Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   "Die Webseite konnte nicht aufgerufen werden" - Virus (https://www.trojaner-board.de/123882-webseite-konnte-aufgerufen-virus.html)

cosinus 16.09.2012 15:40
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
FF - user.js - File not found
FF - prefs.js..network.proxy.http: "www-proxy.t-online.de"
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 0
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-1214310950-730897569-3731794000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O32 - HKLM CDRom: AutoRun - 1
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:05EE1EEF
:Files
C:\ProgramData\dkrfzxliabbagca
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Galge 16.09.2012 17:30
Ich danke dir schonmal das du dir am Sonntag, zeit für mich nimmst! :)

So hier das Log:

Code:
All processes killed
========== OTL ==========
Prefs.js: "www-proxy.t-online.de" removed from network.proxy.http
Prefs.js: 80 removed from network.proxy.http_port
Prefs.js: true removed from network.proxy.share_proxy_settings
Prefs.js: 0 removed from network.proxy.type
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1214310950-730897569-3731794000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
ADS C:\ProgramData\TEMP:05EE1EEF deleted successfully.
========== FILES ==========
C:\ProgramData\dkrfzxliabbagca moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Galge\Desktop\cmd.bat deleted successfully.
C:\Users\Galge\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Galge
->Temp folder emptied: 3200010554 bytes
->Temporary Internet Files folder emptied: 146674767 bytes
->Java cache emptied: 775419 bytes
->FireFox cache emptied: 1164028001 bytes
->Opera cache emptied: 52299545 bytes
->Flash cache emptied: 41605 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 25222976 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 211523277 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 46356772 bytes
RecycleBin emptied: 60556186 bytes
 
Total Files Cleaned = 4.680,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.61.4 log created on 09162012_182145

Files\Folders moved on Reboot...
C:\Users\Galge\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
MfG

cosinus 17.09.2012 09:22
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

Galge 17.09.2012 12:19
Ich poste dir einfach alle Logs die er erstellt hat:

Code:
13:12:25.0972 4804  TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
13:12:29.0023 4804  Perform update action was selected
13:12:29.0023 2852  Deinitialize success
Code:
13:12:46.0823 2488  TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
13:12:58.0844 2488  ============================================================
13:12:58.0844 2488  Current date / time: 2012/09/17 13:12:58.0844
13:12:58.0844 2488  SystemInfo:
13:12:58.0844 2488 
13:12:58.0844 2488  OS Version: 6.1.7601 ServicePack: 1.0
13:12:58.0844 2488  Product type: Workstation
13:12:58.0844 2488  ComputerName: ANIMENIA
13:12:58.0844 2488  UserName: Galge
13:12:58.0844 2488  Windows directory: C:\Windows
13:12:58.0844 2488  System windows directory: C:\Windows
13:12:58.0844 2488  Running under WOW64
13:12:58.0844 2488  Processor architecture: Intel x64
13:12:58.0844 2488  Number of processors: 6
13:12:58.0844 2488  Page size: 0x1000
13:12:58.0844 2488  Boot type: Normal boot
13:12:58.0844 2488  ============================================================
13:13:00.0054 2488  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
13:13:00.0064 2488  Drive \Device\Harddisk1\DR1 - Size: 0xAEA8BD5E00 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x17A85, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040
13:13:00.0064 2488  ============================================================
13:13:00.0064 2488  \Device\Harddisk0\DR0:
13:13:00.0064 2488  MBR partitions:
13:13:00.0064 2488  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
13:13:00.0064 2488  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D3800
13:13:00.0064 2488  \Device\Harddisk1\DR1:
13:13:00.0064 2488  MBR partitions:
13:13:00.0064 2488  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
13:13:00.0064 2488  \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x57512800
13:13:00.0064 2488  ============================================================
13:13:00.0074 2488  C: <-> \Device\Harddisk0\DR0\Partition2
13:13:00.0094 2488  E: <-> \Device\Harddisk1\DR1\Partition2
13:13:00.0094 2488  ============================================================
13:13:00.0094 2488  Initialize success
13:13:00.0094 2488  ============================================================
13:13:02.0174 5892  Deinitialize success
Code:
13:13:13.0595 5220  TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
13:13:21.0646 5220  Perform update action was selected
13:13:21.0646 3312  Deinitialize success
Code:
13:13:50.0069 5148  TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
13:13:52.0549 5148  ============================================================
13:13:52.0549 5148  Current date / time: 2012/09/17 13:13:52.0549
13:13:52.0549 5148  SystemInfo:
13:13:52.0549 5148 
13:13:52.0549 5148  OS Version: 6.1.7601 ServicePack: 1.0
13:13:52.0549 5148  Product type: Workstation
13:13:52.0549 5148  ComputerName: ANIMENIA
13:13:52.0549 5148  UserName: Galge
13:13:52.0549 5148  Windows directory: C:\Windows
13:13:52.0549 5148  System windows directory: C:\Windows
13:13:52.0549 5148  Running under WOW64
13:13:52.0549 5148  Processor architecture: Intel x64
13:13:52.0549 5148  Number of processors: 6
13:13:52.0549 5148  Page size: 0x1000
13:13:52.0549 5148  Boot type: Normal boot
13:13:52.0549 5148  ============================================================
13:13:53.0719 5148  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
13:13:53.0719 5148  Drive \Device\Harddisk1\DR1 - Size: 0xAEA8BD5E00 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x17A85, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040
13:13:53.0729 5148  ============================================================
13:13:53.0729 5148  \Device\Harddisk0\DR0:
13:13:53.0729 5148  MBR partitions:
13:13:53.0729 5148  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
13:13:53.0729 5148  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D3800
13:13:53.0729 5148  \Device\Harddisk1\DR1:
13:13:53.0729 5148  MBR partitions:
13:13:53.0729 5148  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
13:13:53.0729 5148  \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x57512800
13:13:53.0729 5148  ============================================================
13:13:53.0739 5148  C: <-> \Device\Harddisk0\DR0\Partition2
13:13:53.0739 5148  E: <-> \Device\Harddisk1\DR1\Partition2
13:13:53.0739 5148  ============================================================
13:13:53.0739 5148  Initialize success
13:13:53.0739 5148  ============================================================
13:14:40.0677 1160  ============================================================
13:14:40.0677 1160  Scan started
13:14:40.0677 1160  Mode: Manual; SigCheck; TDLFS;
13:14:40.0677 1160  ============================================================
13:14:41.0706 1160  ================ Scan system memory ========================
13:14:41.0706 1160  System memory - ok
13:14:41.0706 1160  ================ Scan services =============================
13:14:41.0847 1160  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
13:14:41.0909 1160  1394ohci - ok
13:14:41.0940 1160  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
13:14:41.0987 1160  ACPI - ok
13:14:42.0018 1160  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
13:14:42.0112 1160  AcpiPmi - ok
13:14:42.0190 1160  [ 62B7936F9036DD6ED36E6A7EFA805DC0 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
13:14:42.0206 1160  AdobeARMservice - ok
13:14:42.0299 1160  [ B2B64AF436FACCFA854DD397027C5360 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
13:14:42.0330 1160  AdobeFlashPlayerUpdateSvc - ok
13:14:42.0377 1160  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\DRIVERS\adp94xx.sys
13:14:42.0408 1160  adp94xx - ok
13:14:42.0424 1160  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\DRIVERS\adpahci.sys
13:14:42.0455 1160  adpahci - ok
13:14:42.0471 1160  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\DRIVERS\adpu320.sys
13:14:42.0471 1160  adpu320 - ok
13:14:42.0502 1160  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
13:14:42.0580 1160  AeLookupSvc - ok
13:14:42.0642 1160  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD            C:\Windows\system32\drivers\afd.sys
13:14:42.0720 1160  AFD - ok
13:14:42.0736 1160  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
13:14:42.0752 1160  agp440 - ok
13:14:42.0767 1160  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
13:14:42.0814 1160  ALG - ok
13:14:42.0861 1160  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
13:14:42.0892 1160  aliide - ok
13:14:42.0939 1160  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
13:14:42.0954 1160  amdide - ok
13:14:42.0970 1160  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\DRIVERS\amdk8.sys
13:14:42.0986 1160  AmdK8 - ok
13:14:43.0017 1160  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
13:14:43.0032 1160  AmdPPM - ok
13:14:43.0064 1160  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
13:14:43.0079 1160  amdsata - ok
13:14:43.0110 1160  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
13:14:43.0126 1160  amdsbs - ok
13:14:43.0126 1160  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
13:14:43.0142 1160  amdxata - ok
13:14:43.0188 1160  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\Windows\system32\drivers\appid.sys
13:14:43.0391 1160  AppID - ok
13:14:43.0407 1160  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
13:14:43.0485 1160  AppIDSvc - ok
13:14:43.0532 1160  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo        C:\Windows\System32\appinfo.dll
13:14:43.0594 1160  Appinfo - ok
13:14:43.0656 1160  [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
13:14:43.0688 1160  Apple Mobile Device - ok
13:14:43.0719 1160  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\DRIVERS\arc.sys
13:14:43.0734 1160  arc - ok
13:14:43.0734 1160  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
13:14:43.0750 1160  arcsas - ok
13:14:43.0812 1160  [ F6BDA026E4157DC4E321CA391E9D9BC6 ] AsIO            C:\Windows\syswow64\drivers\AsIO.sys
13:14:43.0844 1160  AsIO - ok
13:14:43.0968 1160  [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
13:14:44.0015 1160  aspnet_state - ok
13:14:44.0062 1160  [ 8C1FD73CC27EDD8D3344C632571C224C ] AsSysCtrlService C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe
13:14:44.0078 1160  AsSysCtrlService ( UnsignedFile.Multi.Generic ) - warning
13:14:44.0078 1160  AsSysCtrlService - detected UnsignedFile.Multi.Generic (1)
13:14:44.0109 1160  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
13:14:44.0171 1160  AsyncMac - ok
13:14:44.0202 1160  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\drivers\atapi.sys
13:14:44.0234 1160  atapi - ok
13:14:44.0280 1160  [ 7C5D273E29DCC5505469B299C6F29163 ] AtiPcie        C:\Windows\system32\DRIVERS\AtiPcie.sys
13:14:44.0296 1160  AtiPcie - ok
13:14:44.0327 1160  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
13:14:44.0405 1160  AudioEndpointBuilder - ok
13:14:44.0421 1160  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
13:14:44.0452 1160  AudioSrv - ok
13:14:44.0499 1160  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
13:14:44.0577 1160  AxInstSV - ok
13:14:44.0592 1160  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\DRIVERS\bxvbda.sys
13:14:44.0655 1160  b06bdrv - ok
13:14:44.0686 1160  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
13:14:44.0717 1160  b57nd60a - ok
13:14:44.0764 1160  [ 7ED4E1D2E124AD4E6A287CF49DBC9BBA ] BCUService      C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
13:14:44.0811 1160  BCUService - ok
13:14:44.0842 1160  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
13:14:44.0951 1160  BDESVC - ok
13:14:44.0998 1160  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
13:14:45.0076 1160  Beep - ok
13:14:45.0154 1160  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\Windows\System32\bfe.dll
13:14:45.0232 1160  BFE - ok
13:14:45.0279 1160  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll
13:14:45.0404 1160  BITS - ok
13:14:45.0419 1160  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
13:14:45.0466 1160  blbdrive - ok
13:14:45.0560 1160  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
13:14:45.0591 1160  Bonjour Service - ok
13:14:45.0622 1160  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
13:14:45.0684 1160  bowser - ok
13:14:45.0700 1160  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
13:14:45.0778 1160  BrFiltLo - ok
13:14:45.0794 1160  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
13:14:45.0840 1160  BrFiltUp - ok
13:14:45.0872 1160  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser        C:\Windows\System32\browser.dll
13:14:45.0934 1160  Browser - ok
13:14:45.0950 1160  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
13:14:46.0012 1160  Brserid - ok
13:14:46.0028 1160  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
13:14:46.0059 1160  BrSerWdm - ok
13:14:46.0074 1160  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
13:14:46.0090 1160  BrUsbMdm - ok
13:14:46.0090 1160  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
13:14:46.0106 1160  BrUsbSer - ok
13:14:46.0121 1160  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
13:14:46.0137 1160  BTHMODEM - ok
13:14:46.0152 1160  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
13:14:46.0184 1160  bthserv - ok
13:14:46.0215 1160  [ 9E32916AE9C19A067B67188AC5388A35 ] ccEvtMgr        C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe
13:14:46.0215 1160  ccEvtMgr - ok
13:14:46.0215 1160  [ 9E32916AE9C19A067B67188AC5388A35 ] ccSetMgr        C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe
13:14:46.0230 1160  ccSetMgr - ok
13:14:46.0230 1160  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
13:14:46.0277 1160  cdfs - ok
13:14:46.0324 1160  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
13:14:46.0371 1160  cdrom - ok
13:14:46.0386 1160  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\Windows\System32\certprop.dll
13:14:46.0433 1160  CertPropSvc - ok
13:14:46.0449 1160  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
13:14:46.0464 1160  circlass - ok
13:14:46.0480 1160  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
13:14:46.0496 1160  CLFS - ok
13:14:46.0542 1160  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
13:14:46.0574 1160  clr_optimization_v2.0.50727_32 - ok
13:14:46.0605 1160  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
13:14:46.0620 1160  clr_optimization_v2.0.50727_64 - ok
13:14:46.0683 1160  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
13:14:46.0761 1160  clr_optimization_v4.0.30319_32 - ok
13:14:46.0776 1160  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
13:14:46.0792 1160  clr_optimization_v4.0.30319_64 - ok
13:14:46.0808 1160  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
13:14:46.0854 1160  CmBatt - ok
13:14:46.0886 1160  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
13:14:46.0901 1160  cmdide - ok
13:14:46.0948 1160  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG            C:\Windows\system32\Drivers\cng.sys
13:14:46.0995 1160  CNG - ok
13:14:47.0010 1160  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
13:14:47.0010 1160  Compbatt - ok
13:14:47.0057 1160  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
13:14:47.0120 1160  CompositeBus - ok
13:14:47.0120 1160  COMSysApp - ok
13:14:47.0135 1160  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\DRIVERS\crcdisk.sys
13:14:47.0151 1160  crcdisk - ok
13:14:47.0198 1160  [ 4F5414602E2544A4554D95517948B705 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
13:14:47.0213 1160  CryptSvc - ok
13:14:47.0276 1160  [ 5228B7A738DC90A06AE4F4A7412CB1E9 ] CrystalSysInfo  C:\Program Files\MediaCoder\SysInfoX64.sys
13:14:47.0307 1160  CrystalSysInfo - ok
13:14:47.0354 1160  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
13:14:47.0432 1160  DcomLaunch - ok
13:14:47.0463 1160  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
13:14:47.0541 1160  defragsvc - ok
13:14:47.0588 1160  [ DEE15008CE5C2F2A4A65FBCE923DDCC2 ] DefWatch        C:\Program Files (x86)\Symantec AntiVirus\DefWatch.exe
13:14:47.0603 1160  DefWatch - ok
13:14:47.0650 1160  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
13:14:47.0712 1160  DfsC - ok
13:14:47.0775 1160  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
13:14:47.0837 1160  Dhcp - ok
13:14:47.0837 1160  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
13:14:47.0853 1160  discache - ok
13:14:47.0884 1160  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys
13:14:47.0884 1160  Disk - ok
13:14:47.0900 1160  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
13:14:47.0946 1160  Dnscache - ok
13:14:47.0993 1160  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\Windows\System32\dot3svc.dll
13:14:48.0071 1160  dot3svc - ok
13:14:48.0134 1160  [ B42ED0320C6E41102FDE0005154849BB ] Dot4            C:\Windows\system32\DRIVERS\Dot4.sys
13:14:48.0165 1160  Dot4 - ok
13:14:48.0196 1160  [ E9F5969233C5D89F3C35E3A66A52A361 ] Dot4Print      C:\Windows\system32\DRIVERS\Dot4Prt.sys
13:14:48.0227 1160  Dot4Print - ok
13:14:48.0243 1160  [ FD05A02B0370BC3000F402E543CA5814 ] dot4usb        C:\Windows\system32\DRIVERS\dot4usb.sys
13:14:48.0258 1160  dot4usb - ok
13:14:48.0305 1160  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\Windows\system32\dps.dll
13:14:48.0368 1160  DPS - ok
13:14:48.0399 1160  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
13:14:48.0446 1160  drmkaud - ok
13:14:48.0492 1160  [ 44BB65B1D3827043978FC8E11CA7C0B4 ] DTSAudioService C:\Program Files\Realtek\Audio\HDA\DTSAudioService64.exe
13:14:48.0524 1160  DTSAudioService - ok
13:14:48.0555 1160  [ 46571ED73AE84469DCA53081D33CF3C8 ] dtsoftbus01    C:\Windows\system32\DRIVERS\dtsoftbus01.sys
13:14:48.0570 1160  dtsoftbus01 - ok
13:14:48.0648 1160  dump_wmimmc - ok
13:14:48.0711 1160  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
13:14:48.0773 1160  DXGKrnl - ok
13:14:48.0789 1160  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
13:14:48.0820 1160  EapHost - ok
13:14:48.0914 1160  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\DRIVERS\evbda.sys
13:14:49.0070 1160  ebdrv - ok
13:14:49.0132 1160  [ 4353FF94D47A0A9D52B89ECCF0CDB013 ] eeCtrl          C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
13:14:49.0163 1160  eeCtrl - ok
13:14:49.0194 1160  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\Windows\System32\lsass.exe
13:14:49.0210 1160  EFS - ok
13:14:49.0241 1160  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
13:14:49.0319 1160  ehRecvr - ok
13:14:49.0350 1160  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
13:14:49.0397 1160  ehSched - ok
13:14:49.0413 1160  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\DRIVERS\elxstor.sys
13:14:49.0428 1160  elxstor - ok
13:14:49.0460 1160  [ C5BCCB378D0A896304A3E71BE7215983 ] EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
13:14:49.0475 1160  EraserUtilRebootDrv - ok
13:14:49.0506 1160  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
13:14:49.0506 1160  ErrDev - ok
13:14:49.0538 1160  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
13:14:49.0584 1160  EventSystem - ok
13:14:49.0600 1160  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
13:14:49.0631 1160  exfat - ok
13:14:49.0662 1160  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
13:14:49.0678 1160  fastfat - ok
13:14:49.0740 1160  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\Windows\system32\fxssvc.exe
13:14:49.0772 1160  Fax - ok
13:14:49.0787 1160  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
13:14:49.0803 1160  fdc - ok
13:14:49.0834 1160  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
13:14:49.0881 1160  fdPHost - ok
13:14:49.0896 1160  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
13:14:49.0928 1160  FDResPub - ok
13:14:49.0928 1160  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
13:14:49.0943 1160  FileInfo - ok
13:14:49.0943 1160  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
13:14:49.0990 1160  Filetrace - ok
13:14:50.0006 1160  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
13:14:50.0084 1160  flpydisk - ok
13:14:50.0130 1160  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
13:14:50.0162 1160  FltMgr - ok
13:14:50.0224 1160  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache      C:\Windows\system32\FntCache.dll
13:14:50.0318 1160  FontCache - ok
13:14:50.0380 1160  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
13:14:50.0396 1160  FontCache3.0.0.0 - ok
13:14:50.0458 1160  [ 93B5CD0AC126BE95F65B28AF3D9542DC ] FreemakeVideoCapture C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe
13:14:50.0489 1160  FreemakeVideoCapture ( UnsignedFile.Multi.Generic ) - warning
13:14:50.0489 1160  FreemakeVideoCapture - detected UnsignedFile.Multi.Generic (1)
13:14:50.0536 1160  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
13:14:50.0552 1160  FsDepends - ok
13:14:50.0583 1160  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
13:14:50.0598 1160  Fs_Rec - ok
13:14:50.0630 1160  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
13:14:50.0661 1160  fvevol - ok
13:14:50.0676 1160  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
13:14:50.0692 1160  gagp30kx - ok
13:14:50.0723 1160  [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM    C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
13:14:50.0739 1160  GEARAspiWDM - ok
13:14:50.0786 1160  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\Windows\System32\gpsvc.dll
13:14:50.0832 1160  gpsvc - ok
13:14:50.0879 1160  [ 1E6438D4EA6E1174A3B3B1EDC4DE660B ] hamachi        C:\Windows\system32\DRIVERS\hamachi.sys
13:14:50.0895 1160  hamachi - ok
13:14:51.0004 1160  [ F10C3F2E002100BF8B797DCF283FEA7D ] Hamachi2Svc    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
13:14:51.0082 1160  Hamachi2Svc - ok
13:14:51.0098 1160  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
13:14:51.0113 1160  hcw85cir - ok
13:14:51.0176 1160  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
13:14:51.0222 1160  HdAudAddService - ok
13:14:51.0238 1160  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
13:14:51.0285 1160  HDAudBus - ok
13:14:51.0300 1160  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\DRIVERS\HidBatt.sys
13:14:51.0332 1160  HidBatt - ok
13:14:51.0363 1160  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
13:14:51.0394 1160  HidBth - ok
13:14:51.0425 1160  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
13:14:51.0441 1160  HidIr - ok
13:14:51.0472 1160  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\system32\hidserv.dll
13:14:51.0503 1160  hidserv - ok
13:14:51.0519 1160  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\drivers\hidusb.sys
13:14:51.0534 1160  HidUsb - ok
13:14:51.0566 1160  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
13:14:51.0581 1160  hkmsvc - ok
13:14:51.0628 1160  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
13:14:51.0659 1160  HomeGroupListener - ok
13:14:51.0675 1160  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
13:14:51.0706 1160  HomeGroupProvider - ok
13:14:51.0800 1160  [ 0A3C6AA4A9FC38C20BA4EAC2C3351C05 ] hpqcxs08        C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
13:14:51.0831 1160  hpqcxs08 ( UnsignedFile.Multi.Generic ) - warning
13:14:51.0831 1160  hpqcxs08 - detected UnsignedFile.Multi.Generic (1)
13:14:51.0846 1160  [ F3F72A2A86C22610BCA5439FA789DD52 ] hpqddsvc        C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
13:14:51.0878 1160  hpqddsvc ( UnsignedFile.Multi.Generic ) - warning
13:14:51.0878 1160  hpqddsvc - detected UnsignedFile.Multi.Generic (1)
13:14:51.0909 1160  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
13:14:51.0924 1160  HpSAMD - ok
13:14:51.0987 1160  [ F37882F128EFACEFE353E0BAE2766909 ] HPSLPSVC        C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
13:14:52.0034 1160  HPSLPSVC ( UnsignedFile.Multi.Generic ) - warning
13:14:52.0034 1160  HPSLPSVC - detected UnsignedFile.Multi.Generic (1)
13:14:52.0080 1160  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
13:14:52.0158 1160  HTTP - ok
13:14:52.0190 1160  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
13:14:52.0205 1160  hwpolicy - ok
13:14:52.0252 1160  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
13:14:52.0299 1160  i8042prt - ok
13:14:52.0346 1160  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
13:14:52.0377 1160  iaStorV - ok
13:14:52.0424 1160  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
13:14:52.0455 1160  idsvc - ok
13:14:52.0502 1160  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\DRIVERS\iirsp.sys
13:14:52.0533 1160  iirsp - ok
13:14:52.0580 1160  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
13:14:52.0673 1160  IKEEXT - ok
13:14:52.0814 1160  [ 5F6A3EA5BD7CA861863A3A06CECC115C ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
13:14:52.0938 1160  IntcAzAudAddService - ok
13:14:52.0954 1160  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
13:14:52.0954 1160  intelide - ok
13:14:52.0970 1160  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
13:14:53.0001 1160  intelppm - ok
13:14:53.0032 1160  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
13:14:53.0110 1160  IPBusEnum - ok
13:14:53.0141 1160  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
13:14:53.0172 1160  IpFilterDriver - ok
13:14:53.0204 1160  [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
13:14:53.0282 1160  iphlpsvc - ok
13:14:53.0313 1160  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
13:14:53.0313 1160  IPMIDRV - ok
13:14:53.0328 1160  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
13:14:53.0360 1160  IPNAT - ok
13:14:53.0406 1160  [ A9AB99EE7D39725EAFEC82732D2B3271 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
13:14:53.0438 1160  iPod Service - ok
13:14:53.0438 1160  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
13:14:53.0516 1160  IRENUM - ok
13:14:53.0547 1160  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
13:14:53.0562 1160  isapnp - ok
13:14:53.0578 1160  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
13:14:53.0594 1160  iScsiPrt - ok
13:14:53.0640 1160  [ 4A8A242FDA43765F4F73ECDE2BA0D62A ] JRAID          C:\Windows\system32\DRIVERS\jraid.sys
13:14:53.0656 1160  JRAID - ok
13:14:53.0672 1160  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
13:14:53.0687 1160  kbdclass - ok
13:14:53.0703 1160  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
13:14:53.0734 1160  kbdhid - ok
13:14:53.0750 1160  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
13:14:53.0765 1160  KeyIso - ok
13:14:53.0796 1160  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
13:14:53.0812 1160  KSecDD - ok
13:14:53.0828 1160  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
13:14:53.0843 1160  KSecPkg - ok
13:14:53.0843 1160  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
13:14:53.0921 1160  ksthunk - ok
13:14:53.0952 1160  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
13:14:54.0030 1160  KtmRm - ok
13:14:54.0062 1160  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll
13:14:54.0093 1160  LanmanServer - ok
13:14:54.0124 1160  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
13:14:54.0171 1160  LanmanWorkstation - ok
13:14:54.0264 1160  [ 7772DFAB22611050B79504E671B06E6E ] LBTServ        C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
13:14:54.0296 1160  LBTServ - ok
13:14:54.0342 1160  [ 241F2648ADF090E2A10095BD6D6F5DCB ] LHidFilt        C:\Windows\system32\DRIVERS\LHidFilt.Sys
13:14:54.0358 1160  LHidFilt - ok
13:14:54.0467 1160  [ 3C7FCBBC35E0A52CE9B12E9CC4F5B991 ] LiveUpdate      C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE
13:14:54.0530 1160  LiveUpdate - ok
13:14:54.0561 1160  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
13:14:54.0592 1160  lltdio - ok
13:14:54.0623 1160  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
13:14:54.0654 1160  lltdsvc - ok
13:14:54.0686 1160  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
13:14:54.0717 1160  lmhosts - ok
13:14:54.0748 1160  [ 342ED5A4B3326014438F36D22D803737 ] LMouFilt        C:\Windows\system32\DRIVERS\LMouFilt.Sys
13:14:54.0748 1160  LMouFilt - ok
13:14:54.0764 1160  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
13:14:54.0779 1160  LSI_FC - ok
13:14:54.0795 1160  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\DRIVERS\lsi_sas.sys
13:14:54.0795 1160  LSI_SAS - ok
13:14:54.0795 1160  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
13:14:54.0810 1160  LSI_SAS2 - ok
13:14:54.0810 1160  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
13:14:54.0826 1160  LSI_SCSI - ok
13:14:54.0842 1160  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
13:14:54.0888 1160  luafv - ok
13:14:54.0920 1160  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
13:14:54.0951 1160  Mcx2Svc - ok
13:14:54.0966 1160  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\DRIVERS\megasas.sys
13:14:54.0982 1160  megasas - ok
13:14:55.0013 1160  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
13:14:55.0029 1160  MegaSR - ok
13:14:55.0091 1160  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
13:14:55.0122 1160  MMCSS - ok
13:14:55.0169 1160  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
13:14:55.0232 1160  Modem - ok
13:14:55.0247 1160  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
13:14:55.0294 1160  monitor - ok
13:14:55.0325 1160  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\drivers\mouclass.sys
13:14:55.0356 1160  mouclass - ok
13:14:55.0388 1160  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
13:14:55.0403 1160  mouhid - ok
13:14:55.0434 1160  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
13:14:55.0450 1160  mountmgr - ok
13:14:55.0528 1160  [ CB8AF049AC9BE419A77ADAE288673359 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
13:14:55.0559 1160  MozillaMaintenance - ok
13:14:55.0606 1160  [ 94C66EDEDCDB6A126880472F9A704D8E ] MpFilter        C:\Windows\system32\DRIVERS\MpFilter.sys
13:14:55.0637 1160  MpFilter - ok
13:14:55.0668 1160  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
13:14:55.0700 1160  mpio - ok
13:14:55.0715 1160  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
13:14:55.0762 1160  mpsdrv - ok
13:14:55.0809 1160  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
13:14:55.0887 1160  MpsSvc - ok
13:14:55.0918 1160  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
13:14:55.0965 1160  MRxDAV - ok
13:14:55.0996 1160  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
13:14:56.0027 1160  mrxsmb - ok
13:14:56.0043 1160  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
13:14:56.0058 1160  mrxsmb10 - ok
13:14:56.0090 1160  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
13:14:56.0105 1160  mrxsmb20 - ok
13:14:56.0121 1160  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
13:14:56.0136 1160  msahci - ok
13:14:56.0152 1160  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
13:14:56.0168 1160  msdsm - ok
13:14:56.0183 1160  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
13:14:56.0214 1160  MSDTC - ok
13:14:56.0246 1160  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
13:14:56.0292 1160  Msfs - ok
13:14:56.0308 1160  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
13:14:56.0355 1160  mshidkmdf - ok
13:14:56.0386 1160  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
13:14:56.0386 1160  msisadrv - ok
13:14:56.0417 1160  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
13:14:56.0495 1160  MSiSCSI - ok
13:14:56.0495 1160  msiserver - ok
13:14:56.0526 1160  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
13:14:56.0573 1160  MSKSSRV - ok
13:14:56.0636 1160  [ 59FAAF2C83C8169EA20F9E335E418907 ] MsMpSvc        C:\Program Files\Microsoft Security Client\MsMpEng.exe
13:14:56.0667 1160  MsMpSvc - ok
13:14:56.0682 1160  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
13:14:56.0729 1160  MSPCLOCK - ok
13:14:56.0729 1160  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
13:14:56.0760 1160  MSPQM - ok
13:14:56.0792 1160  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
13:14:56.0838 1160  MsRPC - ok
13:14:56.0854 1160  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
13:14:56.0870 1160  mssmbios - ok
13:14:56.0870 1160  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
13:14:56.0932 1160  MSTEE - ok
13:14:56.0932 1160  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
13:14:56.0948 1160  MTConfig - ok
13:14:56.0963 1160  [ 19B006B181E3875FD254F7B67ACF1E7C ] MTsensor        C:\Windows\system32\DRIVERS\ASACPI.sys
13:14:56.0963 1160  MTsensor - ok
13:14:56.0994 1160  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
13:14:56.0994 1160  Mup - ok
13:14:57.0041 1160  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
13:14:57.0119 1160  napagent - ok
13:14:57.0150 1160  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
13:14:57.0182 1160  NativeWifiP - ok
13:14:57.0291 1160  [ C58D8A669D6551F616D90244BD2C2D4F ] NAVENG          C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20120914.002\ENG64.SYS
13:14:57.0322 1160  NAVENG - ok
13:14:57.0416 1160  [ A3DBDB412ADFA5882DD6843B11FE0828 ] NAVEX15        C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20120914.002\EX64.SYS
13:14:57.0447 1160  NAVEX15 - ok
13:14:57.0509 1160  [ 79B47FD40D9A817E932F9D26FAC0A81C ] NDIS            C:\Windows\system32\drivers\ndis.sys
13:14:57.0572 1160  NDIS - ok
13:14:57.0587 1160  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
13:14:57.0618 1160  NdisCap - ok
13:14:57.0650 1160  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
13:14:57.0665 1160  NdisTapi - ok
13:14:57.0712 1160  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
13:14:57.0790 1160  Ndisuio - ok
13:14:57.0821 1160  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
13:14:57.0868 1160  NdisWan - ok
13:14:57.0899 1160  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
13:14:57.0962 1160  NDProxy - ok
13:14:58.0008 1160  [ 2334DC48997BA203B794DF3EE70521DB ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
13:14:58.0024 1160  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
13:14:58.0024 1160  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
13:14:58.0040 1160  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
13:14:58.0086 1160  NetBIOS - ok
13:14:58.0118 1160  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
13:14:58.0196 1160  NetBT - ok
13:14:58.0211 1160  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
13:14:58.0211 1160  Netlogon - ok
13:14:58.0258 1160  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
13:14:58.0320 1160  Netman - ok
13:14:58.0352 1160  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:14:58.0383 1160  NetMsmqActivator - ok
13:14:58.0398 1160  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:14:58.0414 1160  NetPipeActivator - ok
13:14:58.0414 1160  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
13:14:58.0461 1160  netprofm - ok
13:14:58.0461 1160  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:14:58.0461 1160  NetTcpActivator - ok
13:14:58.0476 1160  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:14:58.0476 1160  NetTcpPortSharing - ok
13:14:58.0586 1160  [ 70B5B4E69A07895DF30291CAB6ABDA54 ] Netzmanager Service C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
13:14:58.0632 1160  Netzmanager Service ( UnsignedFile.Multi.Generic ) - warning
13:14:58.0632 1160  Netzmanager Service - detected UnsignedFile.Multi.Generic (1)
13:14:58.0664 1160  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\DRIVERS\nfrd960.sys
13:14:58.0679 1160  nfrd960 - ok
13:14:58.0710 1160  [ 91B4E0273D2F6C24EF845F2B41311289 ] NisDrv          C:\Windows\system32\DRIVERS\NisDrvWFP.sys
13:14:58.0710 1160  NisDrv - ok
13:14:58.0742 1160  [ 10A43829A9E606AF3EEF25A1C1665923 ] NisSrv          C:\Program Files\Microsoft Security Client\NisSrv.exe
13:14:58.0742 1160  NisSrv - ok
13:14:58.0773 1160  [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc          C:\Windows\System32\nlasvc.dll
13:14:58.0835 1160  NlaSvc - ok
13:14:58.0866 1160  [ 351533ACC2A069B94E80BBFC177E8FDF ] npf            C:\Windows\system32\drivers\npf.sys
13:14:58.0866 1160  npf - ok
13:14:58.0882 1160  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
13:14:58.0898 1160  Npfs - ok
13:14:58.0929 1160  npggsvc - ok
13:14:58.0929 1160  NPPTNT2 - ok
13:14:58.0944 1160  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
13:14:58.0976 1160  nsi - ok
13:14:59.0007 1160  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
13:14:59.0022 1160  nsiproxy - ok
13:14:59.0085 1160  [ A2F74975097F52A00745F9637451FDD8 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
13:14:59.0147 1160  Ntfs - ok
13:14:59.0163 1160  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
13:14:59.0210 1160  Null - ok
13:14:59.0241 1160  [ 285ACEC1B13A15BA520AAE06BACB9CFF ] nusb3hub        C:\Windows\system32\DRIVERS\nusb3hub.sys
13:14:59.0256 1160  nusb3hub - ok
13:14:59.0272 1160  [ F6D625FF7B56BB6EA063F0D3A5BBC996 ] nusb3xhc        C:\Windows\system32\DRIVERS\nusb3xhc.sys
13:14:59.0288 1160  nusb3xhc - ok
13:14:59.0334 1160  [ 8D4AAC74B571FC356560E5B308955E93 ] NVHDA          C:\Windows\system32\drivers\nvhda64v.sys
13:14:59.0366 1160  NVHDA - ok
13:14:59.0600 1160  [ 0EB204639119370F5F8F2871FBF4E14B ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
13:14:59.0880 1160  nvlddmkm - ok
13:14:59.0912 1160  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
13:14:59.0927 1160  nvraid - ok
13:14:59.0943 1160  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
13:14:59.0974 1160  nvstor - ok
13:15:00.0021 1160  [ 32FF8EE6DCEE5C0CB91FF892FB1CA364 ] nvsvc          C:\Windows\system32\nvvsvc.exe
13:15:00.0052 1160  nvsvc - ok
13:15:00.0114 1160  [ BD012DC22C78BE1071BC21EB125D782F ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
13:15:00.0161 1160  nvUpdatusService - ok
13:15:00.0192 1160  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
13:15:00.0208 1160  nv_agp - ok
13:15:00.0239 1160  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
13:15:00.0255 1160  ohci1394 - ok
13:15:00.0302 1160  [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose            C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
13:15:00.0302 1160  ose - ok
13:15:00.0317 1160  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
13:15:00.0364 1160  p2pimsvc - ok
13:15:00.0395 1160  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
13:15:00.0395 1160  p2psvc - ok
13:15:00.0426 1160  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\DRIVERS\parport.sys
13:15:00.0442 1160  Parport - ok
13:15:00.0489 1160  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr        C:\Windows\system32\drivers\partmgr.sys
13:15:00.0489 1160  partmgr - ok
13:15:00.0504 1160  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
13:15:00.0551 1160  PcaSvc - ok
13:15:00.0567 1160  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci            C:\Windows\system32\drivers\pci.sys
13:15:00.0582 1160  pci - ok
13:15:00.0582 1160  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
13:15:00.0598 1160  pciide - ok
13:15:00.0614 1160  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
13:15:00.0614 1160  pcmcia - ok
13:15:00.0629 1160  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
13:15:00.0629 1160  pcw - ok
13:15:00.0660 1160  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
13:15:00.0692 1160  PEAUTH - ok
13:15:00.0770 1160  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
13:15:00.0801 1160  PerfHost - ok
13:15:00.0879 1160  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\Windows\system32\pla.dll
13:15:00.0972 1160  pla - ok
13:15:01.0019 1160  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
13:15:01.0035 1160  PlugPlay - ok
13:15:01.0097 1160  [ AC78DF349F0E4CFB8B667C0CFFF83CCE ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
13:15:01.0128 1160  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
13:15:01.0128 1160  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
13:15:01.0144 1160  PnkBstrA - ok
13:15:01.0160 1160  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
13:15:01.0191 1160  PNRPAutoReg - ok
13:15:01.0191 1160  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
13:15:01.0206 1160  PNRPsvc - ok
13:15:01.0238 1160  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
13:15:01.0284 1160  PolicyAgent - ok
13:15:01.0316 1160  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\Windows\system32\umpo.dll
13:15:01.0362 1160  Power - ok
13:15:01.0409 1160  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
13:15:01.0425 1160  PptpMiniport - ok
13:15:01.0440 1160  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\DRIVERS\processr.sys
13:15:01.0456 1160  Processor - ok
13:15:01.0503 1160  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc        C:\Windows\system32\profsvc.dll
13:15:01.0565 1160  ProfSvc - ok
13:15:01.0581 1160  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
13:15:01.0596 1160  ProtectedStorage - ok
13:15:01.0628 1160  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
13:15:01.0674 1160  Psched - ok
13:15:01.0706 1160  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
13:15:01.0737 1160  ql2300 - ok
13:15:01.0752 1160  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
13:15:01.0752 1160  ql40xx - ok
13:15:01.0768 1160  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
13:15:01.0784 1160  QWAVE - ok
13:15:01.0784 1160  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
13:15:01.0815 1160  QWAVEdrv - ok
13:15:01.0830 1160  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
13:15:01.0846 1160  RasAcd - ok
13:15:01.0877 1160  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
13:15:01.0893 1160  RasAgileVpn - ok
13:15:01.0908 1160  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
13:15:01.0940 1160  RasAuto - ok
13:15:01.0971 1160  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
13:15:02.0033 1160  Rasl2tp - ok
13:15:02.0080 1160  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
13:15:02.0127 1160  RasMan - ok
13:15:02.0158 1160  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
13:15:02.0174 1160  RasPppoe - ok
13:15:02.0189 1160  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
13:15:02.0220 1160  RasSstp - ok
13:15:02.0236 1160  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
13:15:02.0267 1160  rdbss - ok
13:15:02.0298 1160  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
13:15:02.0298 1160  rdpbus - ok
13:15:02.0298 1160  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
13:15:02.0345 1160  RDPCDD - ok
13:15:02.0376 1160  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
13:15:02.0392 1160  RDPENCDD - ok
13:15:02.0408 1160  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
13:15:02.0439 1160  RDPREFMP - ok
13:15:02.0486 1160  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
13:15:02.0501 1160  RDPWD - ok
13:15:02.0548 1160  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
13:15:02.0548 1160  rdyboost - ok
13:15:02.0579 1160  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
13:15:02.0657 1160  RemoteAccess - ok
13:15:02.0673 1160  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
13:15:02.0720 1160  RemoteRegistry - ok
13:15:02.0735 1160  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
13:15:02.0751 1160  RpcEptMapper - ok
13:15:02.0782 1160  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
13:15:02.0798 1160  RpcLocator - ok
13:15:02.0829 1160  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\Windows\system32\rpcss.dll
13:15:02.0860 1160  RpcSs - ok
13:15:02.0876 1160  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
13:15:02.0907 1160  rspndr - ok
13:15:02.0969 1160  [ EE082E06A82FF630351D1E0EBBD3D8D0 ] RTL8167        C:\Windows\system32\DRIVERS\Rt64win7.sys
13:15:03.0000 1160  RTL8167 - ok
13:15:03.0016 1160  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\Windows\system32\lsass.exe
13:15:03.0032 1160  SamSs - ok
13:15:03.0063 1160  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
13:15:03.0078 1160  sbp2port - ok
13:15:03.0110 1160  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
13:15:03.0188 1160  SCardSvr - ok
13:15:03.0203 1160  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
13:15:03.0234 1160  scfilter - ok
13:15:03.0281 1160  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
13:15:03.0312 1160  Schedule - ok
13:15:03.0328 1160  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\Windows\System32\certprop.dll
13:15:03.0359 1160  SCPolicySvc - ok
13:15:03.0375 1160  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
13:15:03.0390 1160  SDRSVC - ok
13:15:03.0406 1160  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
13:15:03.0422 1160  secdrv - ok
13:15:03.0468 1160  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
13:15:03.0531 1160  seclogon - ok
13:15:03.0531 1160  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
13:15:03.0562 1160  SENS - ok
13:15:03.0578 1160  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
13:15:03.0593 1160  SensrSvc - ok
13:15:03.0624 1160  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
13:15:03.0640 1160  Serenum - ok
13:15:03.0671 1160  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
13:15:03.0718 1160  Serial - ok
13:15:03.0780 1160  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
13:15:03.0812 1160  sermouse - ok
13:15:03.0858 1160  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
13:15:03.0890 1160  SessionEnv - ok
13:15:03.0921 1160  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
13:15:03.0952 1160  sffdisk - ok
13:15:03.0968 1160  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
13:15:03.0999 1160  sffp_mmc - ok
13:15:04.0030 1160  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
13:15:04.0077 1160  sffp_sd - ok
13:15:04.0092 1160  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\DRIVERS\sfloppy.sys
13:15:04.0108 1160  sfloppy - ok
13:15:04.0139 1160  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
13:15:04.0186 1160  SharedAccess - ok
13:15:04.0233 1160  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
13:15:04.0280 1160  ShellHWDetection - ok
13:15:04.0295 1160  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
13:15:04.0311 1160  SiSRaid2 - ok
13:15:04.0326 1160  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
13:15:04.0326 1160  SiSRaid4 - ok
13:15:04.0373 1160  [ EA396139541706B4B433641D62EA53CE ] SkypeUpdate    C:\Program Files (x86)\Skype\Updater\Updater.exe
13:15:04.0404 1160  SkypeUpdate - ok
13:15:04.0420 1160  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
13:15:04.0467 1160  Smb - ok
13:15:04.0482 1160  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
13:15:04.0482 1160  SNMPTRAP - ok
13:15:04.0514 1160  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
13:15:04.0514 1160  spldr - ok
13:15:04.0560 1160  [ B96C17B5DC1424D56EEA3A99E97428CD ] Spooler        C:\Windows\System32\spoolsv.exe
13:15:04.0576 1160  Spooler - ok
13:15:04.0670 1160  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
13:15:04.0748 1160  sppsvc - ok
13:15:04.0763 1160  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
13:15:04.0841 1160  sppuinotify - ok
13:15:04.0888 1160  [ C2DDF8538A868639289663004A2020C4 ] SRTSP          C:\Windows\system32\Drivers\SRTSP64.SYS
13:15:04.0904 1160  SRTSP - ok
13:15:04.0935 1160  [ BAC5F3AD735B0D1C85F48CA00A422CF9 ] SRTSPL          C:\Windows\system32\Drivers\SRTSPL64.SYS
13:15:04.0950 1160  SRTSPL ( UnsignedFile.Multi.Generic ) - warning
13:15:04.0950 1160  SRTSPL - detected UnsignedFile.Multi.Generic (1)
13:15:04.0966 1160  [ 2BC8CFCD55481B6159AE2FCD09C8A4A6 ] SRTSPX          C:\Windows\system32\Drivers\SRTSPX64.SYS
13:15:04.0966 1160  SRTSPX ( UnsignedFile.Multi.Generic ) - warning
13:15:04.0966 1160  SRTSPX - detected UnsignedFile.Multi.Generic (1)
13:15:04.0997 1160  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\Windows\system32\DRIVERS\srv.sys
13:15:05.0091 1160  srv - ok
13:15:05.0122 1160  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
13:15:05.0216 1160  srv2 - ok
13:15:05.0262 1160  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
13:15:05.0325 1160  srvnet - ok
13:15:05.0356 1160  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
13:15:05.0387 1160  SSDPSRV - ok
13:15:05.0403 1160  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
13:15:05.0418 1160  SstpSvc - ok
13:15:05.0434 1160  Steam Client Service - ok
13:15:05.0496 1160  [ FC0A58529A02B1EED55DDC58696B7908 ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
13:15:05.0528 1160  Stereo Service - ok
13:15:05.0543 1160  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
13:15:05.0559 1160  stexstor - ok
13:15:05.0590 1160  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
13:15:05.0621 1160  stisvc - ok
13:15:05.0652 1160  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys
13:15:05.0684 1160  swenum - ok
13:15:05.0699 1160  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
13:15:05.0746 1160  swprv - ok
13:15:05.0824 1160  [ B758466B2788F31BC88F70A8C5DD388E ] Symantec AntiVirus C:\Program Files (x86)\Symantec AntiVirus\Rtvscan.exe
13:15:05.0871 1160  Symantec AntiVirus - ok
13:15:05.0886 1160  [ 6FEFA9749BFB5FD8C3A20E5C58817936 ] SymEvent        C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
13:15:05.0902 1160  SymEvent - ok
13:15:05.0964 1160  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain        C:\Windows\system32\sysmain.dll
13:15:06.0027 1160  SysMain - ok
13:15:06.0058 1160  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
13:15:06.0105 1160  TabletInputService - ok
13:15:06.0136 1160  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\Windows\System32\tapisrv.dll
13:15:06.0198 1160  TapiSrv - ok
13:15:06.0214 1160  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
13:15:06.0261 1160  TBS - ok
13:15:06.0354 1160  [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
13:15:06.0432 1160  Tcpip - ok
13:15:06.0464 1160  [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
13:15:06.0479 1160  TCPIP6 - ok
13:15:06.0510 1160  [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
13:15:06.0588 1160  tcpipreg - ok
13:15:06.0604 1160  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
13:15:06.0620 1160  TDPIPE - ok
13:15:06.0651 1160  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
13:15:06.0651 1160  TDTCP - ok
13:15:06.0682 1160  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
13:15:06.0713 1160  tdx - ok
13:15:06.0744 1160  [ 4283D7125BA4BD0CB50BB0F78B54257A ] TelekomNM6      C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys
13:15:06.0776 1160  TelekomNM6 - ok
13:15:06.0791 1160  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys
13:15:06.0791 1160  TermDD - ok
13:15:06.0838 1160  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\Windows\System32\termsrv.dll
13:15:06.0885 1160  TermService - ok
13:15:06.0916 1160  [ 9201BE2BAB8A9FF8E20D8439AE3BB04D ] Themes          C:\Windows\system32\themeservice.dll
13:15:06.0932 1160  Themes ( UnsignedFile.Multi.Generic ) - warning
13:15:06.0932 1160  Themes - detected UnsignedFile.Multi.Generic (1)
13:15:06.0978 1160  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
13:15:07.0025 1160  THREADORDER - ok
13:15:07.0041 1160  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
13:15:07.0056 1160  TrkWks - ok
13:15:07.0119 1160  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
13:15:07.0181 1160  TrustedInstaller - ok
13:15:07.0228 1160  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
13:15:07.0244 1160  tssecsrv - ok
13:15:07.0275 1160  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
13:15:07.0290 1160  TsUsbFlt - ok
13:15:07.0337 1160  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
13:15:07.0400 1160  tunnel - ok
13:15:07.0415 1160  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
13:15:07.0431 1160  uagp35 - ok
13:15:07.0462 1160  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
13:15:07.0509 1160  udfs - ok
13:15:07.0540 1160  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
13:15:07.0540 1160  UI0Detect - ok
13:15:07.0556 1160  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
13:15:07.0556 1160  uliagpkx - ok
13:15:07.0618 1160  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
13:15:07.0634 1160  umbus - ok
13:15:07.0665 1160  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
13:15:07.0665 1160  UmPass - ok
13:15:07.0696 1160  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
13:15:07.0727 1160  upnphost - ok
13:15:07.0758 1160  [ FB251567F41BC61988B26731DEC19E4B ] USBAAPL64      C:\Windows\system32\Drivers\usbaapl64.sys
13:15:07.0774 1160  USBAAPL64 - ok
13:15:07.0821 1160  [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
13:15:07.0852 1160  usbaudio - ok
13:15:07.0852 1160  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
13:15:07.0883 1160  usbccgp - ok
13:15:07.0930 1160  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
13:15:07.0961 1160  usbcir - ok
13:15:07.0977 1160  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
13:15:07.0977 1160  usbehci - ok
13:15:07.0992 1160  [ 2C780746DC44A28FE67004DC58173F05 ] usbfilter      C:\Windows\system32\DRIVERS\usbfilter.sys
13:15:08.0008 1160  usbfilter - ok
13:15:08.0024 1160  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
13:15:08.0039 1160  usbhub - ok
13:15:08.0039 1160  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci        C:\Windows\system32\DRIVERS\usbohci.sys
13:15:08.0055 1160  usbohci - ok
13:15:08.0070 1160  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
13:15:08.0070 1160  usbprint - ok
13:15:08.0133 1160  [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
13:15:08.0148 1160  usbscan - ok
13:15:08.0164 1160  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
13:15:08.0211 1160  USBSTOR - ok
13:15:08.0242 1160  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
13:15:08.0242 1160  usbuhci - ok
13:15:08.0289 1160  [ 70D05EE263568A742D14E1876DF80532 ] usb_rndisx      C:\Windows\system32\DRIVERS\usb8023x.sys
13:15:08.0351 1160  usb_rndisx - ok
13:15:08.0367 1160  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
13:15:08.0414 1160  UxSms - ok
13:15:08.0414 1160  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
13:15:08.0429 1160  VaultSvc - ok
13:15:08.0445 1160  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
13:15:08.0445 1160  vdrvroot - ok
13:15:08.0507 1160  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\Windows\System32\vds.exe
13:15:08.0554 1160  vds - ok
13:15:08.0585 1160  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
13:15:08.0585 1160  vga - ok
13:15:08.0601 1160  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
13:15:08.0679 1160  VgaSave - ok
13:15:08.0694 1160  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
13:15:08.0710 1160  vhdmp - ok
13:15:08.0726 1160  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
13:15:08.0741 1160  viaide - ok
13:15:08.0741 1160  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
13:15:08.0757 1160  volmgr - ok
13:15:08.0788 1160  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
13:15:08.0804 1160  volmgrx - ok
13:15:08.0804 1160  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
13:15:08.0819 1160  volsnap - ok
13:15:08.0850 1160  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\DRIVERS\vsmraid.sys
13:15:08.0850 1160  vsmraid - ok
13:15:08.0913 1160  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\Windows\system32\vssvc.exe
13:15:09.0022 1160  VSS - ok
13:15:09.0038 1160  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
13:15:09.0069 1160  vwifibus - ok
13:15:09.0084 1160  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
13:15:09.0116 1160  W32Time - ok
13:15:09.0131 1160  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
13:15:09.0131 1160  WacomPen - ok
13:15:09.0162 1160  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
13:15:09.0209 1160  WANARP - ok
13:15:09.0225 1160  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
13:15:09.0240 1160  Wanarpv6 - ok
13:15:09.0303 1160  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
13:15:09.0396 1160  wbengine - ok
13:15:09.0412 1160  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
13:15:09.0428 1160  WbioSrvc - ok
13:15:09.0459 1160  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\Windows\System32\wcncsvc.dll
13:15:09.0521 1160  wcncsvc - ok
13:15:09.0552 1160  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
13:15:09.0568 1160  WcsPlugInService - ok
13:15:09.0568 1160  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys
13:15:09.0584 1160  Wd - ok
13:15:09.0599 1160  [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
13:15:09.0630 1160  Wdf01000 - ok
13:15:09.0630 1160  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
13:15:09.0724 1160  WdiServiceHost - ok
13:15:09.0724 1160  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
13:15:09.0740 1160  WdiSystemHost - ok
13:15:09.0786 1160  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\Windows\System32\webclnt.dll
13:15:09.0833 1160  WebClient - ok
13:15:09.0849 1160  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
13:15:09.0896 1160  Wecsvc - ok
13:15:09.0911 1160  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
13:15:09.0942 1160  wercplsupport - ok
13:15:09.0942 1160  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
13:15:09.0974 1160  WerSvc - ok
13:15:09.0989 1160  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
13:15:10.0005 1160  WfpLwf - ok
13:15:10.0020 1160  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
13:15:10.0020 1160  WIMMount - ok
13:15:10.0036 1160  WinDefend - ok
13:15:10.0036 1160  WinHttpAutoProxySvc - ok
13:15:10.0083 1160  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
13:15:10.0145 1160  Winmgmt - ok
13:15:10.0223 1160  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\Windows\system32\WsmSvc.dll
13:15:10.0286 1160  WinRM - ok
13:15:10.0379 1160  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
13:15:10.0410 1160  WinUsb - ok
13:15:10.0442 1160  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
13:15:10.0488 1160  Wlansvc - ok
13:15:10.0520 1160  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
13:15:10.0520 1160  WmiAcpi - ok
13:15:10.0535 1160  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
13:15:10.0566 1160  wmiApSrv - ok
13:15:10.0582 1160  WMPNetworkSvc - ok
13:15:10.0598 1160  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
13:15:10.0629 1160  WPCSvc - ok
13:15:10.0676 1160  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
13:15:10.0722 1160  WPDBusEnum - ok
13:15:10.0738 1160  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
13:15:10.0800 1160  ws2ifsl - ok
13:15:10.0816 1160  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll
13:15:10.0816 1160  wscsvc - ok
13:15:10.0832 1160  WSearch - ok
13:15:10.0910 1160  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
13:15:10.0972 1160  wuauserv - ok
13:15:11.0003 1160  [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
13:15:11.0019 1160  WudfPf - ok
13:15:11.0050 1160  [ CF8D590BE3373029D57AF80914190682 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
13:15:11.0128 1160  WUDFRd - ok
13:15:11.0159 1160  [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
13:15:11.0190 1160  wudfsvc - ok
13:15:11.0190 1160  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc        C:\Windows\System32\wwansvc.dll
13:15:11.0206 1160  WwanSvc - ok
13:15:11.0222 1160  ================ Scan global ===============================
13:15:11.0253 1160  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
13:15:11.0284 1160  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
13:15:11.0300 1160  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
13:15:11.0346 1160  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
13:15:11.0378 1160  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
13:15:11.0378 1160  [Global] - ok
13:15:11.0378 1160  ================ Scan MBR ==================================
13:15:11.0393 1160  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk0\DR0
13:15:11.0518 1160  \Device\Harddisk0\DR0 - ok
13:15:11.0518 1160  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
13:15:11.0830 1160  \Device\Harddisk1\DR1 - ok
13:15:11.0830 1160  ================ Scan VBR ==================================
13:15:11.0830 1160  [ ACD272E1B729652070FECED0ED0B0F39 ] \Device\Harddisk0\DR0\Partition1
13:15:11.0830 1160  \Device\Harddisk0\DR0\Partition1 - ok
13:15:11.0861 1160  [ 8DE47F7197471D3BA775B48398446C2A ] \Device\Harddisk0\DR0\Partition2
13:15:11.0861 1160  \Device\Harddisk0\DR0\Partition2 - ok
13:15:11.0877 1160  [ ACC59F51F8C9F0F4809B7F7A9AA99721 ] \Device\Harddisk1\DR1\Partition1
13:15:11.0877 1160  \Device\Harddisk1\DR1\Partition1 - ok
13:15:11.0877 1160  [ 4991AA74751D5470610EF157B30D9F8B ] \Device\Harddisk1\DR1\Partition2
13:15:11.0877 1160  \Device\Harddisk1\DR1\Partition2 - ok
13:15:11.0892 1160  ============================================================
13:15:11.0892 1160  Scan finished
13:15:11.0892 1160  ============================================================
13:15:11.0892 2464  Detected object count: 11
13:15:11.0892 2464  Actual detected object count: 11
13:15:26.0276 2464  AsSysCtrlService ( UnsignedFile.Multi.Generic ) - skipped by user
13:15:26.0276 2464  AsSysCtrlService ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:15:26.0276 2464  FreemakeVideoCapture ( UnsignedFile.Multi.Generic ) - skipped by user
13:15:26.0276 2464  FreemakeVideoCapture ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:15:26.0276 2464  hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user
13:15:26.0276 2464  hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:15:26.0276 2464  hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user
13:15:26.0276 2464  hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:15:26.0291 2464  HPSLPSVC ( UnsignedFile.Multi.Generic ) - skipped by user
13:15:26.0291 2464  HPSLPSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:15:26.0291 2464  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
13:15:26.0291 2464  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:15:26.0291 2464  Netzmanager Service ( UnsignedFile.Multi.Generic ) - skipped by user
13:15:26.0291 2464  Netzmanager Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:15:26.0291 2464  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
13:15:26.0291 2464  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:15:26.0307 2464  SRTSPL ( UnsignedFile.Multi.Generic ) - skipped by user
13:15:26.0307 2464  SRTSPL ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:15:26.0307 2464  SRTSPX ( UnsignedFile.Multi.Generic ) - skipped by user
13:15:26.0307 2464  SRTSPX ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:15:26.0307 2464  Themes ( UnsignedFile.Multi.Generic ) - skipped by user
13:15:26.0307 2464  Themes ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:16:48.0188 2496  Deinitialize success

cosinus 17.09.2012 12:37
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Galge 17.09.2012 13:55
Das müsste ja der richtige log sein oder? ComboFix?

Code:
ComboFix 12-09-16.01 - Galge 17.09.2012  14:35:45.1.6 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.8190.5597 [GMT 2:00]
ausgeführt von:: c:\users\Galge\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Galge\md5.exe
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_npf
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-08-17 bis 2012-09-17  ))))))))))))))))))))))))))))))
.
.
2012-09-17 12:31 . 2012-08-23 08:26        9310152        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E1DF216E-C8A0-40D0-96B7-A7830CE2D568}\mpengine.dll
2012-09-16 16:21 . 2012-09-16 16:21        --------        d-----w-        C:\_OTL
2012-09-15 03:28 . 2012-08-23 08:26        9310152        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-09-12 11:28 . 2012-08-22 18:12        1913200        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2012-09-12 11:28 . 2012-08-22 18:12        376688        ----a-w-        c:\windows\system32\drivers\netio.sys
2012-09-12 11:28 . 2012-08-22 18:12        288624        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS
2012-09-11 22:38 . 2012-09-11 22:38        --------        d-----w-        c:\program files (x86)\ESET
2012-09-11 12:43 . 2012-09-11 12:43        --------        d-----w-        c:\users\Galge\AppData\Roaming\Malwarebytes
2012-09-11 12:42 . 2012-09-11 12:42        --------        d-----w-        c:\programdata\Malwarebytes
2012-09-11 12:42 . 2012-09-11 12:43        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-09-11 12:42 . 2012-09-07 15:04        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-09-11 09:50 . 2012-09-11 09:50        --------        d-----w-        c:\program files (x86)\Guild Wars 2
2012-09-10 14:04 . 2012-09-10 14:04        --------        d-----w-        c:\program files (x86)\Common Files\Java
2012-09-10 14:03 . 2012-09-10 14:03        95208        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-09-10 14:03 . 2012-09-10 14:03        --------        d-----w-        c:\program files (x86)\Java
2012-09-10 13:33 . 2012-09-10 13:51        --------        d-----w-        c:\programdata\eenmqodvcsibfds
2012-09-08 21:01 . 2012-09-08 21:01        --------        d-----w-        c:\users\Galge\AppData\Roaming\hybrid
2012-09-08 20:45 . 2012-09-08 20:49        --------        d-----w-        c:\users\Galge\AppData\Roaming\HandBrake
2012-09-08 20:45 . 2012-09-10 13:51        --------        d-----w-        c:\program files\Handbrake
2012-09-08 20:30 . 2012-09-08 20:32        --------        d-----w-        c:\users\Galge\AppData\Roaming\avidemux
2012-09-04 01:08 . 2009-03-18 15:35        33856        ---ha-w-        c:\windows\system32\hamachi.sys
2012-09-04 01:08 . 2012-09-04 01:08        --------        d-----w-        c:\program files (x86)\LogMeIn Hamachi
2012-09-02 16:13 . 2012-09-17 11:11        --------        d-----w-        c:\users\Galge\AppData\Local\LogMeIn Hamachi
2012-08-26 02:44 . 2012-08-26 02:44        --------        d-----w-        c:\users\Galge\AppData\Local\Chromium
2012-08-26 02:08 . 2012-09-02 00:31        --------        d-----w-        c:\users\Galge\AppData\Roaming\HpUpdate
2012-08-26 02:08 . 2012-08-26 02:08        --------        d-----w-        c:\windows\Hewlett-Packard
2012-08-25 21:31 . 2012-08-25 21:31        --------        d-----w-        c:\program files (x86)\Gameforge
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-17 11:50 . 2012-04-08 14:14        283304        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr
2012-09-17 11:50 . 2012-04-08 12:08        283304        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe
2012-09-17 11:50 . 2012-04-08 12:08        280904        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0
2012-09-13 01:00 . 2012-04-23 20:51        64462936        ----a-w-        c:\windows\system32\MRT.exe
2012-09-10 14:03 . 2012-05-26 18:26        746984        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2012-08-22 13:24 . 2012-04-08 10:54        73416        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-22 13:24 . 2012-04-08 10:54        696520        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-09 17:22 . 2012-08-09 17:22        955840        ----a-w-        c:\windows\system32\npDeployJava1.dll
2012-08-09 17:22 . 2012-08-09 17:22        839096        ----a-w-        c:\windows\system32\deployJava1.dll
2012-08-09 17:22 . 2012-08-09 17:22        268720        ----a-w-        c:\windows\system32\javaws.exe
2012-08-09 17:22 . 2012-08-09 17:22        189360        ----a-w-        c:\windows\system32\javaw.exe
2012-08-09 17:22 . 2012-08-09 17:22        188840        ----a-w-        c:\windows\system32\java.exe
2012-07-18 18:15 . 2012-08-15 20:35        3148800        ----a-w-        c:\windows\system32\win32k.sys
2012-07-15 21:16 . 2012-07-15 21:16        283200        ----a-w-        c:\windows\system32\drivers\dtsoftbus01.sys
2012-07-14 14:36 . 2012-07-14 14:36        156008        ----a-w-        c:\windows\system32\drivers\SYMEVENT64x86.SYS
2012-07-07 11:06 . 2012-07-07 11:06        65536        ----a-r-        c:\users\Galge\AppData\Roaming\Microsoft\Installer\{9AA761E6-CA51-4FF2-A552-D51638BF0595}\_F8287203FA05_4196_A6DF_946113EFA737.exe
2012-07-04 22:16 . 2012-08-15 20:35        73216        ----a-w-        c:\windows\system32\netapi32.dll
2012-07-04 22:13 . 2012-08-15 20:35        59392        ----a-w-        c:\windows\system32\browcli.dll
2012-07-04 22:13 . 2012-08-15 20:35        136704        ----a-w-        c:\windows\system32\browser.dll
2012-07-04 21:14 . 2012-08-15 20:35        41984        ----a-w-        c:\windows\SysWow64\browcli.dll
2012-06-29 04:55 . 2012-08-15 22:28        17809920        ----a-w-        c:\windows\system32\mshtml.dll
2012-06-29 04:09 . 2012-08-15 22:28        10925568        ----a-w-        c:\windows\system32\ieframe.dll
2012-06-29 03:56 . 2012-08-15 22:28        2312704        ----a-w-        c:\windows\system32\jscript9.dll
2012-06-29 03:49 . 2012-08-15 22:28        1346048        ----a-w-        c:\windows\system32\urlmon.dll
2012-06-29 03:49 . 2012-08-15 22:28        1392128        ----a-w-        c:\windows\system32\wininet.dll
2012-06-29 03:48 . 2012-08-15 22:28        1494528        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-06-29 03:47 . 2012-08-15 22:28        237056        ----a-w-        c:\windows\system32\url.dll
2012-06-29 03:45 . 2012-08-15 22:28        85504        ----a-w-        c:\windows\system32\jsproxy.dll
2012-06-29 03:44 . 2012-08-15 22:28        816640        ----a-w-        c:\windows\system32\jscript.dll
2012-06-29 03:43 . 2012-08-15 22:28        173056        ----a-w-        c:\windows\system32\ieUnatt.exe
2012-06-29 03:42 . 2012-08-15 22:28        2144768        ----a-w-        c:\windows\system32\iertutil.dll
2012-06-29 03:40 . 2012-08-15 22:28        96768        ----a-w-        c:\windows\system32\mshtmled.dll
2012-06-29 03:39 . 2012-08-15 22:28        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2012-06-29 03:35 . 2012-08-15 22:28        248320        ----a-w-        c:\windows\system32\ieui.dll
2012-06-29 00:16 . 2012-08-15 22:28        1800704        ----a-w-        c:\windows\SysWow64\jscript9.dll
2012-06-29 00:09 . 2012-08-15 22:28        1129472        ----a-w-        c:\windows\SysWow64\wininet.dll
2012-06-29 00:08 . 2012-08-15 22:28        1427968        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2012-06-29 00:04 . 2012-08-15 22:28        142848        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2012-06-29 00:00 . 2012-08-15 22:28        2382848        ----a-w-        c:\windows\SysWow64\mshtml.tlb
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VeohPlugin"="c:\program files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2012-06-11 4692840]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"TurboV EVO"="c:\program files\ASUS\TurboV EVO\TurboV_EVO.exe" [2010-07-15 9936512]
"Six Engine"="c:\program files (x86)\ASUS\EPU\EPU.exe" [2010-03-16 5309056]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-26 375000]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-01-19 43632]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"ccApp"="c:\program files (x86)\Common Files\Symantec Shared\ccApp.exe" [2006-12-07 107112]
"vptray"="c:\progra~2\SYMANT~1\VPTray.exe" [2007-01-05 135216]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-08-29 1996200]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-03-01 2348352]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-03 160944]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-22 250568]
R3 dump_wmimmc;dump_wmimmc;c:\program files\gPotato.eu\Rappelz\GameGuard\dump_wmimmc.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-10 114144]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]
R3 TelekomNM6;Telekom Netzmanager Packet Filter Driver;c:\program files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [2010-09-16 45664]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-04-25 52736]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-07-15 283200]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe [2010-06-24 109056]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]
S2 DTSAudioService;DTSAudioService;c:\program files\Realtek\Audio\HDA\DTSAudioService64.exe [2011-05-31 210024]
S2 FreemakeVideoCapture;FreemakeVideoCapture;c:\program files (x86)\Freemake\CaptureLib\CaptureLibService.exe [2012-04-05 8704]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-08-29 2369960]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-02-29 382272]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-08-01 138912]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-04-27 83080]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-04-27 184968]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-01-17 188224]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 13:24]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LgDeviceAgent"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2009-08-13 415752]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2009-08-13 4195848]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-03-20 6468712]
"RtHDVBg_DTS"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2012-03-09 1158248]
"combofix"="c:\combofix\CF31458.3XE" [2010-11-20 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~4\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Galge\AppData\Roaming\Mozilla\Firefox\Profiles\5ywp62yf.default\
FF - prefs.js: network.proxy.http - www-proxy.t-online.de
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{cd90bf73-20f6-44ef-993d-bb920303bd2e} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1214310950-730897569-3731794000-1000\Software\GrandCross\0 ´* & ’v*’0 ’X*]
"InstMode"=hex:00,00,00,00
"InstPath"="c:\\Program Files (x86)\\GrandCross\\‰´–…ƒvƒ‰ƒX"
"DataPath"="c:\\Users\\Galge\\Documents\\GrandCross\\‰´–…ƒvƒ‰ƒX\\"
.
[HKEY_USERS\S-1-5-21-1214310950-730897569-3731794000-1000\Software\GrandCross\0 ´* & ’v*’0 ’X*\System]
"gbFullScreenFlag"=hex:00,00,00,00
"gnWindowLeft"=hex:2d,02,00,00
"gnWindowTop"=hex:e2,00,00,00
"gdwWindowWidth"=hex:20,03,00,00
"gdwWindowHeight"=hex:58,02,00,00
"gdwWindowBpp"=hex:18,00,00,00
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\0 ´* & ’v*’0 ’X*]
"DisplayName"="‰´–…ƒvƒ‰ƒX"
"UninstallString"="c:\\Program Files (x86)\\GrandCross\\‰´–…ƒvƒ‰ƒX\\UNINST.EXE"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Symantec Shared\ccSvcHst.exe
c:\windows\DAODx.exe
c:\program files\ASUS\GPU Boost Driver\GpuBoostServer.exe
c:\program files\ASUS\TurboV EVO\TurboVHELP.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Symantec AntiVirus\DefWatch.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Symantec AntiVirus\Rtvscan.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-09-17  14:47:57 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-09-17 12:47
.
Vor Suchlauf: 10 Verzeichnis(se), 427.988.340.736 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 427.680.960.512 Bytes frei
.
- - End Of File - - 87283663222F139AA17D4038D11A6F9A

cosinus 17.09.2012 14:54
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Folder::
c:\programdata\eenmqodvcsibfds

Filelook::
c:\users\Galge\AppData\Roaming\Microsoft\Installer\{9AA761E6-CA51-4FF2-A552-D51638BF0595}\_F8287203FA05_4196_A6DF_946113EFA737.exe
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Galge 17.09.2012 15:35
So hier bitte:

Code:
ComboFix 12-09-16.01 - Galge 17.09.2012  16:18:13.2.6 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.8190.6147 [GMT 2:00]
ausgeführt von:: c:\users\Galge\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Galge\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\eenmqodvcsibfds
c:\programdata\eenmqodvcsibfds\btn-green.png
c:\programdata\eenmqodvcsibfds\corners-btn.png
c:\programdata\eenmqodvcsibfds\corners1.png
c:\programdata\eenmqodvcsibfds\corners2.png
c:\programdata\eenmqodvcsibfds\corners3.png
c:\programdata\eenmqodvcsibfds\corners4.png
c:\programdata\eenmqodvcsibfds\de-flag.png
c:\programdata\eenmqodvcsibfds\de-image.png
c:\programdata\eenmqodvcsibfds\ie6-7.css
c:\programdata\eenmqodvcsibfds\McAfee.png
c:\programdata\eenmqodvcsibfds\pays-de.png
c:\programdata\eenmqodvcsibfds\steps-de.png
c:\programdata\eenmqodvcsibfds\steps-en.png
c:\programdata\eenmqodvcsibfds\style.css
c:\programdata\eenmqodvcsibfds\tabs.png
c:\programdata\eenmqodvcsibfds\wait.html
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-08-17 bis 2012-09-17  ))))))))))))))))))))))))))))))
.
.
2012-09-17 14:22 . 2012-09-17 14:22        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2012-09-17 14:22 . 2012-09-17 14:22        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-09-16 16:21 . 2012-09-16 16:21        --------        d-----w-        C:\_OTL
2012-09-12 11:28 . 2012-08-22 18:12        1913200        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2012-09-12 11:28 . 2012-08-22 18:12        376688        ----a-w-        c:\windows\system32\drivers\netio.sys
2012-09-12 11:28 . 2012-08-22 18:12        288624        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS
2012-09-11 22:38 . 2012-09-11 22:38        --------        d-----w-        c:\program files (x86)\ESET
2012-09-11 12:43 . 2012-09-11 12:43        --------        d-----w-        c:\users\Galge\AppData\Roaming\Malwarebytes
2012-09-11 12:42 . 2012-09-11 12:42        --------        d-----w-        c:\programdata\Malwarebytes
2012-09-11 12:42 . 2012-09-11 12:43        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-09-11 12:42 . 2012-09-07 15:04        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-09-11 09:50 . 2012-09-11 09:50        --------        d-----w-        c:\program files (x86)\Guild Wars 2
2012-09-10 14:04 . 2012-09-10 14:04        --------        d-----w-        c:\program files (x86)\Common Files\Java
2012-09-10 14:03 . 2012-09-10 14:03        95208        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-09-10 14:03 . 2012-09-10 14:03        --------        d-----w-        c:\program files (x86)\Java
2012-09-08 21:01 . 2012-09-08 21:01        --------        d-----w-        c:\users\Galge\AppData\Roaming\hybrid
2012-09-08 20:45 . 2012-09-08 20:49        --------        d-----w-        c:\users\Galge\AppData\Roaming\HandBrake
2012-09-08 20:45 . 2012-09-10 13:51        --------        d-----w-        c:\program files\Handbrake
2012-09-08 20:30 . 2012-09-08 20:32        --------        d-----w-        c:\users\Galge\AppData\Roaming\avidemux
2012-09-04 01:08 . 2009-03-18 15:35        33856        ---ha-w-        c:\windows\system32\hamachi.sys
2012-09-04 01:08 . 2012-09-04 01:08        --------        d-----w-        c:\program files (x86)\LogMeIn Hamachi
2012-09-02 16:13 . 2012-09-17 14:14        --------        d-----w-        c:\users\Galge\AppData\Local\LogMeIn Hamachi
2012-08-26 02:44 . 2012-08-26 02:44        --------        d-----w-        c:\users\Galge\AppData\Local\Chromium
2012-08-26 02:08 . 2012-09-02 00:31        --------        d-----w-        c:\users\Galge\AppData\Roaming\HpUpdate
2012-08-26 02:08 . 2012-08-26 02:08        --------        d-----w-        c:\windows\Hewlett-Packard
2012-08-25 21:31 . 2012-08-25 21:31        --------        d-----w-        c:\program files (x86)\Gameforge
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-17 11:50 . 2012-04-08 14:14        283304        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr
2012-09-17 11:50 . 2012-04-08 12:08        283304        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe
2012-09-17 11:50 . 2012-04-08 12:08        280904        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0
2012-09-13 01:00 . 2012-04-23 20:51        64462936        ----a-w-        c:\windows\system32\MRT.exe
2012-09-10 14:03 . 2012-05-26 18:26        746984        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2012-08-22 13:24 . 2012-04-08 10:54        73416        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-22 13:24 . 2012-04-08 10:54        696520        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-09 17:22 . 2012-08-09 17:22        955840        ----a-w-        c:\windows\system32\npDeployJava1.dll
2012-08-09 17:22 . 2012-08-09 17:22        839096        ----a-w-        c:\windows\system32\deployJava1.dll
2012-08-09 17:22 . 2012-08-09 17:22        268720        ----a-w-        c:\windows\system32\javaws.exe
2012-08-09 17:22 . 2012-08-09 17:22        189360        ----a-w-        c:\windows\system32\javaw.exe
2012-08-09 17:22 . 2012-08-09 17:22        188840        ----a-w-        c:\windows\system32\java.exe
2012-07-18 18:15 . 2012-08-15 20:35        3148800        ----a-w-        c:\windows\system32\win32k.sys
2012-07-15 21:16 . 2012-07-15 21:16        283200        ----a-w-        c:\windows\system32\drivers\dtsoftbus01.sys
2012-07-14 14:36 . 2012-07-14 14:36        156008        ----a-w-        c:\windows\system32\drivers\SYMEVENT64x86.SYS
2012-07-07 11:06 . 2012-07-07 11:06        65536        ----a-r-        c:\users\Galge\AppData\Roaming\Microsoft\Installer\{9AA761E6-CA51-4FF2-A552-D51638BF0595}\_F8287203FA05_4196_A6DF_946113EFA737.exe
2012-07-04 22:16 . 2012-08-15 20:35        73216        ----a-w-        c:\windows\system32\netapi32.dll
2012-07-04 22:13 . 2012-08-15 20:35        59392        ----a-w-        c:\windows\system32\browcli.dll
2012-07-04 22:13 . 2012-08-15 20:35        136704        ----a-w-        c:\windows\system32\browser.dll
2012-07-04 21:14 . 2012-08-15 20:35        41984        ----a-w-        c:\windows\SysWow64\browcli.dll
2012-06-29 04:55 . 2012-08-15 22:28        17809920        ----a-w-        c:\windows\system32\mshtml.dll
2012-06-29 04:09 . 2012-08-15 22:28        10925568        ----a-w-        c:\windows\system32\ieframe.dll
2012-06-29 03:56 . 2012-08-15 22:28        2312704        ----a-w-        c:\windows\system32\jscript9.dll
2012-06-29 03:49 . 2012-08-15 22:28        1346048        ----a-w-        c:\windows\system32\urlmon.dll
2012-06-29 03:49 . 2012-08-15 22:28        1392128        ----a-w-        c:\windows\system32\wininet.dll
2012-06-29 03:48 . 2012-08-15 22:28        1494528        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-06-29 03:47 . 2012-08-15 22:28        237056        ----a-w-        c:\windows\system32\url.dll
2012-06-29 03:45 . 2012-08-15 22:28        85504        ----a-w-        c:\windows\system32\jsproxy.dll
2012-06-29 03:44 . 2012-08-15 22:28        816640        ----a-w-        c:\windows\system32\jscript.dll
2012-06-29 03:43 . 2012-08-15 22:28        173056        ----a-w-        c:\windows\system32\ieUnatt.exe
2012-06-29 03:42 . 2012-08-15 22:28        2144768        ----a-w-        c:\windows\system32\iertutil.dll
2012-06-29 03:40 . 2012-08-15 22:28        96768        ----a-w-        c:\windows\system32\mshtmled.dll
2012-06-29 03:39 . 2012-08-15 22:28        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2012-06-29 03:35 . 2012-08-15 22:28        248320        ----a-w-        c:\windows\system32\ieui.dll
2012-06-29 00:16 . 2012-08-15 22:28        1800704        ----a-w-        c:\windows\SysWow64\jscript9.dll
2012-06-29 00:09 . 2012-08-15 22:28        1129472        ----a-w-        c:\windows\SysWow64\wininet.dll
2012-06-29 00:08 . 2012-08-15 22:28        1427968        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2012-06-29 00:04 . 2012-08-15 22:28        142848        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2012-06-29 00:00 . 2012-08-15 22:28        2382848        ----a-w-        c:\windows\SysWow64\mshtml.tlb
.
.
((((((((((((((((((((((((((((((((((((((((((((  Look  )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
--- c:\users\Galge\AppData\Roaming\Microsoft\Installer\{9AA761E6-CA51-4FF2-A552-D51638BF0595}\_F8287203FA05_4196_A6DF_946113EFA737.exe ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File size: 65536
Created time: 2012-07-07 11:06
Modified time: 2012-07-07 11:06
MD5: 87E54AD8511D92729EF70F8FF57A97BA
SHA1: D8CF57CE644AA10E73A32E77E096912A450405BC
.
.
(((((((((((((((((((((((((((((  SnapShot@2012-09-17_12.43.45  )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-04-08 10:06 . 2012-09-17 14:27        47000              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-09-17 14:27        33366              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2012-04-08 09:56 . 2012-09-17 14:27        12998              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1214310950-730897569-3731794000-1000_UserData.bin
+ 2012-09-17 14:24 . 2012-09-17 14:24        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-09-17 12:42 . 2012-09-17 12:42        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-09-17 12:42 . 2012-09-17 12:42        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-09-17 14:24 . 2012-09-17 14:24        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 05:01 . 2012-09-17 12:40        256020              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-09-17 14:23        256020              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-04-09 02:08 . 2012-09-17 14:23        4558164              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1214310950-730897569-3731794000-1000-8192.dat
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VeohPlugin"="c:\program files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2012-06-11 4692840]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"TurboV EVO"="c:\program files\ASUS\TurboV EVO\TurboV_EVO.exe" [2010-07-15 9936512]
"Six Engine"="c:\program files (x86)\ASUS\EPU\EPU.exe" [2010-03-16 5309056]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-26 375000]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-01-19 43632]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"ccApp"="c:\program files (x86)\Common Files\Symantec Shared\ccApp.exe" [2006-12-07 107112]
"vptray"="c:\progra~2\SYMANT~1\VPTray.exe" [2007-01-05 135216]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-08-29 1996200]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-03-01 2348352]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-03 160944]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-22 250568]
R3 dump_wmimmc;dump_wmimmc;c:\program files\gPotato.eu\Rappelz\GameGuard\dump_wmimmc.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-10 114144]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]
R3 TelekomNM6;Telekom Netzmanager Packet Filter Driver;c:\program files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [2010-09-16 45664]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-04-25 52736]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-07-15 283200]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe [2010-06-24 109056]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]
S2 DTSAudioService;DTSAudioService;c:\program files\Realtek\Audio\HDA\DTSAudioService64.exe [2011-05-31 210024]
S2 FreemakeVideoCapture;FreemakeVideoCapture;c:\program files (x86)\Freemake\CaptureLib\CaptureLibService.exe [2012-04-05 8704]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-08-29 2369960]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-02-29 382272]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-08-01 138912]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-04-27 83080]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-04-27 184968]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-01-17 188224]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 13:24]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LgDeviceAgent"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2009-08-13 415752]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2009-08-13 4195848]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-03-20 6468712]
"RtHDVBg_DTS"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2012-03-09 1158248]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~4\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Galge\AppData\Roaming\Mozilla\Firefox\Profiles\5ywp62yf.default\
FF - prefs.js: network.proxy.http - www-proxy.t-online.de
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.type - 0
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1214310950-730897569-3731794000-1000\Software\GrandCross\0 ´* & ’v*’0 ’X*]
"InstMode"=hex:00,00,00,00
"InstPath"="c:\\Program Files (x86)\\GrandCross\\‰´–…ƒvƒ‰ƒX"
"DataPath"="c:\\Users\\Galge\\Documents\\GrandCross\\‰´–…ƒvƒ‰ƒX\\"
.
[HKEY_USERS\S-1-5-21-1214310950-730897569-3731794000-1000\Software\GrandCross\0 ´* & ’v*’0 ’X*\System]
"gbFullScreenFlag"=hex:00,00,00,00
"gnWindowLeft"=hex:2d,02,00,00
"gnWindowTop"=hex:e2,00,00,00
"gdwWindowWidth"=hex:20,03,00,00
"gdwWindowHeight"=hex:58,02,00,00
"gdwWindowBpp"=hex:18,00,00,00
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\0 ´* & ’v*’0 ’X*]
"DisplayName"="‰´–…ƒvƒ‰ƒX"
"UninstallString"="c:\\Program Files (x86)\\GrandCross\\‰´–…ƒvƒ‰ƒX\\UNINST.EXE"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Symantec Shared\ccSvcHst.exe
c:\windows\DAODx.exe
c:\program files\ASUS\TurboV EVO\TurboVHELP.exe
c:\program files\ASUS\GPU Boost Driver\GpuBoostServer.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Symantec AntiVirus\DefWatch.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Symantec AntiVirus\Rtvscan.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-09-17  16:29:24 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-09-17 14:29
ComboFix2.txt  2012-09-17 12:47
.
Vor Suchlauf: 13 Verzeichnis(se), 427.447.013.376 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 427.406.237.696 Bytes frei
.
- - End Of File - - 938A7E23442139FE76F86AE466052CF4

cosinus 17.09.2012 19:59
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Galge 18.09.2012 02:11
So erstmal zu GMER.
Das Programm ist nicht abgestürzt oder sonstiges, aber er hat mir nach dem Scan nichts zum Kopieren gegeben.

So aber hier OSAM:

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 02:44:53 on 18.09.2012

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 64-bit
Default Browser: Mozilla Corporation Firefox 15.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

[Control Panel Objects]
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"SYMLIVE" - "Symantec Corporation" - C:\Program Files (x86)\Symantec\LiveUpdate\S32LUCP2.CPL

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AsIO" (AsIO) - ? - C:\Windows\SysWow64\drivers\AsIO.sys  (File found, but it contains no detailed information)
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"CrystalSysInfo" (CrystalSysInfo) - ? - C:\Program Files\MediaCoder\SysInfoX64.sys  (File found, but it contains no detailed information)
"dump_wmimmc" (dump_wmimmc) - ? - C:\Program Files\gPotato.eu\Rappelz\GameGuard\dump_wmimmc.sys  (File not found)
"EraserUtilRebootDrv" (EraserUtilRebootDrv) - "Symantec Corporation" - C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
"Hamachi Network Interface" (hamachi) - "LogMeIn, Inc." - C:\Windows\System32\DRIVERS\hamachi.sys
"NAVENG" (NAVENG) - "Symantec Corporation" - C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20120914.002\ENG64.SYS
"NAVEX15" (NAVEX15) - "Symantec Corporation" - C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20120914.002\EX64.SYS
"NPPTNT2" (NPPTNT2) - ? - C:\Windows\system32\npptNT2.sys  (File not found)
"SRTSP" (SRTSP) - "Symantec Corporation" - C:\Windows\System32\Drivers\SRTSP64.SYS
"SRTSPL" (SRTSPL) - "Symantec Corporation" - C:\Windows\System32\Drivers\SRTSPL64.SYS
"SRTSPX" (SRTSPX) - "Symantec Corporation" - C:\Windows\System32\Drivers\SRTSPX64.SYS
"Symantec Eraser Control driver" (eeCtrl) - "Symantec Corporation" - C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
"SymEvent" (SymEvent) - "Symantec Corporation" - C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
"Telekom Netzmanager Packet Filter Driver" (TelekomNM6) - "Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH" - C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{2C7339CF-2B09-4501-B3F3-F3508C9228ED} "Themes Setup" - "Microsoft Corporation" - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\OFFICE11\msohev.dll
{8BEEE74D-455E-4616-A97A-F6E86C317F32} "VpshellEx Class" - "Symantec Corporation" - C:\Program Files (x86)\Common Files\Symantec Shared\SSC\vpshell2.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{555D4D79-4BD2-4094-A395-CFC534424A05} "HP Smart Web Printing" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} "SearchHook Class" - "DeviceVM, Inc." - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Smart Web Printing ein- oder ausblenden" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~4\OFFICE11\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{0347C33E-8762-4905-BF09-768834316C61} "HP Print Enhancer" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Galge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"VeohPlugin" - "Veoh Networks" - "C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"APSDaemon" - "Apple Inc." - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"BCU" - "DeviceVM, Inc." - "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
"ccApp" - "Symantec Corporation" - "C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe"
"HP Software Update" - "Hewlett-Packard" - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper" - "Apple Inc." - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"JMB36X IDE Setup" - ? - C:\Windows\RaidTool\xInsIDE.exe  (File found, but it contains no detailed information)
"LogMeIn Hamachi Ui" - "LogMeIn Inc." - "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
"NUSB3MON" - "Renesas Electronics Corporation" - "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
"Six Engine" - "

ASUSTeK Computer Inc." - "C:\Program Files (x86)\ASUS\EPU\EPU.exe" -b
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"TurboV EVO" - "ASUSTeK Computer Inc." - "C:\Program Files\ASUS\TurboV EVO\TurboV_EVO.exe" -b
"vptray" - "Symantec Corporation" - C:\PROGRA~2\SYMANT~1\VPTray.exe

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"@%SystemRoot%\System32\themeservice.dll,-8192" (Themes) - "Microsoft Corporation" - C:\Windows\system32\themeservice.dll
"@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243" (NisSrv) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\NisSrv.exe
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
"ASUS System Control Service" (AsSysCtrlService) - ? - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe  (File found, but it contains no detailed information)
"Browser Configuration Utility Service" (BCUService) - "DeviceVM, Inc." - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"FreemakeVideoCapture" (FreemakeVideoCapture) - "Microsoft" - C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe
"HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
"HP Network Devices Support" (HPSLPSVC) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"LiveUpdate" (LiveUpdate) - "Symantec Corporation" - C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE
"Logitech Bluetooth Service" (LBTServ) - "Logitech, Inc." - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
"LogMeIn Hamachi Tunneling Engine" (Hamachi2Svc) - "LogMeIn Inc." - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\MsMpEng.exe
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll
"Netzmanager Infrastruktur Informationssystem Dienst" (Netzmanager Service) - "Deutsche Telekom AG" - C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
"nProtect GameGuard Service" (npggsvc) - ? - C:\Windows\system32\GameMon.des -service  (File not found)
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe
"NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
"NVIDIA Update Service Daemon" (nvUpdatusService) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll
"PnkBstrA" (PnkBstrA) - ? - C:\Windows\system32\PnkBstrA.exe  (File not found)
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe
"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
"Symantec AntiVirus" (Symantec AntiVirus) - "Symantec Corporation" - C:\Program Files (x86)\Symantec AntiVirus\Rtvscan.exe
"Symantec AntiVirus Definition Watcher" (DefWatch) - "Symantec Corporation" - C:\Program Files (x86)\Symantec AntiVirus\DefWatch.exe
"Symantec Event Manager" (ccEvtMgr) - "Symantec Corporation" - C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe
"Symantec Settings Manager" (ccSetMgr) - "Symantec Corporation" - C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files (x86)\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Und hier aswMBR:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-18 03:01:12
-----------------------------
03:01:12.750    OS Version: Windows x64 6.1.7601 Service Pack 1
03:01:12.750    Number of processors: 6 586 0xA00
03:01:12.750    ComputerName: ANIMENIA  UserName: Galge
03:01:15.277    Initialize success
03:02:05.526    AVAST engine defs: 12091400
03:02:08.241    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
03:02:08.256    Disk 0 Vendor: WDC_WD10EARX-00N0YB0 51.0AB51 Size: 953869MB BusType: 3
03:02:08.256    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T1L0-4
03:02:08.256    Disk 1 Vendor: SAMSUNG_HD753LJ 1AA01118 Size: 715403MB BusType: 3
03:02:08.272    Disk 0 MBR read successfully
03:02:08.272    Disk 0 MBR scan
03:02:08.288    Disk 0 unknown MBR code
03:02:08.288    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
03:02:08.303    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      953767 MB offset 206848
03:02:08.319    Disk 0 scanning C:\Windows\system32\drivers
03:02:18.459    Service scanning
03:02:37.553    Modules scanning
03:02:37.569    Disk 0 trace - called modules:
03:02:37.585    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
03:02:37.600    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007bb7790]
03:02:37.600    3 CLASSPNP.SYS[fffff880018ea43f] -> nt!IofCallDriver -> [0xfffffa8007afd9b0]
03:02:37.600    5 ACPI.sys[fffff88000e9f7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa8007bbf060]
03:02:39.488    AVAST engine scan C:\Windows
03:02:43.216    AVAST engine scan C:\Windows\system32
03:05:05.317    AVAST engine scan C:\Windows\system32\drivers
03:05:17.828    AVAST engine scan C:\Users\Galge
03:08:15.403    Disk 0 MBR has been saved successfully to "C:\Users\Galge\Desktop\MBR.dat"
03:08:15.419    The log file has been saved successfully to "C:\Users\Galge\Desktop\aswMBR.txt"
MfG

cosinus 19.09.2012 11:07
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Galge 20.09.2012 00:10
So hier bitte:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-18 03:01:12
-----------------------------
03:01:12.750    OS Version: Windows x64 6.1.7601 Service Pack 1
03:01:12.750    Number of processors: 6 586 0xA00
03:01:12.750    ComputerName: ANIMENIA  UserName: Galge
03:01:15.277    Initialize success
03:02:05.526    AVAST engine defs: 12091400
03:02:08.241    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
03:02:08.256    Disk 0 Vendor: WDC_WD10EARX-00N0YB0 51.0AB51 Size: 953869MB BusType: 3
03:02:08.256    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T1L0-4
03:02:08.256    Disk 1 Vendor: SAMSUNG_HD753LJ 1AA01118 Size: 715403MB BusType: 3
03:02:08.272    Disk 0 MBR read successfully
03:02:08.272    Disk 0 MBR scan
03:02:08.288    Disk 0 unknown MBR code
03:02:08.288    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
03:02:08.303    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      953767 MB offset 206848
03:02:08.319    Disk 0 scanning C:\Windows\system32\drivers
03:02:18.459    Service scanning
03:02:37.553    Modules scanning
03:02:37.569    Disk 0 trace - called modules:
03:02:37.585    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
03:02:37.600    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007bb7790]
03:02:37.600    3 CLASSPNP.SYS[fffff880018ea43f] -> nt!IofCallDriver -> [0xfffffa8007afd9b0]
03:02:37.600    5 ACPI.sys[fffff88000e9f7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa8007bbf060]
03:02:39.488    AVAST engine scan C:\Windows
03:02:43.216    AVAST engine scan C:\Windows\system32
03:05:05.317    AVAST engine scan C:\Windows\system32\drivers
03:05:17.828    AVAST engine scan C:\Users\Galge
03:08:15.403    Disk 0 MBR has been saved successfully to "C:\Users\Galge\Desktop\MBR.dat"
03:08:15.419    The log file has been saved successfully to "C:\Users\Galge\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-20 01:06:41
-----------------------------
01:06:41.192    OS Version: Windows x64 6.1.7601 Service Pack 1
01:06:41.192    Number of processors: 6 586 0xA00
01:06:41.193    ComputerName: ANIMENIA  UserName: Galge
01:06:43.538    Initialize success
01:07:32.575    AVAST engine defs: 12091901
01:07:41.063    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
01:07:41.065    Disk 0 Vendor: WDC_WD10EARX-00N0YB0 51.0AB51 Size: 953869MB BusType: 3
01:07:41.083    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T1L0-4
01:07:41.085    Disk 1 Vendor: SAMSUNG_HD753LJ 1AA01118 Size: 715403MB BusType: 3
01:07:41.104    Disk 0 MBR read successfully
01:07:41.106    Disk 0 MBR scan
01:07:41.114    Disk 0 unknown MBR code
01:07:41.116    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
01:07:41.141    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      953767 MB offset 206848
01:07:41.184    Disk 0 scanning C:\Windows\system32\drivers
01:07:58.686    Service scanning
01:08:32.062    Modules scanning
01:08:32.081    Disk 0 trace - called modules:
01:08:32.113    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
01:08:32.116    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007b98790]
01:08:32.120    3 CLASSPNP.SYS[fffff8800186f43f] -> nt!IofCallDriver -> [0xfffffa8007adf950]
01:08:32.124    5 ACPI.sys[fffff88000f4d7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa8007ba0060]
01:08:32.129    Scan finished successfully
01:09:33.123    Disk 0 MBR has been saved successfully to "C:\Users\Galge\Desktop\MBR.dat"
01:09:33.135    The log file has been saved successfully to "C:\Users\Galge\Desktop\aswMBR.txt"

cosinus 20.09.2012 14:43
Ähm, eigentlich wollte ich das hier posten :wtf: :

Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

Galge 20.09.2012 16:03
So das Sichern hat zwar gedauert, aber das fixen ging schnell:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-18 03:01:12
-----------------------------
03:01:12.750    OS Version: Windows x64 6.1.7601 Service Pack 1
03:01:12.750    Number of processors: 6 586 0xA00
03:01:12.750    ComputerName: ANIMENIA  UserName: Galge
03:01:15.277    Initialize success
03:02:05.526    AVAST engine defs: 12091400
03:02:08.241    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
03:02:08.256    Disk 0 Vendor: WDC_WD10EARX-00N0YB0 51.0AB51 Size: 953869MB BusType: 3
03:02:08.256    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T1L0-4
03:02:08.256    Disk 1 Vendor: SAMSUNG_HD753LJ 1AA01118 Size: 715403MB BusType: 3
03:02:08.272    Disk 0 MBR read successfully
03:02:08.272    Disk 0 MBR scan
03:02:08.288    Disk 0 unknown MBR code
03:02:08.288    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
03:02:08.303    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      953767 MB offset 206848
03:02:08.319    Disk 0 scanning C:\Windows\system32\drivers
03:02:18.459    Service scanning
03:02:37.553    Modules scanning
03:02:37.569    Disk 0 trace - called modules:
03:02:37.585    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
03:02:37.600    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007bb7790]
03:02:37.600    3 CLASSPNP.SYS[fffff880018ea43f] -> nt!IofCallDriver -> [0xfffffa8007afd9b0]
03:02:37.600    5 ACPI.sys[fffff88000e9f7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa8007bbf060]
03:02:39.488    AVAST engine scan C:\Windows
03:02:43.216    AVAST engine scan C:\Windows\system32
03:05:05.317    AVAST engine scan C:\Windows\system32\drivers
03:05:17.828    AVAST engine scan C:\Users\Galge
03:08:15.403    Disk 0 MBR has been saved successfully to "C:\Users\Galge\Desktop\MBR.dat"
03:08:15.419    The log file has been saved successfully to "C:\Users\Galge\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-20 01:06:41
-----------------------------
01:06:41.192    OS Version: Windows x64 6.1.7601 Service Pack 1
01:06:41.192    Number of processors: 6 586 0xA00
01:06:41.193    ComputerName: ANIMENIA  UserName: Galge
01:06:43.538    Initialize success
01:07:32.575    AVAST engine defs: 12091901
01:07:41.063    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
01:07:41.065    Disk 0 Vendor: WDC_WD10EARX-00N0YB0 51.0AB51 Size: 953869MB BusType: 3
01:07:41.083    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T1L0-4
01:07:41.085    Disk 1 Vendor: SAMSUNG_HD753LJ 1AA01118 Size: 715403MB BusType: 3
01:07:41.104    Disk 0 MBR read successfully
01:07:41.106    Disk 0 MBR scan
01:07:41.114    Disk 0 unknown MBR code
01:07:41.116    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
01:07:41.141    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      953767 MB offset 206848
01:07:41.184    Disk 0 scanning C:\Windows\system32\drivers
01:07:58.686    Service scanning
01:08:32.062    Modules scanning
01:08:32.081    Disk 0 trace - called modules:
01:08:32.113    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
01:08:32.116    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007b98790]
01:08:32.120    3 CLASSPNP.SYS[fffff8800186f43f] -> nt!IofCallDriver -> [0xfffffa8007adf950]
01:08:32.124    5 ACPI.sys[fffff88000f4d7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa8007ba0060]
01:08:32.129    Scan finished successfully
01:09:33.123    Disk 0 MBR has been saved successfully to "C:\Users\Galge\Desktop\MBR.dat"
01:09:33.135    The log file has been saved successfully to "C:\Users\Galge\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-20 16:56:41
-----------------------------
16:56:41.368    OS Version: Windows x64 6.1.7601 Service Pack 1
16:56:41.368    Number of processors: 6 586 0xA00
16:56:41.368    ComputerName: ANIMENIA  UserName: Galge
16:56:42.518    Initialize success
16:56:49.639    AVAST engine defs: 12091901
16:57:05.386    Verifying
16:57:15.417    Disk 0 Windows 601 MBR fixed successfully
16:57:50.562    Disk 0 MBR has been saved successfully to "C:\Users\Galge\Desktop\MBR.dat"
16:57:50.593    The log file has been saved successfully to "C:\Users\Galge\Desktop\aswMBR.txt"

cosinus 20.09.2012 20:09
Du solltest aber schon ein neues Log nach dem Fixen des MBR erstellen


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:59 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131