: Normal boot
12:58:17.0640 3020  ============================================================
12:58:22.0788 3020  Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
12:58:22.0788 3020  Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
12:58:22.0804 3020  Drive \Device\Harddisk6\DR6 - Size: 0x15D50F66000 (1397.27 Gb), SectorSize: 0x200, Cylinders: 0x2C881, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
12:58:22.0819 3020  ============================================================
12:58:22.0819 3020  \Device\Harddisk0\DR0:
12:58:22.0819 3020  MBR partitions:
12:58:22.0819 3020  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xC350000
12:58:22.0819 3020  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xC350800, BlocksNum 0x190DD000
12:58:22.0819 3020  \Device\Harddisk1\DR1:
12:58:22.0819 3020  MBR partitions:
12:58:22.0819 3020  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x1E64C000
12:58:22.0819 3020  \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x1E64C800, BlocksNum 0x88B8000
12:58:22.0819 3020  \Device\Harddisk1\DR1\Partition3: MBR, Type 0x7, StartLBA 0x26F04800, BlocksNum 0x61A8000
12:58:22.0850 3020  \Device\Harddisk1\DR1\Partition4: MBR, Type 0x7, StartLBA 0x2D0AD000, BlocksNum 0xD2D8800
12:58:22.0850 3020  \Device\Harddisk6\DR6:
12:58:22.0850 3020  MBR partitions:
12:58:22.0850 3020  \Device\Harddisk6\DR6\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x38B08FC8
12:58:22.0850 3020  \Device\Harddisk6\DR6\Partition2: MBR, Type 0x7, StartLBA 0x38B0D248, BlocksNum 0x75F795B8
12:58:22.0850 3020  ============================================================
12:58:22.0882 3020  C: <-> \Device\Harddisk1\DR1\Partition1
12:58:22.0897 3020  X: <-> \Device\Harddisk6\DR6\Partition1
12:58:22.0928 3020  S: <-> \Device\Harddisk0\DR0\Partition2
12:58:22.0960 3020  E: <-> \Device\Harddisk1\DR1\Partition3
12:58:22.0991 3020  F: <-> \Device\Harddisk1\DR1\Partition4
12:58:23.0006 3020  R: <-> \Device\Harddisk0\DR0\Partition1
12:58:23.0038 3020  D: <-> \Device\Harddisk1\DR1\Partition2
12:58:23.0069 3020  Y: <-> \Device\Harddisk6\DR6\Partition2
12:58:23.0069 3020  ============================================================
12:58:23.0069 3020  Initialize success
12:58:23.0069 3020  ============================================================
12:59:27.0965 1292  ============================================================
12:59:27.0965 1292  Scan started
12:59:27.0965 1292  Mode: Manual; SigCheck; TDLFS;
12:59:27.0965 1292  ============================================================
12:59:29.0228 1292  ================ Scan services =============================
12:59:29.0322 1292  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\DRIVERS\1394ohci.sys
12:59:29.0400 1292  1394ohci - ok
12:59:29.0431 1292  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
12:59:29.0447 1292  ACPI - ok
12:59:29.0462 1292  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
12:59:29.0509 1292  AcpiPmi - ok
12:59:29.0572 1292  [ 62B7936F9036DD6ED36E6A7EFA805DC0 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
12:59:29.0587 1292  AdobeARMservice - ok
12:59:29.0650 1292  [ A9D3B95E8466BD58EEB8A1154654E162 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
12:59:29.0665 1292  AdobeFlashPlayerUpdateSvc - ok
12:59:29.0681 1292  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
12:59:29.0712 1292  adp94xx - ok
12:59:29.0728 1292  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\drivers\adpahci.sys
12:59:29.0743 1292  adpahci - ok
12:59:29.0759 1292  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\drivers\adpu320.sys
12:59:29.0774 1292  adpu320 - ok
12:59:29.0790 1292  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
12:59:29.0915 1292  AeLookupSvc - ok
12:59:29.0962 1292  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD            C:\Windows\system32\drivers\afd.sys
12:59:30.0024 1292  AFD - ok
12:59:30.0040 1292  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
12:59:30.0055 1292  agp440 - ok
12:59:30.0071 1292  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
12:59:30.0118 1292  ALG - ok
12:59:30.0133 1292  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
12:59:30.0149 1292  aliide - ok
12:59:30.0149 1292  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
12:59:30.0164 1292  amdide - ok
12:59:30.0180 1292  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
12:59:30.0211 1292  AmdK8 - ok
12:59:30.0227 1292  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
12:59:30.0242 1292  AmdPPM - ok
12:59:30.0274 1292  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
12:59:30.0289 1292  amdsata - ok
12:59:30.0320 1292  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
12:59:30.0336 1292  amdsbs - ok
12:59:30.0352 1292  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
12:59:30.0367 1292  amdxata - ok
12:59:30.0414 1292  [ B9B5DFAFEA592BD4CA967824EBB42E3D ] AntiVirMailService C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
12:59:30.0430 1292  AntiVirMailService - ok
12:59:30.0461 1292  [ 67B1D78711B4386C26241096326EE14A ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
12:59:30.0461 1292  AntiVirSchedulerService - ok
12:59:30.0492 1292  [ 845C4E7AE211EDAD5E0B832126F56932 ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
12:59:30.0492 1292  AntiVirService - ok
12:59:30.0523 1292  [ 30D71E0C149943A8985D02EA0944F2FE ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
12:59:30.0539 1292  AntiVirWebService - ok
12:59:30.0554 1292  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\Windows\system32\drivers\appid.sys
12:59:30.0632 1292  AppID - ok
12:59:30.0664 1292  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
12:59:30.0710 1292  AppIDSvc - ok
12:59:30.0710 1292  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo        C:\Windows\System32\appinfo.dll
12:59:30.0773 1292  Appinfo - ok
12:59:30.0788 1292  [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt        C:\Windows\System32\appmgmts.dll
12:59:30.0835 1292  AppMgmt - ok
12:59:30.0851 1292  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\drivers\arc.sys
12:59:30.0866 1292  arc - ok
12:59:30.0882 1292  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\drivers\arcsas.sys
12:59:30.0898 1292  arcsas - ok
12:59:30.0976 1292  [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
12:59:30.0991 1292  aspnet_state - ok
12:59:31.0007 1292  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
12:59:31.0069 1292  AsyncMac - ok
12:59:31.0069 1292  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\drivers\atapi.sys
12:59:31.0085 1292  atapi - ok
12:59:31.0116 1292  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
12:59:31.0178 1292  AudioEndpointBuilder - ok
12:59:31.0194 1292  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
12:59:31.0225 1292  AudioSrv - ok
12:59:31.0241 1292  [ 26E38B5A58C6C55FAFBC563EEDDB0867 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
12:59:31.0288 1292  avgntflt - ok
12:59:31.0303 1292  [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
12:59:31.0303 1292  avipbb - ok
12:59:31.0334 1292  [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
12:59:31.0334 1292  avkmgr - ok
12:59:31.0366 1292  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
12:59:31.0444 1292  AxInstSV - ok
12:59:31.0475 1292  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\drivers\bxvbda.sys
12:59:31.0506 1292  b06bdrv - ok
12:59:31.0553 1292  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
12:59:31.0600 1292  b57nd60a - ok
12:59:31.0631 1292  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
12:59:31.0678 1292  BDESVC - ok
12:59:31.0693 1292  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
12:59:31.0740 1292  Beep - ok
12:59:31.0771 1292  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\Windows\System32\bfe.dll
12:59:31.0834 1292  BFE - ok
12:59:31.0865 1292  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll
12:59:31.0943 1292  BITS - ok
12:59:31.0958 1292  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
12:59:31.0974 1292  blbdrive - ok
12:59:32.0005 1292  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
12:59:32.0036 1292  bowser - ok
12:59:32.0052 1292  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
12:59:32.0083 1292  BrFiltLo - ok
12:59:32.0083 1292  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
12:59:32.0099 1292  BrFiltUp - ok
12:59:32.0130 1292  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser        C:\Windows\System32\browser.dll
12:59:32.0161 1292  Browser - ok
12:59:32.0177 1292  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
12:59:32.0224 1292  Brserid - ok
12:59:32.0239 1292  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
12:59:32.0255 1292  BrSerWdm - ok
12:59:32.0270 1292  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
12:59:32.0286 1292  BrUsbMdm - ok
12:59:32.0302 1292  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
12:59:32.0302 1292  BrUsbSer - ok
12:59:32.0333 1292  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum        C:\Windows\system32\drivers\BthEnum.sys
12:59:32.0380 1292  BthEnum - ok
12:59:32.0380 1292  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
12:59:32.0411 1292  BTHMODEM - ok
12:59:32.0426 1292  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
12:59:32.0458 1292  BthPan - ok
12:59:32.0504 1292  [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT        C:\Windows\System32\Drivers\BTHport.sys
12:59:32.0536 1292  BTHPORT - ok
12:59:32.0551 1292  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
12:59:32.0598 1292  bthserv - ok
12:59:32.0614 1292  [ F188B7394D81010767B6DF3178519A37 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
12:59:32.0629 1292  BTHUSB - ok
12:59:32.0645 1292  CdaC15BA - ok
12:59:32.0660 1292  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
12:59:32.0707 1292  cdfs - ok
12:59:32.0723 1292  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
12:59:32.0738 1292  cdrom - ok
12:59:32.0754 1292  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\Windows\System32\certprop.dll
12:59:32.0801 1292  CertPropSvc - ok
12:59:32.0816 1292  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\drivers\circlass.sys
12:59:32.0832 1292  circlass - ok
12:59:32.0863 1292  [ ED81E81752CA817AFA740C14AD05BC6C ] cjpcsc          C:\Windows\SysWOW64\cjpcsc.exe
12:59:32.0879 1292  cjpcsc - ok
12:59:32.0894 1292  [ 06E1F5228399FC49A8D026DA38DB6784 ] cjusb          C:\Windows\system32\DRIVERS\cjusb.sys
12:59:32.0910 1292  cjusb - ok
12:59:32.0941 1292  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
12:59:32.0957 1292  CLFS - ok
12:59:32.0988 1292  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:59:33.0004 1292  clr_optimization_v2.0.50727_32 - ok
12:59:33.0035 1292  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
12:59:33.0050 1292  clr_optimization_v2.0.50727_64 - ok
12:59:33.0082 1292  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
12:59:33.0175 1292  clr_optimization_v4.0.30319_32 - ok
12:59:33.0191 1292  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
12:59:33.0222 1292  clr_optimization_v4.0.30319_64 - ok
12:59:33.0238 1292  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
12:59:33.0253 1292  CmBatt - ok
12:59:33.0269 1292  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
12:59:33.0284 1292  cmdide - ok
12:59:33.0300 1292  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG            C:\Windows\system32\Drivers\cng.sys
12:59:33.0362 1292  CNG - ok
12:59:33.0378 1292  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
12:59:33.0378 1292  Compbatt - ok
12:59:33.0394 1292  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
12:59:33.0425 1292  CompositeBus - ok
12:59:33.0425 1292  COMSysApp - ok
12:59:33.0440 1292  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
12:59:33.0456 1292  crcdisk - ok
12:59:33.0472 1292  [ 4F5414602E2544A4554D95517948B705 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
12:59:33.0581 1292  CryptSvc - ok
12:59:33.0628 1292  [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC            C:\Windows\system32\drivers\csc.sys
12:59:33.0690 1292  CSC - ok
12:59:33.0721 1292  [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService      C:\Windows\System32\cscsvc.dll
12:59:33.0752 1292  CscService - ok
12:59:33.0784 1292  [ B18AB4F8F194E9F0E35D3AF5AF578D14 ] CtClsFlt        C:\Windows\system32\DRIVERS\CtClsFlt.sys
12:59:33.0830 1292  CtClsFlt - ok
12:59:33.0846 1292  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
12:59:33.0893 1292  DcomLaunch - ok
12:59:33.0924 1292  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
12:59:33.0971 1292  defragsvc - ok
12:59:33.0986 1292  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
12:59:34.0033 1292  DfsC - ok
12:59:34.0049 1292  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
12:59:34.0111 1292  Dhcp - ok
12:59:34.0111 1292  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
12:59:34.0158 1292  discache - ok
12:59:34.0174 1292  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\drivers\disk.sys
12:59:34.0189 1292  Disk - ok
12:59:34.0220 1292  [ 5DB085A8A6600BE6401F2B24EECB5415 ] dmvsc          C:\Windows\system32\drivers\dmvsc.sys
12:59:34.0267 1292  dmvsc - ok
12:59:34.0283 1292  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
12:59:34.0330 1292  Dnscache - ok
12:59:34.0345 1292  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\Windows\System32\dot3svc.dll
12:59:34.0392 1292  dot3svc - ok
12:59:34.0408 1292  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\Windows\system32\dps.dll
12:59:34.0454 1292  DPS - ok
12:59:34.0454 1292  DRHARD - ok
12:59:34.0470 1292  [ 2A53AA388EB00FB6C57D43DBFE89C972 ] DRHARD64        C:\Windows\system32\drivers\DRHARD64.sys
12:59:34.0486 1292  DRHARD64 - ok
12:59:34.0517 1292  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
12:59:34.0532 1292  drmkaud - ok
12:59:34.0548 1292  [ D52EEB224DF107AAD9059597F0EB95CC ] DslMNLwf        C:\Windows\system32\DRIVERS\dslmnlwf.sys
12:59:34.0564 1292  DslMNLwf - ok
12:59:34.0595 1292  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
12:59:34.0626 1292  DXGKrnl - ok
12:59:34.0657 1292  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
12:59:34.0704 1292  EapHost - ok
12:59:34.0766 1292  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\drivers\evbda.sys
12:59:34.0829 1292  ebdrv - ok
12:59:34.0860 1292  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\Windows\System32\lsass.exe
12:59:34.0891 1292  EFS - ok
12:59:34.0938 1292  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
12:59:35.0000 1292  ehRecvr - ok
12:59:35.0000 1292  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
12:59:35.0016 1292  ehSched - ok
12:59:35.0047 1292  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\drivers\elxstor.sys
12:59:35.0063 1292  elxstor - ok
12:59:35.0078 1292  [ 9EAFB3B3B60B8AD958985152A9309ACA ] epmntdrv        C:\Windows\system32\epmntdrv.sys
12:59:35.0094 1292  epmntdrv ( UnsignedFile.Multi.Generic ) - warning
12:59:35.0094 1292  epmntdrv - detected UnsignedFile.Multi.Generic (1)
12:59:35.0110 1292  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
12:59:35.0141 1292  ErrDev - ok
12:59:35.0156 1292  [ FB949ED2C93C878A189039F3D7730942 ] EuGdiDrv        C:\Windows\system32\EuGdiDrv.sys
12:59:35.0172 1292  EuGdiDrv ( UnsignedFile.Multi.Generic ) - warning
12:59:35.0172 1292  EuGdiDrv - detected UnsignedFile.Multi.Generic (1)
12:59:35.0203 1292  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
12:59:35.0266 1292  EventSystem - ok
12:59:35.0281 1292  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
12:59:35.0312 1292  exfat - ok
12:59:35.0344 1292  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
12:59:35.0375 1292  fastfat - ok
12:59:35.0406 1292  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\Windows\system32\fxssvc.exe
12:59:35.0468 1292  Fax - ok
12:59:35.0500 1292  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\drivers\fdc.sys
12:59:35.0515 1292  fdc - ok
12:59:35.0531 1292  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
12:59:35.0578 1292  fdPHost - ok
12:59:35.0593 1292  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
12:59:35.0640 1292  FDResPub - ok
12:59:35.0656 1292  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
12:59:35.0671 1292  FileInfo - ok
12:59:35.0671 1292  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
12:59:35.0718 1292  Filetrace - ok
12:59:35.0734 1292  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
12:59:35.0749 1292  flpydisk - ok
12:59:35.0765 1292  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
12:59:35.0780 1292  FltMgr - ok
12:59:35.0827 1292  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache      C:\Windows\system32\FntCache.dll
12:59:35.0858 1292  FontCache - ok
12:59:35.0905 1292  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
12:59:35.0921 1292  FontCache3.0.0.0 - ok
12:59:35.0921 1292  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
12:59:35.0936 1292  FsDepends - ok
12:59:35.0952 1292  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
12:59:35.0968 1292  Fs_Rec - ok
12:59:35.0968 1292  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
12:59:35.0999 1292  fvevol - ok
12:59:36.0014 1292  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
12:59:36.0030 1292  gagp30kx - ok
12:59:36.0061 1292  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\Windows\System32\gpsvc.dll
12:59:36.0108 1292  gpsvc - ok
12:59:36.0170 1292  [ F02A533F517EB38333CB12A9E8963773 ] gupdate        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
12:59:36.0170 1292  gupdate - ok
12:59:36.0186 1292  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
12:59:36.0186 1292  gupdatem - ok
12:59:36.0202 1292  [ CC839E8D766CC31A7710C9F38CF3E375 ] gusvc          C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
12:59:36.0217 1292  gusvc - ok
12:59:36.0233 1292  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
12:59:36.0264 1292  hcw85cir - ok
12:59:36.0280 1292  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
12:59:36.0311 1292  HdAudAddService - ok
12:59:36.0326 1292  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
12:59:36.0342 1292  HDAudBus - ok
12:59:36.0358 1292  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\drivers\HidBatt.sys
12:59:36.0373 1292  HidBatt - ok
12:59:36.0389 1292  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
12:59:36.0420 1292  HidBth - ok
12:59:36.0451 1292  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\drivers\hidir.sys
12:59:36.0467 1292  HidIr - ok
12:59:36.0482 1292  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\system32\hidserv.dll
12:59:36.0514 1292  hidserv - ok
12:59:36.0529 1292  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
12:59:36.0545 1292  HidUsb - ok
12:59:36.0576 1292  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
12:59:36.0623 1292  hkmsvc - ok
12:59:36.0638 1292  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
12:59:36.0670 1292  HomeGroupListener - ok
12:59:36.0701 1292  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
12:59:36.0732 1292  HomeGroupProvider - ok
12:59:36.0732 1292  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
12:59:36.0748 1292  HpSAMD - ok
12:59:36.0779 1292  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
12:59:36.0826 1292  HTTP - ok
12:59:36.0841 1292  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
12:59:36.0857 1292  hwpolicy - ok
12:59:36.0872 1292  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
12:59:36.0888 1292  i8042prt - ok
12:59:36.0919 1292  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
12:59:36.0935 1292  iaStorV - ok
12:59:36.0982 1292  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
12:59:36.0997 1292  idsvc - ok
12:59:37.0013 1292  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
12:59:37.0028 1292  iirsp - ok
12:59:37.0075 1292  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
12:59:37.0138 1292  IKEEXT - ok
12:59:37.0216 1292  [ F242E36CDA231701CFA702641C20FAEC ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
12:59:37.0325 1292  IntcAzAudAddService - ok
12:59:37.0340 1292  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
12:59:37.0356 1292  intelide - ok
12:59:37.0372 1292  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
12:59:37.0403 1292  intelppm - ok
12:59:37.0418 1292  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
12:59:37.0465 1292  IPBusEnum - ok
12:59:37.0512 1292  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
12:59:37.0559 1292  IpFilterDriver - ok
12:59:37.0637 1292  [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
12:59:37.0699 1292  iphlpsvc - ok
12:59:37.0715 1292  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
12:59:37.0715 1292  IPMIDRV - ok
12:59:37.0730 1292  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
12:59:37.0793 1292  IPNAT - ok
12:59:37.0793 1292  [ 05360B1EA5A2ABF620D1D96EBD8BD8F1 ] irda            C:\Windows\system32\DRIVERS\irda.sys
12:59:37.0824 1292  irda - ok
12:59:37.0840 1292  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
12:59:37.0855 1292  IRENUM - ok
12:59:37.0871 1292  [ 3848384AB383F0A8F506C4370635C1F9 ] Irmon          C:\Windows\System32\irmon.dll
12:59:37.0886 1292  Irmon - ok
12:59:37.0902 1292  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
12:59:37.0918 1292  isapnp - ok
12:59:37.0933 1292  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
12:59:37.0964 1292  iScsiPrt - ok
12:59:37.0980 1292  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
12:59:37.0980 1292  kbdclass - ok
12:59:38.0011 1292  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
12:59:38.0027 1292  kbdhid - ok
12:59:38.0042 1292  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
12:59:38.0058 1292  KeyIso - ok
12:59:38.0089 1292  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
12:59:38.0089 1292  KSecDD - ok
12:59:38.0105 1292  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
12:59:38.0120 1292  KSecPkg - ok
12:59:38.0136 1292  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
12:59:38.0167 1292  ksthunk - ok
12:59:38.0198 1292  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
12:59:38.0245 1292  KtmRm - ok
12:59:38.0276 1292  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll
12:59:38.0323 1292  LanmanServer - ok
12:59:38.0339 1292  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
12:59:38.0386 1292  LanmanWorkstation - ok
12:59:38.0401 1292  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
12:59:38.0432 1292  lltdio - ok
12:59:38.0464 1292  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
12:59:38.0526 1292  lltdsvc - ok
12:59:38.0526 1292  lmab_device - ok
12:59:38.0542 1292  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
12:59:38.0588 1292  lmhosts - ok
12:59:38.0620 1292  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
12:59:38.0620 1292  LSI_FC - ok
12:59:38.0651 1292  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
12:59:38.0651 1292  LSI_SAS - ok
12:59:38.0666 1292  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
12:59:38.0682 1292  LSI_SAS2 - ok
12:59:38.0698 1292  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
12:59:38.0713 1292  LSI_SCSI - ok
12:59:38.0729 1292  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
12:59:38.0776 1292  luafv - ok
12:59:38.0807 1292  [ DC8490812A3B72811AE534F423B4C206 ] MBAMProtector  C:\Windows\system32\drivers\mbam.sys
12:59:38.0822 1292  MBAMProtector - ok
12:59:38.0869 1292  [ 43683E970F008C93C9429EF428147A54 ] MBAMService    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
12:59:38.0900 1292  MBAMService - ok
12:59:38.0916 1292  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
12:59:38.0947 1292  Mcx2Svc - ok
12:59:38.0963 1292  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\drivers\megasas.sys
12:59:38.0978 1292  megasas - ok
12:59:38.0994 1292  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
12:59:39.0010 1292  MegaSR - ok
12:59:39.0025 1292  [ 8D0E52F36A153D099DE7D5A1E233FAC7 ] mf              C:\Windows\system32\DRIVERS\mf.sys
12:59:39.0056 1292  mf - ok
12:59:39.0103 1292  Microsoft SharePoint Workspace Audit Service - ok
12:59:39.0119 1292  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
12:59:39.0166 1292  MMCSS - ok
12:59:39.0181 1292  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
12:59:39.0228 1292  Modem - ok
12:59:39.0244 1292  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
12:59:39.0259 1292  monitor - ok
12:59:39.0275 1292  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
12:59:39.0290 1292  mouclass - ok
12:59:39.0322 1292  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
12:59:39.0337 1292  mouhid - ok
12:59:39.0353 1292  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
12:59:39.0368 1292  mountmgr - ok
12:59:39.0384 1292  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
12:59:39.0400 1292  mpio - ok
12:59:39.0415 1292  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
12:59:39.0446 1292  mpsdrv - ok
12:59:39.0478 1292  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
12:59:39.0524 1292  MpsSvc - ok
12:59:39.0556 1292  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
12:59:39.0587 1292  MRxDAV - ok
12:59:39.0602 1292  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
12:59:39.0634 1292  mrxsmb - ok
12:59:39.0649 1292  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
12:59:39.0680 1292  mrxsmb10 - ok
12:59:39.0696 1292  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
12:59:39.0712 1292  mrxsmb20 - ok
12:59:39.0712 1292  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
12:59:39.0727 1292  msahci - ok
12:59:39.0743 1292  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
12:59:39.0743 1292  msdsm - ok
12:59:39.0774 1292  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
12:59:39.0805 1292  MSDTC - ok
12:59:39.0821 1292  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
12:59:39.0852 1292  Msfs - ok
12:59:39.0868 1292  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
12:59:39.0914 1292  mshidkmdf - ok
12:59:39.0914 1292  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
12:59:39.0930 1292  msisadrv - ok
12:59:39.0961 1292  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
12:59:40.0008 1292  MSiSCSI - ok
12:59:40.0008 1292  msiserver - ok
12:59:40.0024 1292  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
12:59:40.0070 1292  MSKSSRV - ok
12:59:40.0086 1292  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
12:59:40.0117 1292  MSPCLOCK - ok
12:59:40.0117 1292  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
12:59:40.0164 1292  MSPQM - ok
12:59:40.0195 1292  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
12:59:40.0211 1292  MsRPC - ok
12:59:40.0242 1292  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
12:59:40.0242 1292  mssmbios - ok
12:59:40.0258 1292  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
12:59:40.0304 1292  MSTEE - ok
12:59:40.0304 1292  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
12:59:40.0336 1292  MTConfig - ok
12:59:40.0351 1292  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
12:59:40.0367 1292  Mup - ok
12:59:40.0382 1292  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
12:59:40.0445 1292  napagent - ok
12:59:40.0460 1292  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
12:59:40.0492 1292  NativeWifiP - ok
12:59:40.0538 1292  [ DFE14D63F0F649EE94A9E3442B7C8F2C ] NAUpdate        C:\Program Files (x86)\Nero\Update\NASvc.exe
12:59:40.0554 1292  NAUpdate - ok
12:59:40.0585 1292  [ 79B47FD40D9A817E932F9D26FAC0A81C ] NDIS            C:\Windows\system32\drivers\ndis.sys
12:59:40.0616 1292  NDIS - ok
12:59:40.0632 1292  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
12:59:40.0679 1292  NdisCap - ok
12:59:40.0679 1292  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
12:59:40.0710 1292  NdisTapi - ok
12:59:40.0726 1292  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
12:59:40.0772 1292  Ndisuio - ok
12:59:40.0788 1292  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
12:59:40.0835 1292  NdisWan - ok
12:59:40.0850 1292  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
12:59:40.0897 1292  NDProxy - ok
12:59:40.0913 1292  [ 2C723E42FC8D7B0209492828F921FB50 ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
12:59:40.0928 1292  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
12:59:40.0928 1292  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
12:59:40.0928 1292  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
12:59:40.0975 1292  NetBIOS - ok
12:59:41.0006 1292  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
12:59:41.0038 1292  NetBT - ok
12:59:41.0053 1292  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
12:59:41.0053 1292  Netlogon - ok
12:59:41.0084 1292  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
12:59:41.0131 1292  Netman - ok
12:59:41.0162 1292  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
12:59:41.0178 1292  NetMsmqActivator - ok
12:59:41.0178 1292  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
12:59:41.0194 1292  NetPipeActivator - ok
12:59:41.0209 1292  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
12:59:41.0256 1292  netprofm - ok
12:59:41.0272 1292  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
12:59:41.0272 1292  NetTcpActivator - ok
12:59:41.0287 1292  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
12:59:41.0287 1292  NetTcpPortSharing - ok
12:59:41.0381 1292  [ 70B5B4E69A07895DF30291CAB6ABDA54 ] Netzmanager Service C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
12:59:41.0428 1292  Netzmanager Service ( UnsignedFile.Multi.Generic ) - warning
12:59:41.0428 1292  Netzmanager Service - detected UnsignedFile.Multi.Generic (1)
12:59:41.0443 1292  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
12:59:41.0459 1292  nfrd960 - ok
12:59:41.0474 1292  [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc          C:\Windows\System32\nlasvc.dll
12:59:41.0537 1292  NlaSvc - ok
12:59:41.0552 1292  [ 2F48AB72B6D554A41817020171DC53D6 ] NmPar          C:\Windows\system32\DRIVERS\NmPar.sys
12:59:41.0568 1292  NmPar - ok
12:59:41.0599 1292  [ 5FE6F8C05F0769BBB74AFAC11453B182 ] nmwcd          C:\Windows\system32\drivers\ccdcmbx64.sys
12:59:41.0646 1292  nmwcd - ok
12:59:41.0662 1292  [ 73C929945C0850B8D1FE2FEA05FDF05D ] nmwcdc          C:\Windows\system32\drivers\ccdcmbox64.sys
12:59:41.0708 1292  nmwcdc - ok
12:59:41.0724 1292  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
12:59:41.0755 1292  Npfs - ok
12:59:41.0771 1292  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
12:59:41.0818 1292  nsi - ok
12:59:41.0833 1292  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
12:59:41.0880 1292  nsiproxy - ok
12:59:41.0927 1292  [ A2F74975097F52A00745F9637451FDD8 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
12:59:41.0974 1292  Ntfs - ok
12:59:42.0005 1292  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
12:59:42.0052 1292  Null - ok
12:59:42.0083 1292  [ A85B4F2EF3A7304A5399EF0526423040 ] NVENETFD        C:\Windows\system32\DRIVERS\nvm62x64.sys
12:59:42.0114 1292  NVENETFD - ok
12:59:42.0348 1292  [ 623D0264E44F88152EEF6C98FF9B8013 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
12:59:42.0707 1292  nvlddmkm - ok
12:59:42.0754 1292  [ BD25E03EAD63AC3365F25175B4DBD56A ] NVNET          C:\Windows\system32\DRIVERS\nvmf6264.sys
12:59:42.0769 1292  NVNET - ok
12:59:42.0785 1292  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
12:59:42.0800 1292  nvraid - ok
12:59:42.0832 1292  [ 61A59FB62864EB3F32D24985A505CE03 ] nvsmu          C:\Windows\system32\DRIVERS\nvsmu.sys
12:59:42.0832 1292  nvsmu - ok
12:59:42.0863 1292  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
12:59:42.0878 1292  nvstor - ok
12:59:42.0925 1292  [ 2D7092FEC9BD2ACA199673BBA2BA9277 ] nvsvc          C:\Windows\system32\nvvsvc.exe
12:59:42.0972 1292  nvsvc - ok
12:59:43.0019 1292  [ 7E22DE30E222BFDFCEC7E77032BAF3CD ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
12:59:43.0081 1292  nvUpdatusService - ok
12:59:43.0097 1292  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
12:59:43.0112 1292  nv_agp - ok
12:59:43.0128 1292  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
12:59:43.0159 1292  ohci1394 - ok
12:59:43.0190 1292  [ 4965B005492CBA7719E82B71E3245495 ] ose64          C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
12:59:43.0206 1292  ose64 - ok
12:59:43.0300 1292  [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
12:59:43.0393 1292  osppsvc - ok
12:59:43.0409 1292  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
12:59:43.0456 1292  p2pimsvc - ok
12:59:43.0487 1292  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
12:59:43.0502 1292  p2psvc - ok
12:59:43.0534 1292  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\drivers\parport.sys
12:59:43.0549 1292  Parport - ok
12:59:43.0580 1292  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr        C:\Windows\system32\drivers\partmgr.sys
12:59:43.0596 1292  partmgr - ok
12:59:43.0612 1292  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
12:59:43.0627 1292  PcaSvc - ok
12:59:43.0658 1292  [ BC0018C2D29F655188A0ED3FA94FDB24 ] pccsmcfd        C:\Windows\system32\DRIVERS\pccsmcfdx64.sys
12:59:43.0690 1292  pccsmcfd - ok
12:59:43.0705 1292  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci            C:\Windows\system32\drivers\pci.sys
12:59:43.0705 1292  pci - ok
12:59:43.0721 1292  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
12:59:43.0736 1292  pciide - ok
12:59:43.0752 1292  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
12:59:43.0768 1292  pcmcia - ok
12:59:43.0768 1292  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
12:59:43.0783 1292  pcw - ok
12:59:43.0799 1292  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
12:59:43.0861 1292  PEAUTH - ok
12:59:43.0892 1292  [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc    C:\Windows\system32\peerdistsvc.dll
12:59:43.0939 1292  PeerDistSvc - ok
12:59:44.0002 1292  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
12:59:44.0017 1292  PerfHost - ok
12:59:44.0080 1292  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\Windows\system32\pla.dll
12:59:44.0142 1292  pla - ok
12:59:44.0189 1292  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
12:59:44.0251 1292  PlugPlay - ok
12:59:44.0267 1292  [ 171E6D91A20AAC8D02172A64E82CE90B ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
12:59:44.0282 1292  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
12:59:44.0282 1292  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
12:59:44.0298 1292  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
12:59:44.0314 1292  PNRPAutoReg - ok
12:59:44.0345 1292  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
12:59:44.0360 1292  PNRPsvc - ok
12:59:44.0376 1292  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
12:59:44.0438 1292  PolicyAgent - ok
12:59:44.0454 1292  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\Windows\system32\umpo.dll
12:59:44.0501 1292  Power - ok
12:59:44.0548 1292  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
12:59:44.0579 1292  PptpMiniport - ok
12:59:44.0594 1292  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\drivers\processr.sys
12:59:44.0626 1292  Processor - ok
12:59:44.0641 1292  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc        C:\Windows\system32\profsvc.dll
12:59:44.0672 1292  ProfSvc - ok
12:59:44.0704 1292  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
12:59:44.0704 1292  ProtectedStorage - ok
12:59:44.0735 1292  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
12:59:44.0782 1292  Psched - ok
12:59:44.0813 1292  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
12:59:44.0860 1292  ql2300 - ok
12:59:44.0875 1292  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
12:59:44.0891 1292  ql40xx - ok
12:59:44.0922 1292  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
12:59:44.0938 1292  QWAVE - ok
12:59:44.0969 1292  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
12:59:44.0984 1292  QWAVEdrv - ok
12:59:45.0000 1292  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
12:59:45.0031 1292  RasAcd - ok
12:59:45.0047 1292  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
12:59:45.0094 1292  RasAgileVpn - ok
12:59:45.0109 1292  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
12:59:45.0156 1292  RasAuto - ok
12:59:45.0172 1292  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
12:59:45.0218 1292  Rasl2tp - ok
12:59:45.0234 1292  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
12:59:45.0281 1292  RasMan - ok
12:59:45.0296 1292  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
12:59:45.0343 1292  RasPppoe - ok
12:59:45.0359 1292  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
12:59:45.0390 1292  RasSstp - ok
12:59:45.0421 1292  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
12:59:45.0452 1292  rdbss - ok
12:59:45.0468 1292  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
12:59:45.0499 1292  rdpbus - ok
12:59:45.0515 1292  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
12:59:45.0546 1292  RDPCDD - ok
12:59:45.0577 1292  [ 1B6163C503398B23FF8B939C67747683 ] RDPDR          C:\Windows\system32\drivers\rdpdr.sys
12:59:45.0608 1292  RDPDR - ok
12:59:45.0624 1292  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
12:59:45.0671 1292  RDPENCDD - ok
12:59:45.0671 1292  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
12:59:45.0702 1292  RDPREFMP - ok
12:59:45.0733 1292  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
12:59:45.0764 1292  RDPWD - ok
12:59:45.0796 1292  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
12:59:45.0811 1292  rdyboost - ok
12:59:45.0827 1292  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
12:59:45.0874 1292  RemoteAccess - ok
12:59:45.0889 1292  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
12:59:45.0936 1292  RemoteRegistry - ok
12:59:45.0967 1292  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
12:59:45.0998 1292  RFCOMM - ok
12:59:46.0030 1292  [ CF1EEE81FD32238FC51ADCA9F2266B7D ] RLDesignVirtualAudioCableWdm C:\Windows\system32\DRIVERS\livecamv.sys
12:59:46.0045 1292  RLDesignVirtualAudioCableWdm - ok
12:59:46.0076 1292  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
12:59:46.0108 1292  RpcEptMapper - ok
12:59:46.0139 1292  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
12:59:46.0154 1292  RpcLocator - ok
12:59:46.0170 1292  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\Windows\system32\rpcss.dll
12:59:46.0217 1292  RpcSs - ok
12:59:46.0232 1292  [ 2ABD2B3BA2EF0C3BA82284C2A5E28675 ] RRNetCap        C:\Windows\system32\DRIVERS\rrnetcap.sys
12:59:46.0248 1292  RRNetCap - ok
12:59:46.0248 1292  [ 2ABD2B3BA2EF0C3BA82284C2A5E28675 ] RRNetCapMP      C:\Windows\system32\DRIVERS\rrnetcap.sys
12:59:46.0264 1292  RRNetCapMP - ok
12:59:46.0279 1292  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
12:59:46.0310 1292  rspndr - ok
12:59:46.0342 1292  [ E60C0A09F997826C7627B244195AB581 ] s3cap          C:\Windows\system32\drivers\vms3cap.sys
12:59:46.0357 1292  s3cap - ok
12:59:46.0373 1292  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\Windows\system32\lsass.exe
12:59:46.0388 1292  SamSs - ok
12:59:46.0404 1292  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
12:59:46.0420 1292  sbp2port - ok
12:59:46.0451 1292  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
12:59:46.0482 1292  SCardSvr - ok
12:59:46.0498 1292  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
12:59:46.0544 1292  scfilter - ok
12:59:46.0576 1292  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
12:59:46.0638 1292  Schedule - ok
12:59:46.0654 1292  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\Windows\System32\certprop.dll
12:59:46.0700 1292  SCPolicySvc - ok
12:59:46.0716 1292  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
12:59:46.0747 1292  SDRSVC - ok
12:59:46.0778 1292  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
12:59:46.0825 1292  secdrv - ok
12:59:46.0841 1292  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
12:59:46.0872 1292  seclogon - ok
12:59:46.0888 1292  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
12:59:46.0919 1292  SENS - ok
12:59:46.0934 1292  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
12:59:46.0981 1292  SensrSvc - ok
12:59:46.0997 1292  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\drivers\serenum.sys
12:59:47.0012 1292  Serenum - ok
12:59:47.0028 1292  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\drivers\serial.sys
12:59:47.0059 1292  Serial - ok
12:59:47.0075 1292  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
12:59:47.0090 1292  sermouse - ok
12:59:47.0153 1292  [ F31E9531AF225CA25350D5E87E999B31 ] ServiceLayer    C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
12:59:47.0168 1292  ServiceLayer - ok
12:59:47.0184 1292  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
12:59:47.0246 1292  SessionEnv - ok
12:59:47.0262 1292  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
12:59:47.0278 1292  sffdisk - ok
12:59:47.0293 1292  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
12:59:47.0309 1292  sffp_mmc - ok
12:59:47.0309 1292  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
12:59:47.0340 1292  sffp_sd - ok
12:59:47.0356 1292  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
12:59:47.0371 1292  sfloppy - ok
12:59:47.0418 1292  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
12:59:47.0465 1292  SharedAccess - ok
12:59:47.0496 1292  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
12:59:47.0543 1292  ShellHWDetection - ok
12:59:47.0558 1292  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
12:59:47.0558 1292  SiSRaid2 - ok
12:59:47.0574 1292  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
12:59:47.0590 1292  SiSRaid4 - ok
12:59:47.0683 1292  [ 0F97E7A47A52F4A36969F0FC319654C2 ] Skype C2C Service C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
12:59:47.0761 1292  Skype C2C Service - ok
12:59:47.0792 1292  [ DDAA5F4A6B958FC313EBD02DD925752F ] SkypeUpdate    C:\Program Files (x86)\Skype\Updater\Updater.exe
12:59:47.0808 1292  SkypeUpdate - ok
12:59:47.0824 1292  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
12:59:47.0870 1292  Smb - ok
12:59:47.0886 1292  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
12:59:47.0902 1292  SNMPTRAP - ok
12:59:47.0933 1292  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
12:59:47.0933 1292  spldr - ok
12:59:47.0964 1292  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler        C:\Windows\System32\spoolsv.exe
12:59:48.0011 1292  Spooler - ok
12:59:48.0073 1292  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
12:59:48.0167 1292  sppsvc - ok
12:59:48.0198 1292  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
12:59:48.0229 1292  sppuinotify - ok
12:59:48.0260 1292  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\Windows\system32\DRIVERS\srv.sys
12:59:48.0307 1292  srv - ok
12:59:48.0323 1292  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
12:59:48.0338 1292  srv2 - ok
12:59:48.0354 1292  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
12:59:48.0370 1292  srvnet - ok
12:59:48.0385 1292  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
12:59:48.0416 1292  SSDPSRV - ok
12:59:48.0448 1292  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
12:59:48.0479 1292  SstpSvc - ok
12:59:48.0541 1292  [ E4AEA6FC64A979375149B86882CA2100 ] StarMoney 8.0 OnlineUpdate C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe
12:59:48.0557 1292  StarMoney 8.0 OnlineUpdate - ok
12:59:48.0588 1292  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\drivers\stexstor.sys
12:59:48.0604 1292  stexstor - ok
12:59:48.0619 1292  [ 1A807A037503B285016E61100D04614A ] STIrUsb        C:\Windows\system32\DRIVERS\irstusb.sys
12:59:48.0650 1292  STIrUsb - ok
12:59:48.0682 1292  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
12:59:48.0728 1292  stisvc - ok
12:59:48.0744 1292  [ 7785DC213270D2FC066538DAF94087E7 ] storflt        C:\Windows\system32\drivers\vmstorfl.sys
12:59:48.0744 1292  storflt - ok
12:59:48.0775 1292  [ C40841817EF57D491F22EB103DA587CC ] StorSvc        C:\Windows\system32\storsvc.dll
12:59:48.0806 1292  StorSvc - ok
12:59:48.0822 1292  [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc        C:\Windows\system32\drivers\storvsc.sys
12:59:48.0822 1292  storvsc - ok
12:59:48.0838 1292  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
12:59:48.0853 1292  swenum - ok
12:59:48.0869 1292  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
12:59:48.0931 1292  swprv - ok
12:59:48.0978 1292  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain        C:\Windows\system32\sysmain.dll
12:59:49.0025 1292  SysMain - ok
12:59:49.0040 1292  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
12:59:49.0072 1292  TabletInputService - ok
12:59:49.0087 1292  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\Windows\System32\tapisrv.dll
12:59:49.0134 1292  TapiSrv - ok
12:59:49.0165 1292  [ 4430E9B4C60AAB672D16E801BAD0555E ] tbhsd          C:\Windows\system32\drivers\tbhsd.sys
12:59:49.0165 1292  tbhsd - ok
12:59:49.0196 1292  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
12:59:49.0243 1292  TBS - ok
12:59:49.0290 1292  [ ACB82BDA8F46C84F465C1AFA517DC4B9 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
12:59:49.0337 1292  Tcpip - ok
12:59:49.0368 1292  [ ACB82BDA8F46C84F465C1AFA517DC4B9 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
12:59:49.0399 1292  TCPIP6 - ok
12:59:49.0430 1292  [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
12:59:49.0477 1292  tcpipreg - ok
12:59:49.0493 1292  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
12:59:49.0524 1292  TDPIPE - ok
12:59:49.0555 1292  [ 5A9715FCD237693631CA236E2AB319C2 ] TDslMgrService  C:\Program Files (x86)\T-Online\DSL-Manager\DslMgrSvc.exe
12:59:49.0571 1292  TDslMgrService ( UnsignedFile.Multi.Generic ) - warning
12:59:49.0571 1292  TDslMgrService - detected UnsignedFile.Multi.Generic (1)
12:59:49.0586 1292  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
12:59:49.0618 1292  TDTCP - ok
12:59:49.0649 1292  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
12:59:49.0680 1292  tdx - ok
12:59:49.0742 1292  [ C314391535B8BBA4238C13D663B07F83 ] TeamViewer6    C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
12:59:49.0805 1292  TeamViewer6 - ok
12:59:49.0852 1292  [ 4283D7125BA4BD0CB50BB0F78B54257A ] TelekomNM6      C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys
12:59:49.0867 1292  TelekomNM6 - ok
12:59:49.0883 1292  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
12:59:49.0898 1292  TermDD - ok
12:59:49.0930 1292  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\Windows\System32\termsrv.dll
12:59:49.0976 1292  TermService - ok
12:59:49.0992 1292  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
12:59:50.0023 1292  Themes - ok
12:59:50.0039 1292  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
12:59:50.0070 1292  THREADORDER - ok
12:59:50.0086 1292  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
12:59:50.0132 1292  TrkWks - ok
12:59:50.0179 1292  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
12:59:50.0210 1292  TrustedInstaller - ok
12:59:50.0242 1292  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
12:59:50.0288 1292  tssecsrv - ok
12:59:50.0288 1292  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
12:59:50.0320 1292  TsUsbFlt - ok
12:59:50.0335 1292  [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD        C:\Windows\system32\drivers\TsUsbGD.sys
12:59:50.0351 1292  TsUsbGD - ok
12:59:50.0398 1292  [ 41A3F69FBB7CA37A3FC5CD8EF424F199 ] TuneUp.Defrag  C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe
12:59:50.0429 1292  TuneUp.Defrag - ok
12:59:50.0460 1292  [ EBA3ABFFDADA40A2B590ADEF1A24CA24 ] TuneUp.UtilitiesSvc C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
12:59:50.0491 1292  TuneUp.UtilitiesSvc - ok
12:59:50.0507 1292  [ DCC94C51D27C7EC0DADECA8F64C94FCF ] TuneUpUtilitiesDrv C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys
12:59:50.0522 1292  TuneUpUtilitiesDrv - ok
12:59:50.0538 1292  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
12:59:50.0585 1292  tunnel - ok
12:59:50.0600 1292  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
12:59:50.0600 1292  uagp35 - ok
12:59:50.0632 1292  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
12:59:50.0678 1292  udfs - ok
12:59:50.0725 1292  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
12:59:50.0741 1292  UI0Detect - ok
12:59:50.0756 1292  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
12:59:50.0772 1292  uliagpkx - ok
12:59:50.0788 1292  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
12:59:50.0803 1292  umbus - ok
12:59:50.0834 1292  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\drivers\umpass.sys
12:59:50.0850 1292  UmPass - ok
12:59:50.0866 1292  [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService    C:\Windows\System32\umrdp.dll
12:59:50.0897 1292  UmRdpService - ok
12:59:50.0912 1292  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
12:59:50.0959 1292  upnphost - ok
12:59:50.0990 1292  [ 34AFB83C7BBA370E404E52CC2290350C ] upperdev        C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys
12:59:51.0022 1292  upperdev - ok
12:59:51.0053 1292  [ C669DE449D5D399037EF9FF77C03C23C ] USB28xxBGA      C:\Windows\system32\DRIVERS\emBDA64.sys
12:59:51.0084 1292  USB28xxBGA - ok
12:59:51.0115 1292  [ 46C0FB27F28531D9D19573FD97EBCF90 ] USB28xxOEM      C:\Windows\system32\DRIVERS\emOEM64.sys
12:59:51.0131 1292  USB28xxOEM - ok
12:59:51.0178 1292  [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
12:59:51.0193 1292  usbaudio - ok
12:59:51.0224 1292  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
12:59:51.0256 1292  usbccgp - ok
12:59:51.0271 1292  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
12:59:51.0287 1292  usbcir - ok
12:59:51.0302 1292  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
12:59:51.0334 1292  usbehci - ok
12:59:51.0349 1292  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
12:59:51.0380 1292  usbhub - ok
12:59:51.0396 1292  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci        C:\Windows\system32\DRIVERS\usbohci.sys
12:59:51.0427 1292  usbohci - ok
12:59:51.0443 1292  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\drivers\usbprint.sys
12:59:51.0458 1292  usbprint - ok
12:59:51.0490 1292  [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
12:59:51.0505 1292  usbscan - ok
12:59:51.0521 1292  [ 4ACEE387FA8FD39F83564FCD2FC234F2 ] usbser          C:\Windows\system32\drivers\usbser.sys
12:59:51.0536 1292  usbser - ok
12:59:51.0552 1292  [ AA75E1EFBEE7186B4CBAAACF1F15E6CA ] UsbserFilt      C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys
12:59:51.0583 1292  UsbserFilt - ok
12:59:51.0614 1292  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
12:59:51.0646 1292  USBSTOR - ok
12:59:51.0661 1292  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
12:59:51.0692 1292  usbuhci - ok
12:59:51.0724 1292  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
12:59:51.0739 1292  usbvideo - ok
12:59:51.0770 1292  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
12:59:51.0802 1292  UxSms - ok
12:59:51.0833 1292  [ 9AC0C072FD7EDE138842BEF7DA73B0E6 ] UxTuneUp        C:\Windows\System32\uxtuneup.dll
12:59:51.0833 1292  UxTuneUp - ok
12:59:51.0880 1292  [ 8242985B0EB906C921075A8635069860 ] V0540Dev        C:\Windows\system32\DRIVERS\V0540Vid.sys
12:59:51.0895 1292  V0540Dev - ok
12:59:51.0911 1292  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
12:59:51.0926 1292  VaultSvc - ok
12:59:51.0942 1292  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
12:59:51.0958 1292  vdrvroot - ok
12:59:51.0989 1292  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\Windows\System32\vds.exe
12:59:52.0036 1292  vds - ok
12:59:52.0051 1292  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
12:59:52.0067 1292  vga - ok
12:59:52.0082 1292  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
12:59:52.0129 1292  VgaSave - ok
12:59:52.0145 1292  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
12:59:52.0160 1292  vhdmp - ok
12:59:52.0176 1292  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
12:59:52.0192 1292  viaide - ok
12:59:52.0223 1292  [ 86EA3E79AE350FEA5331A1303054005F ] vmbus          C:\Windows\system32\drivers\vmbus.sys
12:59:52.0238 1292  vmbus - ok
12:59:52.0254 1292  [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
12:59:52.0270 1292  VMBusHID - ok
12:59:52.0270 1292  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
12:59:52.0285 1292  volmgr - ok
12:59:52.0301 1292  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
12:59:52.0316 1292  volmgrx - ok
12:59:52.0332 1292  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
12:59:52.0348 1292  volsnap - ok
12:59:52.0379 1292  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
12:59:52.0394 1292  vsmraid - ok
12:59:52.0426 1292  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\Windows\system32\vssvc.exe
12:59:52.0504 1292  VSS - ok
12:59:52.0519 1292  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
12:59:52.0550 1292  vwifibus - ok
12:59:52.0566 1292  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
12:59:52.0597 1292  W32Time - ok
12:59:52.0628 1292  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
12:59:52.0644 1292  WacomPen - ok
12:59:52.0660 1292  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
12:59:52.0706 1292  WANARP - ok
12:59:52.0722 1292  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
12:59:52.0753 1292  Wanarpv6 - ok
12:59:52.0800 1292  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
12:59:52.0862 1292  wbengine - ok
12:59:52.0878 1292  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
12:59:52.0909 1292  WbioSrvc - ok
12:59:52.0925 1292  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\Windows\System32\wcncsvc.dll
12:59:52.0956 1292  wcncsvc - ok
12:59:52.0972 1292  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
12:59:53.0003 1292  WcsPlugInService - ok
12:59:53.0018 1292  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\drivers\wd.sys
12:59:53.0034 1292  Wd - ok
12:59:53.0065 1292  [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
12:59:53.0081 1292  Wdf01000 - ok
12:59:53.0096 1292  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
12:59:53.0159 1292  WdiServiceHost - ok
12:59:53.0174 1292  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
12:59:53.0190 1292  WdiSystemHost - ok
12:59:53.0221 1292  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\Windows\System32\webclnt.dll
12:59:53.0252 1292  WebClient - ok
12:59:53.0268 1292  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
12:59:53.0315 1292  Wecsvc - ok
12:59:53.0330 1292  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
12:59:53.0377 1292  wercplsupport - ok
12:59:53.0393 1292  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
12:59:53.0440 1292  WerSvc - ok
12:59:53.0455 1292  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
12:59:53.0486 1292  WfpLwf - ok
12:59:53.0502 1292  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
12:59:53.0518 1292  WIMMount - ok
12:59:53.0533 1292  WinDefend - ok
12:59:53.0549 1292  WinHttpAutoProxySvc - ok
12:59:53.0596 1292  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
12:59:53.0642 1292  Winmgmt - ok
12:59:53.0689 1292  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\Windows\system32\WsmSvc.dll
12:59:53.0752 1292  WinRM - ok
12:59:53.0783 1292  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
12:59:53.0814 1292  WinUsb - ok
12:59:53.0845 1292  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
12:59:53.0892 1292  Wlansvc - ok
12:59:53.0908 1292  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\DRIVERS\wmiacpi.sys
12:59:53.0923 1292  WmiAcpi - ok
12:59:53.0954 1292  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
12:59:53.0970 1292  wmiApSrv - ok
12:59:53.0986 1292  WMPNetworkSvc - ok
12:59:54.0001 1292  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
12:59:54.0032 1292  WPCSvc - ok
12:59:54.0048 1292  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
12:59:54.0079 1292  WPDBusEnum - ok
12:59:54.0095 1292  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
12:59:54.0142 1292  ws2ifsl - ok
12:59:54.0157 1292  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll
12:59:54.0188 1292  wscsvc - ok
12:59:54.0220 1292  [ 8D918B1DB190A4D9B1753A66FA8C96E8 ] WSDPrintDevice  C:\Windows\system32\DRIVERS\WSDPrint.sys
12:59:54.0251 1292  WSDPrintDevice - ok
12:59:54.0251 1292  WSearch - ok
12:59:54.0313 1292  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
12:59:54.0376 1292  wuauserv - ok
12:59:54.0407 1292  [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
12:59:54.0438 1292  WudfPf - ok
12:59:54.0469 1292  [ CF8D590BE3373029D57AF80914190682 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
12:59:54.0500 1292  WUDFRd - ok
12:59:54.0532 1292  [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
12:59:54.0563 1292  wudfsvc - ok
12:59:54.0594 1292  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc        C:\Windows\System32\wwansvc.dll
12:59:54.0625 1292  WwanSvc - ok
12:59:54.0641 1292  ================ Scan global ===============================
12:59:54.0688 1292  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
12:59:54.0719 1292  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
12:59:54.0734 1292  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
12:59:54.0750 1292  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
12:59:54.0766 1292  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
12:59:54.0781 1292  [Global] - ok
12:59:54.0781 1292  ================ Scan MBR ==================================
12:59:54.0781 1292  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
12:59:54.0890 1292  \Device\Harddisk0\DR0 - ok
12:59:54.0906 1292  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
12:59:55.0015 1292  \Device\Harddisk1\DR1 - ok
12:59:55.0031 1292  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk6\DR6
12:59:55.0124 1292  \Device\Harddisk6\DR6 - ok
12:59:55.0124 1292  ================ Scan VBR ==================================
12:59:55.0124 1292  [ DC42802F5BB64CDD3D9A2539173883C0 ] \Device\Harddisk0\DR0\Partition1
12:59:55.0124 1292  \Device\Harddisk0\DR0\Partition1 - ok
12:59:55.0124 1292  [ 10D5246552F4D431D1F6E0CBAF5FB825 ] \Device\Harddisk0\DR0\Partition2
12:59:55.0124 1292  \Device\Harddisk0\DR0\Partition2 - ok
12:59:55.0156 1292  [ DAE8898BA87270797B0CF40406A7D5AF ] \Device\Harddisk1\DR1\Partition1
12:59:55.0156 1292  \Device\Harddisk1\DR1\Partition1 - ok
12:59:55.0171 1292  [ 11D10E978C1D8AFCA25C417A7DD6BF52 ] \Device\Harddisk1\DR1\Partition2
12:59:55.0171 1292  \Device\Harddisk1\DR1\Partition2 - ok
12:59:55.0187 1292  [ CE481CD93A547D12C47663E1D9E5554B ] \Device\Harddisk1\DR1\Partition3
12:59:55.0187 1292  \Device\Harddisk1\DR1\Partition3 - ok
12:59:55.0187 1292  [ 2C0924412007A0879ECB672354F8D46F ] \Device\Harddisk1\DR1\Partition4
12:59:55.0202 1292  \Device\Harddisk1\DR1\Partition4 - ok
12:59:55.0202 1292  [ 544CBE3DF5733B5ED3FAEA640818FFBA ] \Device\Harddisk6\DR6\Partition1
12:59:55.0202 1292  \Device\Harddisk6\DR6\Partition1 - ok
12:59:55.0202 1292  [ 4DCBE73096F7376908B0EFDE60FE8668 ] \Device\Harddisk6\DR6\Partition2
12:59:55.0218 1292  \Device\Harddisk6\DR6\Partition2 - ok
12:59:55.0218 1292  ============================================================
12:59:55.0218 1292  Scan finished
12:59:55.0218 1292  ============================================================
12:59:55.0234 6060  Detected object count: 6
12:59:55.0234 6060  Actual detected object count: 6
13:01:32.0532 6060  epmntdrv ( UnsignedFile.Multi.Generic ) - skipped by user
13:01:32.0532 6060  epmntdrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:01:32.0532 6060  EuGdiDrv ( UnsignedFile.Multi.Generic ) - skipped by user
13:01:32.0532 6060  EuGdiDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:01:32.0548 6060  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
13:01:32.0548 6060  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:01:32.0548 6060  Netzmanager Service ( UnsignedFile.Multi.Generic ) - skipped by user
13:01:32.0548 6060  Netzmanager Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:01:32.0548 6060  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
13:01:32.0548 6060  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:01:32.0548 6060  TDslMgrService ( UnsignedFile.Multi.Generic ) - skipped by user
13:01:32.0548 6060  TDslMgrService ( UnsignedFile.Multi.Generic ) - User select action: Skip
LG Jonny

cosinus 21.08.2012 13:55
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

jonnyk 21.08.2012 17:54
Hallo,
hier das Log:

[CODE]
Combofix Logfile:
Code:
ComboFix 12-08-20.02 - Jonny 21.08.2012  18:37:29.1.4 - x64
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.4095.2138 [GMT 2:00]
ausgeführt von:: c:\users\Jonny\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\users\Jonny\AppData\Roaming\AcroIEHelpe.txt
c:\users\Jonny\AppData\Roaming\srvblck5.tmp
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-07-21 bis 2012-08-21  ))))))))))))))))))))))))))))))
.
.
2012-08-21 16:43 . 2012-08-21 16:43        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2012-08-19 11:25 . 2012-08-19 11:25        --------        d-----w-        C:\_OTL
2012-08-15 14:40 . 2012-07-06 20:07        552960        ----a-w-        c:\windows\system32\drivers\bthport.sys
2012-08-15 09:26 . 2012-05-05 08:36        503808        ----a-w-        c:\windows\system32\srcore.dll
2012-08-15 09:26 . 2012-05-05 07:46        43008        ----a-w-        c:\windows\SysWow64\srclient.dll
2012-08-15 09:26 . 2012-02-11 06:43        751104        ----a-w-        c:\windows\system32\win32spl.dll
2012-08-15 09:26 . 2012-02-11 06:36        559104        ----a-w-        c:\windows\system32\spoolsv.exe
2012-08-15 09:26 . 2012-02-11 06:36        67072        ----a-w-        c:\windows\splwow64.exe
2012-08-15 09:26 . 2012-02-11 05:43        492032        ----a-w-        c:\windows\SysWow64\win32spl.dll
2012-08-15 09:26 . 2012-07-04 22:16        73216        ----a-w-        c:\windows\system32\netapi32.dll
2012-08-15 09:26 . 2012-07-04 22:13        59392        ----a-w-        c:\windows\system32\browcli.dll
2012-08-15 09:26 . 2012-07-04 22:13        136704        ----a-w-        c:\windows\system32\browser.dll
2012-08-15 09:26 . 2012-07-04 21:14        41984        ----a-w-        c:\windows\SysWow64\browcli.dll
2012-08-15 09:26 . 2012-07-18 18:15        3148800        ----a-w-        c:\windows\system32\win32k.sys
2012-08-15 09:26 . 2012-05-14 05:26        956928        ----a-w-        c:\windows\system32\localspl.dll
2012-08-13 12:45 . 2012-08-13 12:45        --------        d-----w-        c:\program files (x86)\ESET
2012-08-10 11:36 . 2012-06-29 10:04        9133488        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{AEE1B934-BB36-4A49-AD0D-7368B708D2A5}\mpengine.dll
2012-08-05 15:44 . 2012-08-05 15:44        --------        d-----w-        c:\users\Jonny\AppData\Roaming\Malwarebytes
2012-08-05 15:43 . 2012-08-05 15:43        --------        d-----w-        c:\programdata\Malwarebytes
2012-08-05 15:43 . 2012-08-05 15:43        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-08-05 15:43 . 2012-07-03 11:46        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-08-03 12:10 . 2012-08-03 12:10        --------        d-----w-        c:\program files (x86)\Microtek
2012-08-03 11:58 . 2012-08-03 11:58        --------        d-----w-        c:\programdata\ABBYY
2012-07-28 14:25 . 2012-07-28 14:25        --------        d-----w-        c:\users\Jonny\AppData\Local\Macromedia
2012-07-28 14:19 . 2012-07-28 14:19        --------        d-----w-        c:\users\Jonny\AppData\Local\Mozilla
2012-07-28 13:04 . 2012-07-28 13:04        --------        d-----w-        c:\users\Jonny\AppData\Roaming\Anvsoft
2012-07-28 13:04 . 2012-07-28 13:04        --------        d-----w-        c:\program files (x86)\AnvSoft
2012-07-27 14:09 . 2012-07-30 17:32        --------        d-----w-        c:\program files (x86)\WebSite X5 v8 - Evolution
2012-07-27 14:09 . 1997-07-19 15:00        604432        ----a-w-        c:\windows\SysWow64\COMCTL32.OCX
2012-07-27 11:43 . 2012-07-27 11:43        --------        d-----w-        c:\users\Public\ABBYY FineReader Engine 9.0
2012-07-27 11:43 . 2012-07-27 11:43        --------        d-----w-        c:\users\Jonny\AppData\Roaming\ABBYY FineReader Engine 9.0
2012-07-27 11:43 . 2012-07-27 11:43        --------        d-----w-        c:\users\Jonny\AppData\Local\ABBYY FineReader Engine 9.0
2012-07-23 15:56 . 2012-07-23 15:56        --------        d-----w-        c:\users\Jonny\AppData\Roaming\Serif
2012-07-23 15:55 . 2012-07-23 15:55        --------        d-----w-        c:\program files (x86)\Serif
2012-07-23 15:16 . 2012-07-23 15:16        --------        d-----w-        c:\users\Jonny\AppData\Roaming\LMSOFT
2012-07-23 15:13 . 2012-07-23 15:19        --------        d-----w-        c:\program files (x86)\LMSOFT
2012-07-23 13:57 . 2012-07-23 13:57        --------        d-----w-        c:\users\Jonny\AppData\Roaming\Nvu
2012-07-23 13:57 . 2012-07-23 15:21        --------        d-----w-        c:\program files (x86)\Nvu
2012-07-23 12:17 . 2012-07-23 12:17        --------        d-----w-        c:\programdata\vsosdk
2012-07-23 11:42 . 2012-07-23 12:46        --------        d-----w-        c:\users\Jonny\AppData\Roaming\BuddyW
2012-07-23 11:42 . 2012-07-23 11:42        --------        d-----w-        c:\program files (x86)\BuddyW
2012-07-23 11:38 . 2012-07-23 12:27        --------        d-----w-        c:\users\Jonny\AppData\Roaming\dvdcss
2012-07-23 11:36 . 2012-07-23 11:36        --------        d-----w-        c:\programdata\MagicSoftware
2012-07-23 11:34 . 2012-07-23 11:35        --------        d-----w-        c:\program files (x86)\DVDx 4.0 Open Edition
2012-07-23 11:34 . 2012-07-23 11:34        --------        d-----w-        c:\users\Jonny\AppData\Local\MagicSoftware
2012-07-23 11:34 . 2012-07-23 12:25        --------        d-----w-        c:\program files (x86)\MagicDVDCopier
2012-07-22 17:11 . 2012-07-22 17:16        --------        d-----w-        c:\program files (x86)\phase5
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-16 13:17 . 2012-04-01 10:47        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-16 13:17 . 2012-01-02 16:07        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-15 14:34 . 2011-12-30 19:09        62134624        ----a-w-        c:\windows\system32\MRT.exe
2012-07-12 15:13 . 2012-05-18 14:46        405144        ----a-w-        c:\windows\SysWow64\Newtonsoft.Json.Net20.dll
2012-06-09 05:43 . 2012-07-11 16:42        14172672        ----a-w-        c:\windows\system32\shell32.dll
2012-06-06 06:06 . 2012-07-11 16:42        2004480        ----a-w-        c:\windows\system32\msxml6.dll
2012-06-06 06:06 . 2012-07-11 16:42        1881600        ----a-w-        c:\windows\system32\msxml3.dll
2012-06-06 06:02 . 2012-07-11 16:41        1133568        ----a-w-        c:\windows\system32\cdosys.dll
2012-06-06 05:05 . 2012-07-11 16:42        1390080        ----a-w-        c:\windows\SysWow64\msxml6.dll
2012-06-06 05:05 . 2012-07-11 16:42        1236992        ----a-w-        c:\windows\SysWow64\msxml3.dll
2012-06-06 05:03 . 2012-07-11 16:41        805376        ----a-w-        c:\windows\SysWow64\cdosys.dll
2012-06-02 22:19 . 2012-06-26 09:30        38424        ----a-w-        c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-26 09:30        2428952        ----a-w-        c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-26 09:30        57880        ----a-w-        c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-26 09:30        44056        ----a-w-        c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-26 09:30        701976        ----a-w-        c:\windows\system32\wuapi.dll
2012-06-02 22:15 . 2012-06-26 09:30        2622464        ----a-w-        c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-26 09:30        99840        ----a-w-        c:\windows\system32\wudriver.dll
2012-06-02 13:19 . 2012-06-26 09:30        186752        ----a-w-        c:\windows\system32\wuwebv.dll
2012-06-02 13:15 . 2012-06-26 09:30        36864        ----a-w-        c:\windows\system32\wuapp.exe
2012-06-02 05:50 . 2012-07-11 16:42        458704        ----a-w-        c:\windows\system32\drivers\cng.sys
2012-06-02 05:48 . 2012-07-11 16:42        95600        ----a-w-        c:\windows\system32\drivers\ksecdd.sys
2012-06-02 05:48 . 2012-07-11 16:42        151920        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys
2012-06-02 05:45 . 2012-07-11 16:42        340992        ----a-w-        c:\windows\system32\schannel.dll
2012-06-02 05:44 . 2012-07-11 16:42        307200        ----a-w-        c:\windows\system32\ncrypt.dll
2012-06-02 04:40 . 2012-07-11 16:42        22016        ----a-w-        c:\windows\SysWow64\secur32.dll
2012-06-02 04:40 . 2012-07-11 16:42        225280        ----a-w-        c:\windows\SysWow64\schannel.dll
2012-06-02 04:39 . 2012-07-11 16:42        219136        ----a-w-        c:\windows\SysWow64\ncrypt.dll
2012-06-02 04:34 . 2012-07-11 16:42        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll
2012-05-31 10:25 . 2010-11-21 03:27        279656        ------w-        c:\windows\system32\MpSigStub.exe
2006-05-03 11:06        163328        --sha-r-        c:\windows\SysWOW64\flvDX.dll
2007-02-21 12:47        31232        --sha-r-        c:\windows\SysWOW64\msfDX.dll
2008-03-16 14:30        216064        --sha-r-        c:\windows\SysWOW64\nbDX.dll
2010-01-06 23:00        107520        --sha-r-        c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-12-31 39408]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"CreativeTaskScheduler"="c:\program files (x86)\Creative\Shared Files\CTSched.exe" [2006-11-17 53341]
"LMab1err"="c:\program files\Lexmark\ErrorApp\LMab1err.exe" [2010-08-03 582312]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17418928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"Live! Central"="c:\program files (x86)\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe" [2008-05-08 438399]
"NBAgent"="c:\program files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2011-04-28 1406248]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2009-09-05 385024]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSL-Manager.lnk - c:\program files (x86)\T-Online\DSL-Manager\DslMgr.exe [2012-1-2 1085440]
.
c:\users\Anneliese\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSL-Manager.lnk - c:\program files (x86)\T-Online\DSL-Manager\DslMgr.exe [2012-1-2 1085440]
.
c:\users\Carolin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSL-Manager.lnk - c:\program files (x86)\T-Online\DSL-Manager\DslMgr.exe [2012-1-2 1085440]
.
c:\users\Jonny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSL-Manager.lnk - c:\program files (x86)\T-Online\DSL-Manager\DslMgr.exe [2012-1-2 1085440]
Netzmanager.lnk - c:\program files\Netzmanager\netzmanager.exe [2011-11-10 14000128]
ShellFolderFix.lnk - c:\program files (x86)\ShellFolderFix\ShellFolderFixUI.exe [2012-1-12 2625024]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microtek Scanner Finder.lnk - c:\program files (x86)\Microtek\ScanWizard 5\ScannerFinder.exe [2012-8-3 344064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-31 136176]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-07-05 3048136]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-07 160944]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-16 250056]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
R3 DRHARD;DRHARD;c:\windows\system32\DRIVERS\DRHARD.SYS [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 16776]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 9096]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-31 136176]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 RRNetCap;RRNetCap Service;c:\windows\system32\DRIVERS\rrnetcap.sys [2012-01-03 37480]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-10-11 27760]
S1 DslMNLwf;DSL-Manager NDIS LightWeight Filter;c:\windows\system32\DRIVERS\dslmnlwf.sys [2007-08-01 19008]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [2012-05-15 375760]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-15 86224]
S2 AntiVirWebService;Avira Browser Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [2012-05-15 465360]
S2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\SysWOW64\cjpcsc.exe [2012-03-19 514128]
S2 DRHARD64;DRHARD64;c:\windows\system32\drivers\DRHARD64.sys [2008-08-06 22216]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-11-04 687400]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 StarMoney 8.0 OnlineUpdate;StarMoney 8.0 OnlineUpdate;c:\program files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe [2012-06-28 692432]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-03-01 2296696]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2011-11-21 1403200]
S3 cjusb;REINER SCT cyberJack USB Driver;c:\windows\system32\DRIVERS\cjusb.sys [2011-03-29 34672]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2008-05-07 169472]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]
S3 NmPar;PCI Parallel Port;c:\windows\system32\DRIVERS\NmPar.sys [2010-01-12 95744]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 RLDesignVirtualAudioCableWdm;Live! Cam Virtual;c:\windows\system32\DRIVERS\livecamv.sys [2007-02-05 49664]
S3 RRNetCapMP;RRNetCapMP;c:\windows\system32\DRIVERS\rrnetcap.sys [2012-01-03 37480]
S3 TDslMgrService;DSL-Manager;c:\program files (x86)\T-Online\DSL-Manager\DslMgrSvc.exe [2007-08-01 290816]
S3 TelekomNM6;Telekom Netzmanager Packet Filter Driver;c:\program files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [2010-09-16 45664]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2009-10-14 11856]
S3 V0540Dev;Creative Camera VF0540 Driver;c:\windows\system32\DRIVERS\V0540Vid.sys [2009-06-15 321376]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-08-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 13:17]
.
2012-08-12 c:\windows\Tasks\AdvancedDriverUpdater.job
- c:\program files (x86)\Advanced Driver Updater\adu.exe [2012-01-03 10:33]
.
2012-07-18 c:\windows\Tasks\AdvancedDriverUpdater_UPDATES.job
- c:\program files (x86)\Advanced Driver Updater\adu.exe [2012-01-03 10:33]
.
2012-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-31 14:53]
.
2012-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-31 14:53]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-01-31 12446824]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://portal.sska.de/portal/portal/StartenIPSTANDARD
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = local
IE: &Download by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Do&wnload selected by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/202
IE: Free YouTube to MP3 Converter - c:\users\Jonny\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.178.1
DPF: {39ED5386-A900-4D6C-B564-20BFDE5402CF} - hxxp://www.medion.com/de/service/download/MEDION_Treibersuche.ocx
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Incomedia WebSite X5 v8 - Evolution - c:\windows\system32\iwpsetup.exe
AddRemove-SmartToolseBook DAO, ADO Recordsetsv1.00 - c:\program files (x86)\SmartTools\Access eBook DAO
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-08-21  18:45:50
ComboFix-quarantined-files.txt  2012-08-21 16:45
.
Vor Suchlauf: 17 Verzeichnis(se), 199.663.939.584 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 199.140.237.312 Bytes frei
.
- - End Of File - - FC05696190A21CE04B47E02630E43601
--- --- ---


Einen schönen Urlaub.

LG Jonny

jonnyk 24.08.2012 17:25
Hallo Cosinus
hoffe du hattest schöne Tage!

Zitat:
Zitat von jonnyk (Beitrag 892915)
Hi,

zu 1.: Windows läuft sauber, gefühlt sogar etwas schneller (Hochfahren + WIN-Anmeldung) :daumenhoc

zu 2.: Habe mal überschlägig getestet. Scheint alles da zu sein. Keine leeren Ordner. Eine genaue Prüfung wäre allerdings sehr aufwendig, da doch einige Installationen vorhanden sind (Audio-, Video- und Fotobearbeitung)!
Habe hierzu eigene Desktop-Ordner, deren Inhalt aber einwandfrei läuft! :daumenhoc

Ich denke soweit passt alles und wir können weiter machen.

Bis hierher schon mal vielen vielen Dank. http://www.trojaner-board.de/images/icons/icon24.gif
habe nun doch ein kleines Problem! :(

Beim Start von StarMoney 8.0 kann der Update-Dienst nicht gestartet weden!

Habe eine Datei mit genauer Fehlerbeschreibung angehängt.

Da sich StarMoney grundsätzlich starten lässt, eben nur nicht updaten, ist es zunächst nicht sooo tragisch, sollte aber schon gelöst werden!

Vielen Dank.
Jonny

cosinus 30.08.2012 14:32
StarMoney musst du wohl neu installieren. Ansonsten musst du den Support vom Hersteller in Anspruch nehmen, ich kann dafür nun wirklich keinen Support geben

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

jonnyk 30.08.2012 16:03
Hallo cosinus,
zu StarMoney:
mir war schon klar, dass du dazu keinen Support lieferst, andererseits soll man doch alle ungewöhnlichen Dinge posten!?

Hier die Logs:

GMER:
Code:
GMER Logfile:

       
Code:

       
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-08-30 16:47:55
Windows 6.1.7601 Service Pack 1
Running: gmer.exe


---- Registry - GMER 1.0.15 ----

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0011675aeaea                     
Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0011675aeaea@001f5c51641e         0x1D 0x2D 0xC0 0x11 ...
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0011675aeaea (not active ControlSet) 
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0011675aeaea@001f5c51641e             0x1D 0x2D 0xC0 0x11 ...

---- EOF - GMER 1.0.15 ----

--- --- ---
OSAM:
Code:
OSAM Logfile:

       
Code:

       
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 16:54:11 on 30.08.2012

OS: Windows 7  Service Pack 1 (Build 7601), 64-bit
Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"AdvancedDriverUpdater.job" - "Systweak Inc" - C:\Program Files (x86)\Advanced Driver Updater\adu.exe
"AdvancedDriverUpdater_UPDATES.job" - "Systweak Inc" - C:\Program Files (x86)\Advanced Driver Updater\adu.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

[Control Panel Objects]
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Nero BurnRights 10" - ? - C:\Program Files (x86)\Nero\Nero 10\Nero 10\Nero BurnRights\NeroBurnRights_10.cpl  (File not found)
"NokiaConnectionManager" - "Nokia" - C:\PROGRA~2\Nokia\NOKIAP~1\CONNEC~1.CPL

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Audials Sound Capturing" (tbhsd) - "RapidSolution Software AG" - C:\Windows\System32\drivers\tbhsd.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"CdaC15BA" (CdaC15BA) - ? - C:\Windows\system32\drivers\CDAC15BA.SYS  (File not found)
"DRHARD" (DRHARD) - ? - C:\Windows\system32\DRIVERS\DRHARD.SYS  (File not found)
"DRHARD64" (DRHARD64) - "Licensed for Gebhard Software" - C:\Windows\system32\drivers\DRHARD64.sys
"epmntdrv" (epmntdrv) - ? - C:\Windows\system32\epmntdrv.sys  (File found, but it contains no detailed information)
"EuGdiDrv" (EuGdiDrv) - ? - C:\Windows\system32\EuGdiDrv.sys  (File found, but it contains no detailed information)
"Live! Cam Virtual" (RLDesignVirtualAudioCableWdm) - ? - C:\Windows\System32\DRIVERS\livecamv.sys  (File signed by Microsoft | File found, but it contains no detailed information)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"Telekom Netzmanager Packet Filter Driver" (TelekomNM6) - "Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH" - C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys
"TuneUpUtilitiesDrv" (TuneUpUtilitiesDrv) - "TuneUp Software" - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
{314111c7-a502-11d2-bbca-00c04f8ec294} "ms-help" - ? -   (File not found | COM-object registry key not found)
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D} "Arbeitsbereiche" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A} "Enterprise-Projekte" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\NAMEEXT.DLL
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{0006F045-0000-0000-C000-000000000046} "Microsoft Outlook Custom Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL
{F764812A-132C-4013-9960-5CBBEB408A0E} "NeroShellExt Class" - "Nero AG" - C:\Program Files (x86)\Common Files\Nero\NeroShellExt\NeroShellExt.dll
{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - C:\Program Files (x86)\TuneUp Utilities 2010\DseShExt-x86.dll
{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - C:\Program Files (x86)\TuneUp Utilities 2010\SDShelEx-win32.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
<binary data> "Grab Pro" - ? - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8BC53B30-32E4-4ED3-BEF9-DB761DB77453} "CInstallLPCtrl Object" - "SanDisk Corporation" - C:\Windows\Downloaded Program Files\InstallLP.dll / hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB
{6C269571-C6D7-4818-BCA4-32A035E8C884} "Creative Software AutoUpdate" - "Creative Technology Ltd" - C:\Windows\DOWNLO~1\CTSUEngn.ocx / hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab
{F6ACF75C-C32C-447B-9BEF-46B766368D29} "Creative Software AutoUpdate Support Package" - "Creative Technology Ltd" - C:\PROGRA~2\Creative\SHARED~1\SOFTWA~1\CTPID.ocx / hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab
{D4B68B83-8710-488B-A692-D74B50BA558E} "Creative Software AutoUpdate Support Package 2" - "Creative Technology Ltd" - C:\Windows\DOWNLO~1\CTPIDPDE.ocx / hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
{A796D216-2DE1-4EA8-BABB-FE6E7C959098} "HPSDDX Class" - "Hewlett-Packard Company" - C:\Windows\Downloaded Program Files\sdd.dll / hxxp://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} "Java Plug-in 1.6.0_30" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
{39ED5386-A900-4D6C-B564-20BFDE5402CF} "Medion Control" - "TODO: <Company name>" - C:\Windows\DOWNLO~1\MEDION~1.OCX / hxxp://www.medion.com/de/service/download/MEDION_Treibersuche.ocx
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~2\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_4_402_265.ocx / hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\Windows\SysWow64\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
<binary data> "Grab Pro" - ? - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
{000123B4-9B42-4900-B3F7-F4B073EFC214} "Octh Class" - "Orbitdownloader.com" - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"DSL-Manager.lnk" - "T-Systems Enterprise Services GmbH" - C:\Program Files (x86)\T-Online\DSL-Manager\DslMgr.exe  (Shortcut exists | File exists)
"Netzmanager.lnk" - ? - C:\Program Files (x86)\Netzmanager\netzmanager.exe  (Shortcut exists | File not found)
"ShellFolderFix.lnk" - ? - C:\Program Files (x86)\ShellFolderFix\ShellFolderFixUI.exe  (Shortcut exists | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Microtek Scanner Finder.lnk" - ? - C:\Program Files (x86)\Microtek\ScanWizard 5\ScannerFinder.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"CreativeTaskScheduler" - "Creative Technology Ltd" - "C:\Program Files (x86)\Creative\Shared Files\CTSched.exe" /logon
"LMab1err" - " " - C:\Program Files\Lexmark\ErrorApp\LMab1err.exe
"Skype" - "Skype Technologies S.A." - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
"swg" - "Google Inc." - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
"FreePDF Assistant" - "shbox.de" - C:\Program Files (x86)\FreePDF_XP\fpassist.exe
"Live! Central" - "Creative Technology Ltd." - "C:\Program Files (x86)\Creative\Creative Live! Cam\Live! Central\CTLVCentral.exe" /mode2
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"NBAgent" - "Nero AG" - "C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"HP Universal Print Monitor" - "Hewlett-Packard" - C:\Windows\system32\HPMPW081.DLL
"HPPMOPJL" - "Hewlett-Packard Company" - C:\Windows\system32\hppmopjl.dll
"Lexmark Enhanced TCP/IP Port" - " " - C:\Windows\system32\lmablmpm.dll
"Redirected Port" - ? - C:\Windows\system32\redmonnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"@%SystemRoot%\System32\uxtuneup.dll,-4096" (UxTuneUp) - "TuneUp Software" - C:\Windows\System32\uxtuneup.dll
"@C:\Program Files (x86)\Nero\Update\NASvc.exe,-200" (NAUpdate) - "Nero AG" - C:\Program Files (x86)\Nero\Update\NASvc.exe
"@C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1" (TuneUp.Defrag) - "TuneUp Software" - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
"Avira Browser Schutz" (AntiVirWebService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
"Avira Email Schutz" (AntiVirMailService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
"cyberJack PC/SC COM Service " (cjpcsc) - "REINER SCT" - C:\Windows\SysWOW64\cjpcsc.exe
"DSL-Manager" (TDslMgrService) - "T-Systems Enterprise Services GmbH" - C:\Program Files (x86)\T-Online\DSL-Manager\DslMgrSvc.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"lmab_device" (lmab_device) - " " - C:\Windows\system32\LMabcoms.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft SharePoint Workspace Audit Service" (Microsoft SharePoint Workspace Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\GROOVE.EXE
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll
"Netzmanager Infrastruktur Informationssystem Dienst" (Netzmanager Service) - "Deutsche Telekom AG" - C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe
"NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
"NVIDIA Update Service Daemon" (nvUpdatusService) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
"Office 64 Source Engine" (ose64) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll
"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
"Skype C2C Service" (Skype C2C Service) - "Skype Technologies S.A." - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe
"StarMoney 8.0 OnlineUpdate" (StarMoney 8.0 OnlineUpdate) - "Star Finanz - Software Entwicklung und Vertriebs GmbH" - C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe
"TeamViewer 6" (TeamViewer6) - "TeamViewer GmbH" - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
"TeamViewer 7" (TeamViewer7) - "TeamViewer GmbH" - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
"TuneUp Utilities Service" (TuneUp.UtilitiesSvc) - "TuneUp Software" - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----
"AVSDA" - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Soll ich aswmbr auch gleich ausführen oder auf den OK hinsichtlich der obigen Logs warten?

jonnyk 30.08.2012 16:23
Habe nun, da du Offline gegangen bist und in Deinem Post nicht explizit stand, ich solle warten, aswMBR ausgeführt.

Dies stürzte nach einer weile ab bzw. "funktionierte nicht mehr", siehe Anhang.

cosinus 30.08.2012 20:05
Bitte auch alles lesen was in meinem Posting steht. Ganz unten zu aswMBR steht nämlich noch ein Hinweis!

jonnyk 31.08.2012 12:16
Ok, sorry, werde mir künftig mehr Mühe geben! :headbang:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-31 13:09:39
-----------------------------
13:09:39.310    OS Version: Windows x64 6.1.7601 Service Pack 1
13:09:39.310    Number of processors: 4 586 0x1707
13:09:39.310    ComputerName: JONNY-BUERO-7  UserName: Jonny
13:09:40.090    Initialize success
13:09:47.964    AVAST engine defs: 12083000
13:10:27.100    Disk 0  \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
13:10:27.100    Disk 0 Vendor: SAMSUNG_HD322GJ 1AR10001 Size: 305245MB BusType: 3
13:10:27.100    Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-2
13:10:27.100    Disk 1 Vendor: SAMSUNG_HD502HJ 1AJ10001 Size: 476940MB BusType: 3
13:10:27.110    Disk 1 MBR read successfully
13:10:27.110    Disk 1 MBR scan
13:10:27.120    Disk 1 Windows 7 default MBR code
13:10:27.120    Disk 1 Partition 1 00    07    HPFS/NTFS NTFS      248984 MB offset 2048
13:10:27.140    Disk 1 Partition 2 00    07    HPFS/NTFS NTFS        70000 MB offset 509921280
13:10:27.160    Disk 1 Partition 3 80 (A) 07    HPFS/NTFS NTFS        50000 MB offset 653281280
13:10:27.160    Disk 1 Partition - 00    0F Extended LBA            107954 MB offset 755681280
13:10:27.180    Disk 1 Partition 4 00    07    HPFS/NTFS NTFS      107953 MB offset 755683328
13:10:27.220    Disk 1 scanning C:\Windows\system32\drivers
13:10:37.674    Service scanning
13:11:00.750    Modules scanning
13:11:00.750    Disk 1 trace - called modules:
13:11:00.766    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
13:11:00.766    1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0xfffffa8004a3b060]
13:11:00.781    3 CLASSPNP.SYS[fffff8800199443f] -> nt!IofCallDriver -> [0xfffffa80047d8760]
13:11:00.781    5 ACPI.sys[fffff88000ecf7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T1L0-2[0xfffffa80047d5060]
13:11:00.781    Scan finished successfully
13:11:19.457    Disk 1 MBR has been saved successfully to "C:\Users\Jonny\Desktop\MBR.dat"
13:11:19.457    The log file has been saved successfully to "C:\Users\Jonny\Desktop\aswMBR.txt"

cosinus 31.08.2012 14:10
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

jonnyk 01.09.2012 09:22
Hallo,
hier das log aus MalwareBytes:
Code:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.31.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jonny :: JONNY-BUERO-7 [Administrator]

31.08.2012 17:13:44
mbam-log-2012-08-31 (21-56-05).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|R:\|S:\|X:\|Y:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 685172
Laufzeit: 3 Stunde(n), 12 Minute(n), 40 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 13
F:\Web\Fun_PGM\schnippi.exe (PUP.Joke.SmallWilly) -> Keine Aktion durchgeführt.
S:\Nero_Sync\Kopieren_F\Web\Fun_PGM\schnippi.exe (PUP.Joke.SmallWilly) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\DesktopDot\reddot.exe (PUP.Joke.RJLSoftware) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\DownHoax\downhoax.exe (Trojan.Joke) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\drunkMouse\DrunkMouse.exe.XXX (BadJoke.MovingMouse) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\Finger\finger.exe.XXX (BadJoke.Finger) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\Launcher\launcher.exe (PUP.Joke.RJLSoftware) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\Y2K-Fun\Y2k.exe.XXX (PUP.Joke.RJLSoftware) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\ExactAudioCopy\eac-0.99pb4.exe (Adware.Yabector) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\Video-Konverter\Audio-Video Converter\SoftonicDownloader_fuer_audio-video-converter.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\Video-Schnitt\VirtualDub_Cut-Assistent\SoftonicDownloader_fuer_ffdshow.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Internet\Ultrasurf-anonym\U1104.exe (PUP.UltraSurf) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Registry_Cleaner\Registry_Convoy\RegistryConvoy_Setup.exe (Rogue.RegTidy) -> Keine Aktion durchgeführt.

(Ende)
Soll ich die Ergebnisse von MalwareBytes entfernen lassen?

Das Log von SASW kann ich nicht posten, da das Programm bei einer mpg-Datei auf meiner Sicherungsplatte hängen blieb!
Habe es nach über 12 Stunden Laufzeit abgebrochen (siehe Anhang).

Nach "Stop scan" läuft SASW immer noch im Hintergrund!?
Werde es wohl über den TM abbrechen müssen oder?

cosinus 01.09.2012 12:12
Zitat:
Keine Aktion durchgeführt.
-> No action taken.
Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! Bitte nachholen falls noch nicht getan!

NICHTS voreilig aus der Quarantäne löschen!

jonnyk 01.09.2012 12:44
hi,
da ich Malwarebytes noch nicht geschlossen hatte, habe ich nun entfernt:
Code:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.31.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jonny :: JONNY-BUERO-7 [Administrator]

31.08.2012 17:13:44
mbam-log-2012-08-31 (17-13-44).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|R:\|S:\|X:\|Y:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 685172
Laufzeit: 3 Stunde(n), 12 Minute(n), 40 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 13
F:\Web\Fun_PGM\schnippi.exe (PUP.Joke.SmallWilly) -> Keine Aktion durchgeführt.
S:\Nero_Sync\Kopieren_F\Web\Fun_PGM\schnippi.exe (PUP.Joke.SmallWilly) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\DesktopDot\reddot.exe (PUP.Joke.RJLSoftware) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\Launcher\launcher.exe (PUP.Joke.RJLSoftware) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\Y2K-Fun\Y2k.exe.XXX (PUP.Joke.RJLSoftware) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\Video-Konverter\Audio-Video Converter\SoftonicDownloader_fuer_audio-video-converter.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\Video-Schnitt\VirtualDub_Cut-Assistent\SoftonicDownloader_fuer_ffdshow.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Internet\Ultrasurf-anonym\U1104.exe (PUP.UltraSurf) -> Keine Aktion durchgeführt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\DownHoax\downhoax.exe (Trojan.Joke) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\drunkMouse\DrunkMouse.exe.XXX (BadJoke.MovingMouse) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Alt\Spiele\APRIL\windows\Finger\finger.exe.XXX (BadJoke.Finger) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Audio_Video\ExactAudioCopy\eac-0.99pb4.exe (Adware.Yabector) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Y:\Nero_Sync_Server\Kopieren_Jonny_N\PC\Programme_Sicherung\Registry_Cleaner\Registry_Convoy\RegistryConvoy_Setup.exe (Rogue.RegTidy) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
SASW kann ich wohl nun über X rechts oben (geht auch, nicht nur über TM) schließen oder?
Edit: hat sich erledigt, da Malwarebytes nach "entfernen" einen Neustart will!

So nebenbei noch die Info, dass StarMoney nach Neuinstallation wieder sauber läuft, auch das Online-Update.

Jonny

cosinus 01.09.2012 12:53
Bracuhst du diese MPG-Datei noch? Wenn nicht dann lösch sie, ansonsten verschied sie irgendwo anders hin, auf CD brennen oder so und lösch sie dann. Wiederhol den Vollscan mit SASW dann nochmal

jonnyk 01.09.2012 13:09
Die betroffenen Datie "Seabiscuit Mit dem Willen zum Erfolg.mpg" stammt ursprünglich vom Mediaserver (LW:\V = Netzlaufwerk) und dieses wird wöchentlich auf LW:\Y gesichert.

Habe sie nun von LW:\Y gelöscht und lasse SASW nochmal laufen!
Hoffentlich verschluckt sich SASW nicht noch an einer weiteren Datei!

Sobald fertig, poste ich das LOG.

Was befürchtet, ist eingetreten!
Nun steht SASW bei der Datei "Slumdog Millionär.ts" auf LW:\Y nach ca 3 Stunden!
Natürlich könnte ich diese Datei auch löschen aber danach kommen noch 12 Film-Dateien, alle mit einer Größe zwischen 500 MB und 5 GB!
Außerdem ist das nicht das letzte Verzeichnis auf LW:\Y.
Das LW:\Y liegt auf einer externen Festplatte, die per USB am Rechner hängt.

Eine andere Möglichkeit wäre, bei dem Scan von SASW zunächst "Y" auszuschließen und evtl. anschließend einen zweiten Scan nur für "Y" zu versuchen!?

Wie gesagt alles nur Vorschläge!

Was meinst?

Hallo,
habe nun, wie im letzten Post vorgeschlagen, das LW:\Y ausgeklammert.
Hier das Log:
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/01/2012 at 11:28 PM

Application Version : 5.5.1012

Core Rules Database Version : 9166
Trace Rules Database Version: 6978

Scan type      : Complete Scan
Total Scan Time : 04:34:28

Operating System Information
Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 684
Memory threats detected  : 0
Registry items scanned    : 73474
Registry threats detected : 0
File items scanned        : 339084
File threats detected    : 133

Trojan.Agent/Gen-Falcomp[RE]
        D:\$DOWNLOAD\ROOF-SUNBATHING.EXE
        D:\$DOWNLOAD\STRIP-HANGMAN-WITH-ANGELA.EXE
        S:\NERO_SYNC\KOPIEREN_D\$DOWNLOAD\ROOF-SUNBATHING.EXE
        S:\NERO_SYNC\KOPIEREN_D\$DOWNLOAD\STRIP-HANGMAN-WITH-ANGELA.EXE

Adware.Tracking Cookie
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\YM3S5SK8.txt [ /viporn.net ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\28SCA1N3.txt [ /c.atdmt.com ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\EU4M5ZI8.txt [ /atdmt.com ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\L3MWZU65.txt [ /xxx-4-free.net ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\VFTZ8H3X.txt [ /purpleporno.com ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\0TD7KB1K.txt [ /adx.chip.de ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\VXET8JIP.txt [ /stats.paypal.com ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\NBKEES0U.txt [ /accounts.google.com ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\YOAQ1CTZ.txt [ /adx.chip.de ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\YPPWJFMB.txt [ /www.purpleporno.com ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\VV16YQ59.txt [ /sexgeizkragen.de ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\ABA6JYOB.txt [ /www.sexgeizkragen.de ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\LE4CRGYQ.txt [ /porn-reactor.net ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\98WY4MYJ.txt [ /ww42.sexysat.tv ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\VSQP0F3W.txt [ /www.purpleporno.com ]
        C:\USERS\ANNELIESE\AppData\Roaming\Microsoft\Windows\Cookies\AO8IXTBR.txt [ Cookie:anneliese@paypal.112.2o7.net/ ]
        C:\USERS\ANNELIESE\AppData\Roaming\Microsoft\Windows\Cookies\ZYZ3KJ41.txt [ Cookie:anneliese@mediaplex.com/ ]
        C:\USERS\ANNELIESE\AppData\Roaming\Microsoft\Windows\Cookies\CFTHXROS.txt [ Cookie:anneliese@doubleclick.net/ ]
        C:\USERS\ANNELIESE\AppData\Roaming\Microsoft\Windows\Cookies\EFMZT2HN.txt [ Cookie:anneliese@c.atdmt.com/ ]
        C:\USERS\ANNELIESE\AppData\Roaming\Microsoft\Windows\Cookies\RIXO9VP5.txt [ Cookie:anneliese@imrworldwide.com/cgi-bin ]
        C:\USERS\ANNELIESE\AppData\Roaming\Microsoft\Windows\Cookies\M0J7AKGS.txt [ Cookie:anneliese@ad2.adfarm1.adition.com/ ]
        C:\USERS\ANNELIESE\AppData\Roaming\Microsoft\Windows\Cookies\81X57P9I.txt [ Cookie:anneliese@apmebf.com/ ]
        C:\USERS\ANNELIESE\AppData\Roaming\Microsoft\Windows\Cookies\5HVEMH3V.txt [ Cookie:anneliese@specificclick.net/ ]
        C:\USERS\ANNELIESE\AppData\Roaming\Microsoft\Windows\Cookies\AGKDTK62.txt [ Cookie:anneliese@2o7.net/ ]
        C:\USERS\ANNELIESE\AppData\Roaming\Microsoft\Windows\Cookies\HBX5ZMGO.txt [ Cookie:anneliese@ad.yieldmanager.com/ ]
        C:\USERS\ANNELIESE\AppData\Roaming\Microsoft\Windows\Cookies\BUHDDV1N.txt [ Cookie:anneliese@fl01.ct2.comclick.com/ ]
        C:\USERS\ANNELIESE\AppData\Roaming\Microsoft\Windows\Cookies\EHLYJ2ZB.txt [ Cookie:anneliese@atdmt.com/ ]
        C:\USERS\ANNELIESE\AppData\Roaming\Microsoft\Windows\Cookies\TI1LUX31.txt [ Cookie:anneliese@adfarm1.adition.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\YPX4U7KV.txt [ Cookie:carolin@2o7.net/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\02EMJDYD.txt [ Cookie:carolin@track.adform.net/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\OEEIALXX.txt [ Cookie:carolin@adbrite.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\5PW11VYN.txt [ Cookie:carolin@ad2.adfarm1.adition.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\ZW6LJA51.txt [ Cookie:carolin@traffictrack.de/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\1O6D1NDN.txt [ Cookie:carolin@webmasterplan.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\CUCAB2J9.txt [ Cookie:carolin@adviva.net/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\LCKZZ7IM.txt [ Cookie:carolin@track.effiliation.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\VRJ7228R.txt [ Cookie:carolin@casalemedia.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\30U9PBPD.txt [ Cookie:carolin@server.adformdsp.net/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\3229RFGV.txt [ Cookie:carolin@tracking.quisma.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\CIIBBVZC.txt [ Cookie:carolin@ad3.adfarm1.adition.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\WIIEEJFU.txt [ Cookie:carolin@unitymedia.de/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\EMJKDQVW.txt [ Cookie:carolin@ad.zanox.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\ZE38EWKR.txt [ Cookie:carolin@adform.net/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\6VGWQAWV.txt [ Cookie:carolin@ad.yieldmanager.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\VD7EJ6GS.txt [ Cookie:carolin@ad.dyntracker.de/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\MJKK2NLV.txt [ Cookie:carolin@adformdsp.net/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\YA79XH85.txt [ Cookie:carolin@invitemedia.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\7JTYUQ87.txt [ Cookie:carolin@c.atdmt.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\DQTF79YF.txt [ Cookie:carolin@fl01.ct2.comclick.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\9Q6OKWBQ.txt [ Cookie:carolin@tradedoubler.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\1IGY9WGA.txt [ Cookie:carolin@specificclick.net/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\NZGZCHR4.txt [ Cookie:carolin@ad4.adfarm1.adition.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\J3J1S2M2.txt [ Cookie:carolin@revsci.net/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\JIQE2FHU.txt [ Cookie:carolin@track.effiliation.com/servlet/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\1QWH6GQP.txt [ Cookie:carolin@mediaplex.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\0D6NZSBE.txt [ Cookie:carolin@bs.serving-sys.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\HZE61DJ3.txt [ Cookie:carolin@apmebf.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\YLBHRTQS.txt [ Cookie:carolin@imrworldwide.com/cgi-bin ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\AWMF4OWC.txt [ Cookie:carolin@track.adform.net/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\GQGVC2VM.txt [ Cookie:carolin@server.adformdsp.net/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\9983F0ZD.txt [ Cookie:carolin@adform.net/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\K8D4I9NO.txt [ Cookie:carolin@adformdsp.net/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\PX978TKF.txt [ Cookie:carolin@invitemedia.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\YS4INX4X.txt [ Cookie:carolin@ad4.adfarm1.adition.com/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\NG2HG0FV.txt [ Cookie:carolin@revsci.net/ ]
        C:\USERS\CAROLIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\MXY9H86X.txt [ Cookie:carolin@bs.serving-sys.com/ ]
        C:\USERS\JONNY\AppData\Roaming\Microsoft\Windows\Cookies\V8F4AWQS.txt [ Cookie:jonny@google.com/accounts/recovery/ ]
        C:\USERS\JONNY\AppData\Roaming\Microsoft\Windows\Cookies\APWXDDR0.txt [ Cookie:jonny@www.google.com/accounts ]
        C:\USERS\JONNY\AppData\Roaming\Microsoft\Windows\Cookies\35UR3VGD.txt [ Cookie:jonny@www.google.de/accounts ]
        R:\USERS\ANNELIESE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\ANNELIESE@AD.YIELDMANAGER[2].TXT [ /AD.YIELDMANAGER ]
        R:\USERS\ANNELIESE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\ANNELIESE@DOUBLECLICK[1].TXT [ /DOUBLECLICK ]
        R:\USERS\ANNELIESE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\ANNELIESE@LOYALTYPARTNER.122.2O7[1].TXT [ /LOYALTYPARTNER.122.2O7 ]
        R:\USERS\ANNELIESE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\ANNELIESE@ATDMT[2].TXT [ /ATDMT ]
        R:\USERS\ANNELIESE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\ANNELIESE@TRADEDOUBLER[2].TXT [ /TRADEDOUBLER ]
        R:\USERS\ANNELIESE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\ANNELIESE@2O7[1].TXT [ /2O7 ]
        delivery.ibanner.de [ R:\USERS\CARO\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\MG9CNE4E ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@ADS.MEDIENHAUS[1].TXT [ /ADS.MEDIENHAUS ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@CONTENT.YIELDMANAGER[1].TXT [ /CONTENT.YIELDMANAGER ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@WWW.GOOGLEADSERVICES[1].TXT [ /WWW.GOOGLEADSERVICES ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@AD.YIELDMANAGER[2].TXT [ /AD.YIELDMANAGER ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@MSNPORTAL.112.2O7[1].TXT [ /MSNPORTAL.112.2O7 ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@WEBMASTERPLAN[2].TXT [ /WEBMASTERPLAN ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@ATDMT[1].TXT [ /ATDMT ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@22.ZIELTRACK[1].TXT [ /22.ZIELTRACK ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@2O7[1].TXT [ /2O7 ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@APMEBF[1].TXT [ /APMEBF ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@EAS.APM.EMEDIATE[2].TXT [ /EAS.APM.EMEDIATE ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@INVITEMEDIA[1].TXT [ /INVITEMEDIA ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@SEVENONEINTERMEDIA.112.2O7[1].TXT [ /SEVENONEINTERMEDIA.112.2O7 ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@TRADEDOUBLER[1].TXT [ /TRADEDOUBLER ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@TRAFFICTRACK[1].TXT [ /TRAFFICTRACK ]
        R:\USERS\CARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CARO@ZIELTRACK[1].TXT [ /ZIELTRACK ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@TRAFFICTRACK[2].TXT [ /TRAFFICTRACK ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@FL01.CT2.COMCLICK[2].TXT [ /FL01.CT2.COMCLICK ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@ADS.TREIBER[2].TXT [ /ADS.TREIBER ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@QUESTIONMARKET[2].TXT [ /QUESTIONMARKET ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@AD.YIELDMANAGER[1].TXT [ /AD.YIELDMANAGER ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@ADTECH[1].TXT [ /ADTECH ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@ADVIVA[2].TXT [ /ADVIVA ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@TRACKING.QUISMA[2].TXT [ /TRACKING.QUISMA ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@CONTENT.YIELDMANAGER[1].TXT [ /CONTENT.YIELDMANAGER ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@IMRWORLDWIDE[2].TXT [ /IMRWORLDWIDE ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@SERVING-SYS[2].TXT [ /SERVING-SYS ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@TRACKING.MLSAT02[1].TXT [ /TRACKING.MLSAT02 ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@ZANOX[2].TXT [ /ZANOX ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@FASTCLICK[1].TXT [ /FASTCLICK ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@REVSCI[1].TXT [ /REVSCI ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@DOUBLECLICK[1].TXT [ /DOUBLECLICK ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@LEGOLAS-MEDIA[1].TXT [ /LEGOLAS-MEDIA ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@ADS.TF-NETWORK[2].TXT [ /ADS.TF-NETWORK ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@AD.ZANOX[1].TXT [ /AD.ZANOX ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@INTERCLICK[1].TXT [ /INTERCLICK ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@MEDIAPLEX[1].TXT [ /MEDIAPLEX ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@ADFARM1.ADITION[2].TXT [ /ADFARM1.ADITION ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@STATCOUNTER[2].TXT [ /STATCOUNTER ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@SPECIFICCLICK[2].TXT [ /SPECIFICCLICK ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@A.REVENUEMAX[1].TXT [ /A.REVENUEMAX ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@BS.SERVING-SYS[1].TXT [ /BS.SERVING-SYS ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@ADSERVER2.CLIPKIT[1].TXT [ /ADSERVER2.CLIPKIT ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@INVITEMEDIA[1].TXT [ /INVITEMEDIA ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@WEBMASTERPLAN[2].TXT [ /WEBMASTERPLAN ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@KONTERA[1].TXT [ /KONTERA ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@TRADEDOUBLER[1].TXT [ /TRADEDOUBLER ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@APMEBF[1].TXT [ /APMEBF ]
        R:\USERS\JONNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY@ATDMT[2].TXT [ /ATDMT ]
        www.3dsex.com [ R:\USERS\JONNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SG4QMLNX ]
        R:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY-BUERO$@XITI[1].TXT [ /XITI ]
        R:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY-BUERO$@XITI[2].TXT [ /XITI ]
        R:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JONNY-BUERO$@XITI[3].TXT [ /XITI ]
Werde nun SASW nochmal nur für LW:\Y laufen lassen.
Wenns dann durchläuft, kommt das Log auch noch.

jonnyk 02.09.2012 13:09
Der nächste Lauf von SASW (nur mit LW:\Y blieb wieder hängen (siehe Anhang)
Habe dann, wie in SASW "empfohlen", Dateien größer 4 MB ignoriert.

Hier das Log zu diesem Lauf:
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/02/2012 at 02:00 PM

Application Version : 5.5.1012

Core Rules Database Version : 9166
Trace Rules Database Version: 6978

Scan type      : Complete Scan
Total Scan Time : 00:23:57

Operating System Information
Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 748
Memory threats detected  : 0
Registry items scanned    : 73475
Registry threats detected : 0
File items scanned        : 27176
File threats detected    : 2

Trojan.Agent/Gen-SoftonicDownloader
        Y:\NERO_SYNC_SERVER\KOPIEREN_JONNY_N\PC\PROGRAMME_SICHERUNG\AUDIO_VIDEO\VIDEO-KONVERTER\AUDIO-VIDEO CONVERTER\SOFTONICDOWNLOADER_FUER_AUDIO-VIDEO-CONVERTER.EXE
        Y:\NERO_SYNC_SERVER\KOPIEREN_JONNY_N\PC\PROGRAMME_SICHERUNG\AUDIO_VIDEO\VIDEO-SCHNITT\VIRTUALDUB_CUT-ASSISTENT\SOFTONICDOWNLOADER_FUER_FFDSHOW.EXE
Mir ist klar, dass ich evtl. etwas "eigenmächtig" gehandelt habe aber da die Laufzeiten recht lang sind, wollte ich einfach was tun.
Ich hoffe, das war ok!

LG Jonny

cosinus 03.09.2012 19:12
Code:
UAC On - Limited User
Wie hast du sasw gestartet? Einfach per Doppelklick?

jonnyk 04.09.2012 09:18
Ja, einfach per Doppelklick!
Und dann entsprechend eurer Anleitung für SASW, bei den weiteren Läufen natürlich mit entsprechenden Einschränkungen.

cosinus 04.09.2012 16:01
Ja dann lies doch mal was in der Anleitung zu SASW steht wie du es ausführen sollst!

jonnyk 04.09.2012 22:40
Hallo,
kaum macht mans offensichtlich richtig, läuft der scan durch!
Kurz zur Erklärung:
Habe SASW deinstalliert (mit Routine aus der Anleitung) und neu installieert!
Dass es ursprünglich nicht lief, lag wohl daran, dass bei der Installation ein, in der Anleitung nicht beschriebenes Fenster kam, in dem man die Wahl hat, den Trial der Version Professional zu installieren oder nicht!
Habe dieses Mal den Trial nicht installiert!

Hier nun das Log:
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/04/2012 at 11:31 PM

Application Version : 5.5.1012

Core Rules Database Version : 9169
Trace Rules Database Version: 6981

Scan type      : Complete Scan
Total Scan Time : 05:20:27

Operating System Information
Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned      : 739
Memory threats detected  : 0
Registry items scanned    : 73662
Registry threats detected : 0
File items scanned        : 366484
File threats detected    : 5

Adware.Tracking Cookie
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\5RWZRIGV.txt [ /doubleclick.net ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\EW37FOR7.txt [ /c.atdmt.com ]
        C:\Users\Jonny\AppData\Roaming\Microsoft\Windows\Cookies\DUOQAKPE.txt [ /atdmt.com ]
        delivery.ibanner.de [ R:\USERS\CARO\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\MG9CNE4E ]
        www.3dsex.com [ R:\USERS\JONNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SG4QMLNX ]
Soll ich die Threats entfernen?

... und habe natürlich sowohl die Installation als auch den Programmstart "Als Administrator" ausgeführt.
Sorry, dachte wohl mal wieder falsch, dass es ausreichen würde, wenn ich als Administrator angemeldet bin.

!!!! Das ganze Leben ist ein Lernprozess !!!!

cosinus 05.09.2012 14:09
Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

jonnyk 05.09.2012 15:28
Hallo,
es sieht so aus als ob nun alles wieder ok ist.
Es läuft stabil.
Auf deine Frage ob es andere Probleme gibt, fällt mir noch was ein.
Sollte das jedoch alla Starmoney nicht in euere Zuständigkeit fallen, kann ich auch damit leben.
Seit ungefähr 2 Jahren habe ich im Gerätemanager 2 unbekannte USB-Geräte.
Diese haben sich immer wieder abgemeldet und anschließend wurde sofort wieder die Installation versucht.
Dies erzeugte natürlich jeweils eine Systemmeldung mit Klang, was ich dann abgestellt habe.
Auch eine Deinstallation über den Gerätemanager führt wieder zur sofortigen Installation mit Fehler.
Eine Teiberaktualisierung meldet "Bester Treiber vorhanden".
Eine Nachfrage bei FSC ergab keine Lösung!
Ich vermute, dass wohl einmal USB-Geräte angesteckt waren, die nicht sauber entfernt wurden.
Als Anhang habe ich Bilder dazu beigefügt!

Evtl. kennt ihr ja das Problem!?

Auf jeden Fall schon mal herzlichen Dank für die kompetente Führung durch die Virenbeseitigung. :dankeschoen:

LG Jonny

cosinus 05.09.2012 15:37
StarMoney neu installieren
Die unbekannten Geräte sind ein Fall für den Hardwarebereich hier im Trojaner-Board

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:04 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55