Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Firefox und IE funktionieren nach Kaspersky-Funden nicht mehr. (https://www.trojaner-board.de/127267-firefox-ie-funktionieren-kaspersky-funden-mehr.html)

aupex 20.11.2012 09:38
Firefox und IE funktionieren nach Kaspersky-Funden nicht mehr.
 
Hallo,
Vorgestern hat mein Kaspersky mir einen Fund gemeldet.
Um genau zu sein hat während dem Surfen auf Facebook Kaspersky einen unbekannten Fund gemeldet und danach mit einem Scan angefangen. Bei diesem Scan wurden über 400 Infizierte Objekte entdeckt und abgearbeitet.
Seitdem ist das Surfen im Netzt fast nicht mehr möblich. Sobald ich ein neues Register im Firefox öffne hängt er sich auf. Gehe ich auf eine Webseite die etwas größer ist (z.b. Amazon) hängt er sich auf usw.
Öffne ich den InternetExplorer kommt nur ein Fenster "Downloads anzeigen und nachverfolgen"
Danach kommt 2x die Fehlermeldung: "RunDLL Fehler beim Laden von C:\Windows\System32\inetcpl.cpl Das angegebene Modul wurde nicht gefunden"
Logfiles von Defogger, Gmer und OTL hänge ich an. OTL hat allerdings nur eine Datei erstellt. Die Datei extra.txt fehlt. Die gmer.log ist aufgrund der Größe als 7zip angehängt.

Gruß

Aupex


defogger
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:51 on 19/11/2012 (Aupex)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-
OTL
Code:
OTL logfile created on: 19.11.2012 20:58:25 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Aupex\Desktop\trojanerboard
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,57 Gb Available Physical Memory | 52,33% Memory free
10,72 Gb Paging File | 9,28 Gb Available in Paging File | 86,63% Paging File free
Paging file location(s): d:\pagefile.sys 8000 8000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 41,12 Gb Total Space | 1,20 Gb Free Space | 2,93% Space Free | Partition Type: NTFS
Drive D: | 185,90 Gb Total Space | 1,62 Gb Free Space | 0,87% Space Free | Partition Type: NTFS
Drive E: | 523,86 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive P: | 1,88 Gb Total Space | 1,75 Gb Free Space | 93,25% Space Free | Partition Type: FAT
 
Computer Name: STEFANLAPTOP | User Name: Aupex | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Aupex\Desktop\trojanerboard\OTL.exe (OldTimer Tools)
PRC - D:\Program Files\suparaasyp\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - C:\Programme\Google\Drive\googledrivesync.exe (Google)
PRC - d:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - D:\Program Files\suparaasyp\SASCORE.EXE (SUPERAntiSpyware.com)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - D:\Program Files\Kaspersky Security Suite CBE 12\avp.exe (Kaspersky Lab ZAO)
PRC - D:\Program Files\kies\External\FirmwareUpdate\KiesPDLR.exe ()
PRC - d:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe (Deutsche Telekom AG)
PRC - C:\Programme\Bamboo Dock\BambooCore.exe ()
PRC - C:\Programme\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Programme\Tablet\Pen\Pen_TouchUser.exe (Wacom Technology, Corp.)
PRC - C:\Programme\Tablet\Pen\Pen_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:\Programme\Tablet\Pen\Pen_TouchService.exe (Wacom Technology, Corp.)
PRC - C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Programme\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - d:\Program Files\Secunia\PSI\sua.exe (Secunia)
PRC - C:\Programme\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
PRC - C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Programme\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
PRC - C:\Programme\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
PRC - C:\Programme\Saitek\SD6\Software\ProfilerU.exe (Saitek)
PRC - C:\Programme\Canon\IJPLM\ijplmsvc.exe ()
PRC - C:\Programme\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Programme\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Programme\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
PRC - C:\Programme\Common Files\microsoft shared\ink\TabTip.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
PRC - d:\Program Files\Sandboxie\SbieSvc.exe (tzuk)
PRC - C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\microsoft shared\ink\InputPersonalization.exe (Microsoft Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\wx._gdi_.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\pysqlite2._sqlite.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\win32com.shell.shell.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\win32api.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\_elementtree.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\wx._html2.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\_socket.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\win32ts.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\win32crypt.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\windows._cacheinvalidation.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\wx._misc_.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\_ssl.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\pythoncom26.dll ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\win32security.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\pywintypes26.dll ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\_ctypes.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\win32profile.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\wx._core_.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\wx._windows_.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\_hashlib.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\wx._wizard.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\win32file.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\win32process.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\win32pdh.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\win32inet.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\wx._controls_.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\unicodedata.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\pyexpat.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\win32event.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI44922\select.pyd ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\7c8bffb6e42a248341d7821a8464ef0b\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\a74fade4c3e490c62af3d60742fb078a\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\dfe6e22159d3f5bf61b5bfe1da6f2758\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\ecbb113bbad9034fa8385c15f73fb4cf\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\14d2241be401f66cc1898dc5dc383b80\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\e10bbd79027aa4c1ca8950b78fd640d4\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\a8dfd1388afc0a50f39f9e1dc7ecd45c\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\379599837ade465016dd5d96798b2766\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\dbc34d53e1fbedabecd201fe4f264961\mscorlib.ni.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\qtgui4.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\qtscript4.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\qtsql4.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\qtcore4.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\qtnetwork4.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\qtdeclarative4.dll ()
MOD - C:\Users\Aupex\AppData\Local\Temp\08f56ff6-864d-4a92-944a-57b870198cb2\CliSecureRT.dll ()
MOD - D:\Program Files\kies\External\FirmwareUpdate\KiesPDLR.exe ()
MOD - d:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Programme\Bamboo Dock\BambooCore.exe ()
MOD - C:\Programme\Tablet\Pen\libxml2.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\imageformats\qgif4.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- d:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (!SASCORE) -- D:\Program Files\suparaasyp\SASCORE.EXE (SUPERAntiSpyware.com)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AVP) -- D:\Program Files\Kaspersky Security Suite CBE 12\avp.exe (Kaspersky Lab ZAO)
SRV - (MCSWASVR) -- d:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe (Deutsche Telekom AG)
SRV - (TabletServicePen) -- C:\Programme\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.)
SRV - (TouchServicePen) -- C:\Programme\Tablet\Pen\Pen_TouchService.exe (Wacom Technology, Corp.)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (Secunia PSI Agent) -- d:\Program Files\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) -- d:\Program Files\Secunia\PSI\sua.exe (Secunia)
SRV - (NAUpdate) -- C:\Programme\Nero\Update\NASvc.exe (Nero AG)
SRV - (wlidsvc) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (MSSQL$JTLWAWI) -- C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) -- C:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)
SRV - (IJPLMSVC) -- C:\Programme\Canon\IJPLM\ijplmsvc.exe ()
SRV - (afcdpsrv) -- C:\Programme\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
SRV - (getPlusHelper) -- C:\Programme\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (ACDaemon) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (FLEXnet Licensing Service) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (Fabs) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (MSSQLServerADHelper100) -- C:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe (Microsoft Corporation)
SRV - (LBTServ) -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (MSSQL$SQLEXPRESS) -- C:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLBrowser) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (SQLAgent$SQLEXPRESS) -- C:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE (Microsoft Corporation)
SRV - (TOSHIBA Bluetooth Service) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (SbieSvc) -- d:\Program Files\Sandboxie\SbieSvc.exe (tzuk)
SRV - (FirebirdServerMAGIXInstance) -- C:\Programme\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
SRV - (SQLWriter) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (USBModem) -- system32\DRIVERS\lgusbmodem.sys File not found
DRV - (UsbDiag) -- system32\DRIVERS\lgusbdiag.sys File not found
DRV - (usbbus) -- system32\DRIVERS\lgusbbus.sys File not found
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (LGVMODEM) -- system32\DRIVERS\lgvmodem.sys File not found
DRV - (lgbusenum) -- system32\DRIVERS\lgbtbus.sys File not found
DRV - (LgBttPort) -- system32\DRIVERS\lgbtport.sys File not found
DRV - (Lavasoft Kernexplorer) -- C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (catchme) -- C:\Users\Aupex\AppData\Local\Temp\catchme.sys File not found
DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (KLIF) -- C:\Windows\System32\drivers\klif.sys (Kaspersky Lab)
DRV - (pwdrvio) -- C:\Windows\System32\pwdrvio.sys ()
DRV - (pwdspio) -- C:\Windows\System32\pwdspio.sys ()
DRV - (Ser2pl) -- C:\Windows\System32\drivers\ser2pl.sys (Prolific Technology Inc.)
DRV - (wacommousefilter) -- C:\Windows\System32\drivers\wacommousefilter.sys (Wacom Technology)
DRV - (wacomvhid) -- C:\Windows\System32\drivers\wacomvhid.sys (Wacom Technology)
DRV - (SASKUTIL) -- D:\Program Files\suparaasyp\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) -- D:\Program Files\suparaasyp\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (sscdmdm) -- C:\Windows\System32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdbus) -- C:\Windows\System32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (sscdmdfl) -- C:\Windows\System32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (ssadmdm) -- C:\Windows\System32\drivers\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) -- C:\Windows\System32\drivers\ssadbus.sys (MCCI Corporation)
DRV - (ssadserd) -- C:\Windows\System32\drivers\ssadserd.sys (MCCI Corporation)
DRV - (androidusb) -- C:\Windows\System32\drivers\ssadadb.sys (Google Inc)
DRV - (ssadmdfl) -- C:\Windows\System32\drivers\ssadmdfl.sys (MCCI Corporation)
DRV - (speedfan) -- C:\Windows\System32\speedfan.sys (Almico Software)
DRV - (FTDIBUS) -- C:\Windows\System32\drivers\ftdibus.sys (FTDI Ltd.)
DRV - (FTSER2K) -- C:\Windows\System32\drivers\ftser2k.sys (FTDI Ltd.)
DRV - (KLIM6) -- C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab ZAO)
DRV - (kl2) -- C:\Windows\System32\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV - (KL1) -- C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV - (PSI) -- C:\Windows\System32\drivers\psi_mf.sys (Secunia)
DRV - (SaiNtBus) -- C:\Windows\System32\drivers\SaiBus.sys (Saitek)
DRV - (SaiMini) -- C:\Windows\System32\drivers\SaiMini.sys (Saitek)
DRV - (Lbd) -- C:\Windows\System32\drivers\Lbd.sys (Lavasoft AB)
DRV - (afcdp) -- C:\Windows\System32\drivers\afcdp.sys (Acronis)
DRV - (tdrpman251) -- C:\Windows\System32\drivers\tdrpm251.sys (Acronis)
DRV - (timounter) -- C:\Windows\System32\drivers\timntr.sys (Acronis)
DRV - (snapman) -- C:\Windows\System32\drivers\snapman.sys (Acronis)
DRV - (cbfs3) -- C:\Windows\System32\drivers\cbfs3.sys (EldoS Corporation)
DRV - (ggsemc) -- C:\Windows\System32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV - (ggflt) -- C:\Windows\System32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV - (USB28xxBGA) -- C:\Windows\System32\drivers\emBDA.sys (eMPIA Technology, Inc.)
DRV - (USB28xxOEM) -- C:\Windows\System32\drivers\emOEM.sys (eMPIA Technology, Inc.)
DRV - (klmouflt) -- C:\Windows\System32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (tap0901) -- C:\Windows\System32\drivers\tap0901.sys (The OpenVPN Project)
DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (TosRfSnd) -- C:\Windows\System32\drivers\TosRfSnd.sys (TOSHIBA Corporation)
DRV - (tosrfbnp) -- C:\Windows\System32\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV - (RsFx0103) -- C:\Windows\System32\drivers\RsFx0103.sys (Microsoft Corporation)
DRV - (Tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (tosrfnds) -- C:\Windows\System32\drivers\tosrfnds.sys (TOSHIBA Corporation.)
DRV - (Tosrfhid) -- C:\Windows\System32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV - (Tosrfcom) -- C:\Windows\System32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (SbieDrv) -- d:\Program Files\Sandboxie\SbieDrv.sys (tzuk)
DRV - (hotcore3) -- C:\Windows\System32\drivers\hotcore3.sys (Paragon Software Group)
DRV - (tosrfbd) -- C:\Windows\System32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (s0016unic) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (tosporte) -- C:\Windows\System32\drivers\tosporte.sys (TOSHIBA Corporation)
DRV - (seehcri) -- C:\Windows\System32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (NETw4v32) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (enecir) -- C:\Windows\System32\drivers\enecir.sys (ENE TECHNOLOGY INC.)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (MGHwCtrl) -- C:\Windows\System32\drivers\MGHwCtrl.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (Si3531) -- C:\Windows\System32\drivers\Si3531.sys (Silicon Image, Inc)
DRV - (SiRemFil) -- C:\Windows\System32\drivers\SiRemFil.sys (Silicon Image, Inc.)
DRV - (SiFilter) -- C:\Windows\System32\drivers\SiWinAcc.sys (Silicon Image, Inc.)
DRV - (giveio) -- C:\Windows\System32\giveio.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 42 B7 60 24 4D 07 CB 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{7CA392FF-03B9-4588-9225-404B3C3B6E4B}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=971163&p={searchTerms}
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}: "URL" = hxxp://www.daemon-search.com/search/web?q={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledAddons: battlefieldplay4free@ea.com:1.0.66.2
FF - prefs.js..extensions.enabledAddons: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.9
FF - prefs.js..extensions.enabledItems: fdm_ffext@freedownloadmanager.org:1.3.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: KPSA-home-Priess@EasternGraphics.com:1.0.2
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: D:\Program Files\canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: d:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.10: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.0.0.1: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
FF - HKCU\Software\MozillaPlugins\wacom.com/WacomTabletPlugin: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.06.13 10:31:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.06.13 10:31:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: D:\Program Files\Kaspersky Security Suite CBE 12\FFExt\virtualKeyboard@kaspersky.ru [2012.06.13 18:50:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: D:\Program Files\Kaspersky Security Suite CBE 12\FFExt\linkfilter@kaspersky.ru [2012.06.13 18:50:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: D:\Program Files\Kaspersky Security Suite CBE 12\FFExt\KavAntiBanner@Kaspersky.ru [2012.06.13 18:49:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2012.10.29 07:44:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2012.10.29 07:44:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: D:\Program Files\Mozilla Thunderbird\components [2012.10.29 21:35:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: D:\Program Files\Mozilla Thunderbird\plugins [2012.10.29 21:35:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{8C17574E-F5C5-41b8-8B36-333FC7E67980}: D:\Program Files\Kaspersky Security Suite CBE 12\THBExt_2_x [2012.06.13 17:37:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{FD9B3EC6-8265-41fb-8A2F-4C5A22A95A7B}: D:\Program Files\Kaspersky Security Suite CBE 12\THBExt_3_1_x [2012.06.13 17:37:08 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\Aupex\AppData\Roaming\5015
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2012.10.29 07:44:46 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2012.10.29 07:44:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: D:\Program Files\Mozilla Thunderbird\components [2012.10.29 21:35:26 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: D:\Program Files\Mozilla Thunderbird\plugins [2012.10.29 21:35:31 | 000,000,000 | ---D | M]
 
[2010.09.20 18:23:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aupex\AppData\Roaming\mozilla\Extensions
[2010.09.20 18:23:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aupex\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.10.23 19:52:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aupex\AppData\Roaming\mozilla\Firefox\Profiles\z8fjhgyp.default\extensions
[2010.04.28 10:30:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Aupex\AppData\Roaming\mozilla\Firefox\Profiles\z8fjhgyp.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.09.04 09:08:26 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Aupex\AppData\Roaming\mozilla\Firefox\Profiles\z8fjhgyp.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.10.04 19:47:00 | 000,000,000 | ---D | M] (Battlefield Play4Free) -- C:\Users\Aupex\AppData\Roaming\mozilla\Firefox\Profiles\z8fjhgyp.default\extensions\battlefieldplay4free@ea.com
[2012.09.07 14:22:16 | 000,000,000 | ---D | M] (Free Download Manager plugin) -- C:\Users\Aupex\AppData\Roaming\mozilla\Firefox\Profiles\z8fjhgyp.default\extensions\fdm_ffext@freedownloadmanager.org
[2011.02.26 21:42:26 | 000,000,000 | ---D | M] (KPSA-Home (Priess)) -- C:\Users\Aupex\AppData\Roaming\mozilla\Firefox\Profiles\z8fjhgyp.default\extensions\KPSA-home-Priess@EasternGraphics.com
[2009.09.10 20:06:59 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\Aupex\AppData\Roaming\mozilla\Firefox\Profiles\z8fjhgyp.default\extensions\moveplayer@movenetworks.com
[2010.03.24 15:13:02 | 000,000,917 | ---- | M] () -- C:\Users\Aupex\AppData\Roaming\mozilla\firefox\profiles\z8fjhgyp.default\searchplugins\conduit.xml
 
O1 HOSTS File: ([2011.06.08 14:21:18 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Programme\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Security Suite CBE 12\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Virtual Storage Mount Notification) - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\System32\CbFsMntNtf3.dll (EldoS Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - d:\Program Files\Free Download Manager\iefdm2.dll ()
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - D:\Program Files\Kaspersky Security Suite CBE 12\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [AVP] D:\Program Files\Kaspersky Security Suite CBE 12\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [BambooCore] C:\Programme\Bamboo Dock\BambooCore.exe ()
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [IJNetworkScannerSelectorEX] C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [ProfilerU] C:\Programme\Saitek\SD6\Software\ProfilerU.exe (Saitek)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [TrayServer] D:\Program Files\MAGIX\Video_deluxe_17_Plus_Sonderedition\Trayserver.exe (MAGIX AG)
O4 - HKCU..\Run: [GoogleDriveSync] C:\Program Files\Google\Drive\googledrivesync.exe (Google)
O4 - HKCU..\Run: [KiesHelper] D:\Program Files\Kies\KiesHelper.exe (Samsung)
O4 - HKCU..\Run: [KiesPDLR] D:\Program Files\kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [SUPERAntiSpyware] D:\Program Files\suparaasyp\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Alles mit FDM herunterladen - d:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Auswahl mit FDM herunterladen - d:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Datei mit FDM herunterladen - d:\Program Files\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Download with Xilisoft Download YouTube Video - d:\Program Files\Xilisoft\Download YouTube Video\upod_link.HTM ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Aupex\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - D:\Program Files\Kaspersky Security Suite CBE 12\ie_banner_deny.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Videos mit FDM herunterladen - d:\Program Files\Free Download Manager\dlfvideo.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - D:\Program Files\Kaspersky Security Suite CBE 12\ievkbd.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - D:\Program Files\Kaspersky Security Suite CBE 12\klwtbbho.dll (Kaspersky Lab ZAO)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.7.0_05)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{14436A7B-9E23-494B-A111-E37191A2C976}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7E4D3FD4-2868-44D7-9825-067520FD8405}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\system32\mshtml.dll File not found
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\system32\mshtml.dll File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\system32\mshtml.dll File not found
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\system32\mshtml.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\system32\mshtml.dll File not found
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (D:\Program Files\suparaasyp\SASWINLO.DLL) - D:\Program Files\suparaasyp\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\klogon: DllName - (C:\Windows\system32\klogon.dll) - C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O21 - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\System32\CbFsMntNtf3.dll (EldoS Corporation)
O22 - SharedTaskScheduler: {5FF49FE8-B332-4CB9-B102-FB6951629E55} - Virtual Storage Mount Notification - C:\Windows\System32\CbFsMntNtf3.dll (EldoS Corporation)
O24 - Desktop WallPaper: C:\Users\Aupex\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Aupex\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - D:\Program Files\suparaasyp\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2000.01.18 01:28:36 | 000,028,672 | R--- | M] (Dipl.-Ing. Stefan Krueger <skrueger@installsite.org>) - E:\AUTORUN.EXE -- [ CDFS ]
O32 - AutoRun File - [2002.01.12 03:28:28 | 000,001,042 | R--- | M] () - E:\AUTORUN.INI -- [ CDFS ]
O32 - AutoRun File - [2002.04.22 21:47:10 | 000,000,138 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.19 20:45:22 | 000,000,000 | ---D | C] -- C:\Users\Aupex\Desktop\trojanerboard
[2012.11.10 17:32:52 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Canon_Inc_IC
[2012.11.10 17:31:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Canon_Inc_IC
[2012.11.06 20:42:54 | 000,000,000 | ---D | C] -- C:\Users\Aupex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CombineZP
[2012.11.06 20:42:45 | 000,000,000 | ---D | C] -- C:\Program Files\Alan Hadley
[2012.11.02 18:26:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ErgoFAKT V4.0
[2012.11.02 18:26:38 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Borland Shared
[2012.11.02 18:26:35 | 000,000,000 | ---D | C] -- C:\Program Files\ERGO SOFT
[2012.11.02 18:19:09 | 000,000,000 | ---D | C] -- C:\Users\Aupex\AppData\Local\ErgoFAKT
[2012.11.02 18:17:53 | 000,000,000 | ---D | C] -- C:\ProgramData\ErgoFAKT
[2012.10.25 19:49:15 | 000,000,000 | ---D | C] -- C:\Users\Aupex\AppData\Roaming\inkscape
[2012.10.25 10:45:46 | 000,000,000 | -HSD | C] -- C:\Users\Aupex\AppData\Local\.#
[2012.10.25 10:45:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RasterVect 17.3 Trial
[2012.10.23 19:08:29 | 000,000,000 | ---D | C] -- C:\Users\Aupex\Desktop\Charlotte
[2012.10.21 20:12:01 | 000,000,000 | ---D | C] -- C:\Users\Aupex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Raven Software
[2012.10.21 20:12:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Raven Software
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.19 20:54:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.11.19 20:54:00 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.11.19 20:53:20 | 000,003,296 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.19 20:53:20 | 000,003,296 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.19 20:53:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.19 20:51:47 | 000,000,020 | ---- | M] () -- C:\Users\Aupex\defogger_reenable
[2012.11.19 20:32:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.19 20:23:38 | 000,389,128 | ---- | M] () -- C:\Users\Aupex\Desktop\bookmarks-2012-11-19.json
[2012.11.19 10:27:17 | 000,136,704 | ---- | M] () -- C:\Users\Aupex\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.11.17 21:08:35 | 000,000,851 | ---- | M] () -- C:\Users\Aupex\Desktop\SOF II Einzelspieler.lnk
[2012.11.15 06:04:02 | 000,566,872 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.11.14 22:53:02 | 000,810,226 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.14 22:53:02 | 000,749,954 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.14 22:53:02 | 000,198,294 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.14 22:53:02 | 000,166,232 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.10 17:33:01 | 000,000,947 | ---- | M] () -- C:\Users\Public\Desktop\Digital Photo Professional.lnk
[2012.11.06 21:02:40 | 000,002,511 | ---- | M] () -- C:\Users\Aupex\Desktop\CombineZP.lnk
[2012.11.06 20:42:54 | 000,001,944 | ---- | M] () -- C:\Users\Aupex\Desktop\CZPBatch.lnk
[2012.11.02 18:26:47 | 000,001,980 | ---- | M] () -- C:\Users\Public\Desktop\ErgoFAKT V4.0.lnk
[2012.10.30 11:55:17 | 000,005,038 | ---- | M] () -- C:\Users\Aupex\.recently-used.xbel
[2012.10.30 11:52:46 | 000,008,799 | ---- | M] () -- C:\Users\Aupex\AppData\Local\recently-used.xbel
[2012.10.30 11:29:31 | 000,009,020 | ---- | M] () -- C:\Users\Aupex\Desktop\testlogo.svg
[2012.10.25 19:49:09 | 000,025,424 | ---- | M] () -- C:\Users\Aupex\Desktop\Vorschlag Logo.svg
[2012.10.25 19:47:27 | 000,000,634 | ---- | M] () -- C:\Users\Public\Desktop\Inkscape.lnk
[2012.10.25 10:45:39 | 000,000,695 | ---- | M] () -- C:\Users\Aupex\Desktop\RasterVect 17.3 Trial.lnk
[2012.10.25 07:46:38 | 000,666,704 | ---- | M] () -- C:\Users\Aupex\Desktop\Vorschlag Logo.png
[2012.10.25 07:45:51 | 000,085,977 | ---- | M] () -- C:\Users\Aupex\Desktop\logoss2.jpg
[2012.10.24 15:19:27 | 000,000,182 | ---- | M] () -- C:\Windows\System32\~.inf
[2012.10.22 09:40:07 | 000,000,708 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.10.21 20:12:10 | 000,000,762 | ---- | M] () -- C:\Windows\Sof2.INI
[2012.10.21 20:12:10 | 000,000,673 | ---- | M] () -- C:\Users\Aupex\Desktop\SOF II Mehrspieler.lnk
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.19 20:51:27 | 000,000,020 | ---- | C] () -- C:\Users\Aupex\defogger_reenable
[2012.11.19 20:23:37 | 000,389,128 | ---- | C] () -- C:\Users\Aupex\Desktop\bookmarks-2012-11-19.json
[2012.11.06 20:42:54 | 000,002,511 | ---- | C] () -- C:\Users\Aupex\Desktop\CombineZP.lnk
[2012.11.06 20:42:54 | 000,001,944 | ---- | C] () -- C:\Users\Aupex\Desktop\CZPBatch.lnk
[2012.11.02 18:26:47 | 000,001,980 | ---- | C] () -- C:\Users\Public\Desktop\ErgoFAKT V4.0.lnk
[2012.10.30 11:55:17 | 000,005,038 | ---- | C] () -- C:\Users\Aupex\.recently-used.xbel
[2012.10.30 11:52:46 | 000,008,799 | ---- | C] () -- C:\Users\Aupex\AppData\Local\recently-used.xbel
[2012.10.25 20:04:50 | 000,009,020 | ---- | C] () -- C:\Users\Aupex\Desktop\testlogo.svg
[2012.10.25 19:49:07 | 000,025,424 | ---- | C] () -- C:\Users\Aupex\Desktop\Vorschlag Logo.svg
[2012.10.25 19:47:59 | 000,000,666 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inkscape.lnk
[2012.10.25 19:47:27 | 000,000,634 | ---- | C] () -- C:\Users\Public\Desktop\Inkscape.lnk
[2012.10.25 10:45:39 | 000,000,695 | ---- | C] () -- C:\Users\Aupex\Desktop\RasterVect 17.3 Trial.lnk
[2012.10.25 07:46:34 | 000,666,704 | ---- | C] () -- C:\Users\Aupex\Desktop\Vorschlag Logo.png
[2012.10.25 07:45:47 | 000,085,977 | ---- | C] () -- C:\Users\Aupex\Desktop\logoss2.jpg
[2012.10.22 09:40:07 | 000,000,708 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.10.21 20:12:10 | 000,000,851 | ---- | C] () -- C:\Users\Aupex\Desktop\SOF II Einzelspieler.lnk
[2012.10.21 20:12:10 | 000,000,673 | ---- | C] () -- C:\Users\Aupex\Desktop\SOF II Mehrspieler.lnk
[2012.10.21 20:02:24 | 000,000,762 | ---- | C] () -- C:\Windows\Sof2.INI
[2012.10.13 20:16:50 | 000,000,087 | ---- | C] () -- C:\Windows\winDecrypt.INI
[2012.09.22 10:24:29 | 000,107,520 | RHS- | C] () -- C:\Windows\System32\TAKDSDecoder.dll
[2012.09.11 14:28:00 | 000,025,600 | ---- | C] () -- C:\Users\Aupex\Salon Seemann.dot
[2012.09.03 06:02:43 | 000,000,800 | ---- | C] () -- C:\Windows\Rtcw.INI
[2012.09.01 13:26:36 | 000,000,104 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\.ptbt1
[2012.07.31 10:37:59 | 000,000,317 | ---- | C] () -- C:\Windows\CODUO.ini
[2012.07.27 19:53:10 | 000,000,721 | ---- | C] () -- C:\Windows\COD.INI
[2012.06.27 20:34:31 | 018,506,240 | ---- | C] () -- C:\Users\Aupex\jtlwawi260612.bak
[2012.06.27 15:06:14 | 014,967,296 | ---- | C] () -- C:\Users\Aupex\sicherung270612.bak
[2012.06.13 18:39:35 | 000,017,408 | ---- | C] () -- C:\Users\Aupex\AppData\Local\WebpageIcons.db
[2012.06.13 17:39:13 | 000,116,189 | ---- | C] () -- C:\Windows\System32\drivers\klin.dat
[2012.06.13 17:39:13 | 000,098,168 | ---- | C] () -- C:\Windows\System32\drivers\klick.dat
[2012.05.19 12:26:47 | 000,016,472 | ---- | C] () -- C:\Windows\System32\pwdrvio.sys
[2012.05.18 20:39:46 | 000,922,184 | ---- | C] () -- C:\Windows\System32\pwNative.exe
[2012.05.18 20:39:08 | 000,011,104 | ---- | C] () -- C:\Windows\System32\pwdspio.sys
[2012.04.02 08:03:10 | 000,000,021 | ---- | C] () -- C:\Windows\preview.ini
[2012.03.21 15:14:49 | 000,084,480 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011.12.23 20:58:28 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.12.23 18:06:49 | 000,000,021 | ---- | C] () -- C:\Users\Aupex\AppData\Local\mc.pixel.data
[2011.07.26 16:26:46 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011.07.26 16:26:46 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011.07.26 16:26:46 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011.07.26 16:26:46 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2011.06.08 11:00:20 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011.06.08 11:00:20 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011.06.08 11:00:20 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011.06.08 11:00:20 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011.06.08 11:00:20 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011.06.06 09:41:31 | 000,523,061 | ---- | C] () -- C:\Users\Aupex\mricrocosft.cab
[2011.05.29 08:31:24 | 000,000,558 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\AutoGK.ini
[2011.05.16 16:39:33 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat
[2011.05.16 16:39:33 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat
[2011.05.14 20:36:58 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2011.03.11 11:43:54 | 000,029,763 | ---- | C] () -- C:\Windows\System32\drivers\klopp.dat
[2011.01.25 15:02:14 | 000,032,768 | ---- | C] () -- C:\Windows\System32\MGFPCtrl.dll
[2010.11.28 12:29:00 | 000,045,056 | ---- | C] () -- C:\Windows\System32\ss35pp.dll
[2010.10.12 19:54:54 | 007,424,512 | ---- | C] () -- C:\Users\Aupex\tab.bak
[2010.08.26 21:34:46 | 000,360,723 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\mdbu.bin
[2010.06.29 17:17:29 | 000,345,434 | ---- | C] () -- C:\Users\Aupex\bild 00000.jpg
[2010.04.21 18:43:25 | 000,725,294 | ---- | C] () -- C:\Users\Aupex\.fonts.cache-1
[2010.04.21 18:42:04 | 000,000,000 | ---- | C] () -- C:\Users\Aupex\.gtk-bookmarks
[2010.03.11 21:48:19 | 000,000,093 | ---- | C] () -- C:\Users\Aupex\AppData\Local\fusioncache.dat
[2009.11.03 12:46:01 | 000,001,024 | ---- | C] () -- C:\Users\Aupex\.lmmsrc.xml
[2009.06.02 19:38:33 | 000,001,356 | ---- | C] () -- C:\Users\Aupex\AppData\Local\d3d9caps.dat
[2009.03.26 11:14:56 | 000,007,680 | ---- | C] () -- C:\Users\Aupex\20F112907.lbl
[2009.03.22 19:49:16 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.02.18 10:04:11 | 000,007,680 | ---- | C] () -- C:\Users\Aupex\99L099908.lbl
[2009.01.20 11:23:13 | 000,007,168 | ---- | C] () -- C:\Users\Aupex\bnn.lbl
[2009.01.13 07:11:04 | 000,000,000 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\wklnhst.dat
[2009.01.12 12:16:32 | 000,138,056 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\PnkBstrK.sys
[2009.01.09 20:43:44 | 000,136,704 | ---- | C] () -- C:\Users\Aupex\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.01.06 15:31:21 | 000,005,525 | ---- | C] () -- C:\Users\Aupex\b
[2008.12.28 23:05:28 | 000,027,335 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\nvModes.001
[2008.12.28 23:02:44 | 000,027,335 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\nvModes.dat
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2011.10.07 20:21:01 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Ableton
[2010.06.01 19:04:08 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Acronis
[2010.11.09 12:17:51 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Arduino
[2011.07.05 10:18:27 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\BitTorrent
[2009.01.06 21:23:08 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Blender Foundation
[2012.07.24 14:35:23 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Broad Intelligence
[2010.11.03 17:59:51 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\CadSoft
[2011.01.26 18:09:01 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\calibre
[2011.11.19 09:42:59 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Canneverbe Limited
[2012.11.10 17:32:40 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Canon
[2009.01.08 21:15:47 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\DAEMON Tools
[2012.01.22 10:14:45 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\DAEMON Tools Lite
[2009.01.08 21:15:47 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\DAEMON Tools Pro
[2011.10.30 11:55:57 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\DAZ 3D
[2010.12.12 20:42:48 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\DVD Profiler
[2012.04.08 18:06:50 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\DVDVideoSoft
[2011.02.16 15:22:51 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.08.01 16:57:57 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\DVRemoteDesktop
[2010.10.09 21:50:22 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\fdrtools.com
[2012.03.16 11:03:27 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\FileZilla
[2011.10.18 10:32:37 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Free Download Manager
[2010.08.27 18:06:03 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Fritzing
[2012.02.03 18:14:46 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\GrabPro
[2010.07.13 17:08:38 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\gtk-2.0
[2012.03.16 12:30:40 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\HandBrake
[2009.03.09 08:27:50 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\HDRsoft
[2012.10.17 19:21:23 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\hybrid
[2010.10.18 20:31:23 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\InfraRecorder
[2012.10.25 19:49:15 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\inkscape
[2009.10.21 19:38:52 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Leadertech
[2009.09.30 15:12:09 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Lexware
[2012.07.23 09:03:07 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\MAGIX
[2012.04.24 17:56:24 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\MixVibes
[2009.09.01 21:32:20 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Mp3tag
[2011.12.03 23:56:45 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Nik Software
[2011.05.04 16:17:39 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\No Company Name
[2010.10.06 22:22:49 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\NwDocx
[2010.08.31 21:16:33 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Oloneo
[2009.01.06 22:21:40 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\OpenOffice.org
[2009.12.14 22:18:10 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Picturenaut
[2009.03.03 11:40:36 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Planetside Software
[2012.01.16 15:42:33 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\proDAD
[2012.02.03 18:14:57 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\ProgSense
[2012.01.12 08:21:47 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Samsung
[2009.08.07 12:52:29 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\SlySoft
[2009.06.16 21:25:15 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\T-Online
[2011.01.12 15:19:49 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Template
[2009.01.19 16:09:16 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Thinstall
[2010.09.20 18:23:53 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Thunderbird
[2009.03.03 12:39:23 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\uk.co.planetside
[2009.01.19 16:11:39 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\uTorrent
[2011.01.11 17:06:41 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\VidCoder
[2009.06.08 11:56:58 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\VistaStumbler
[2012.09.06 12:33:39 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Wacom
[2012.09.06 12:36:00 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
[2011.02.15 21:18:45 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\Xilisoft
[2012.10.23 19:10:11 | 000,000,000 | ---D | M] -- C:\Users\Aupex\AppData\Roaming\XnView
 
========== Purity Check ==========
 
 

< End of report >

cosinus 20.11.2012 10:50
Hallo und :hallo:

Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


Zitat:
Bei diesem Scan wurden über 400 Infizierte Objekte entdeckt und abgearbeitet.
Und warum lässt du das Log weg, wie wollen wir ohne dem wissen was da genau gelöscht wurde? :(
Bitte beachten => http://www.trojaner-board.de/125889-...tml#post941520

aupex 20.11.2012 11:29
Sorry...
Komsicherweise, hat mir Kaspersky gestern über 400 bedrohungen angezeigt, aber im Log sind nur 99 drin...

Kaspersky Log:

Code:
Typ: Schwachstelle (9)       
hxxp://redirect.kaspersky.com/?hl=de-DE-xcbild&target=securelist&rpe=1&function=advisories&VN=50354        Nicht gefunden        19.11.2012 06:15:54       
hxxp://redirect.kaspersky.com/?hl=de-DE-xcbild&target=securelist&rpe=1&function=advisories&VN=50949        Inaktiv        19.11.2012 06:15:53       
hxxp://redirect.kaspersky.com/?hl=de-DE-xcbild&target=securelist&rpe=1&function=advisories&VN=42798        Inaktiv        19.11.2012 06:15:56       
hxxp://redirect.kaspersky.com/?hl=de-DE-xcbild&target=securelist&rpe=1&function=advisories&VN=51226        Inaktiv        19.11.2012 06:16:00       
hxxp://redirect.kaspersky.com/?hl=de-DE-xcbild&target=securelist&rpe=1&function=advisories&VN=49856        Inaktiv        19.11.2012 06:16:00       
hxxp://redirect.kaspersky.com/?hl=de-DE-xcbild&target=securelist&rpe=1&function=advisories&VN=49969        Inaktiv        19.11.2012 06:15:54       
hxxp://redirect.kaspersky.com/?hl=de-DE-xcbild&target=securelist&rpe=1&function=advisories&VN=50949        Inaktiv        19.11.2012 06:15:53       
hxxp://redirect.kaspersky.com/?hl=de-DE-xcbild&target=securelist&rpe=1&function=advisories&VN=50547        Inaktiv        19.11.2012 06:16:00       
hxxp://redirect.kaspersky.com/?hl=de-DE-xcbild&target=securelist&rpe=1&function=advisories&VN=29407        Inaktiv        19.11.2012 06:15:53       
Typ: Virus (99)       
System.Xaml.ni.dll        Nicht gefunden        19.11.2012 06:03:34       
System.Runtime.Remoting.ni.dll        Nicht gefunden        19.11.2012 06:03:32       
System.Management.ni.dll        Nicht gefunden        19.11.2012 06:03:30       
PresentationFramework.Classic.ni.dll        Nicht gefunden        19.11.2012 06:03:18       
mscorlib.ni.dll        Nicht gefunden        19.11.2012 06:03:17       
System.Xml.ni.dll        Nicht gefunden        19.11.2012 06:03:15       
System.ni.dll        Nicht gefunden        19.11.2012 06:03:15       
System.Web.ni.dll        Nicht gefunden        19.11.2012 06:03:14       
System.ServiceProcess.ni.dll        Nicht gefunden        19.11.2012 06:03:13       
System.ServiceModel.ni.dll        Nicht gefunden        19.11.2012 06:03:12       
System.Runtime.Serialization.ni.dll        Nicht gefunden        19.11.2012 06:02:40       
System.IdentityModel.ni.dll        Nicht gefunden        19.11.2012 06:02:39       
System.Configuration.ni.dll        Nicht gefunden        19.11.2012 06:02:37       
SMDiagnostics.ni.dll        Nicht gefunden        19.11.2012 06:02:36       
mshtml.dll        Nicht gefunden        19.11.2012 06:02:05       
PTQL5L.DLL        Nicht gefunden        19.11.2012 06:00:32       
MGHwCtrl.dll        Nicht gefunden        19.11.2012 06:00:29       
edd.exe        Nicht gefunden        19.11.2012 05:57:50       
MGKBHook.dll        Nicht gefunden        19.11.2012 05:57:45       
MGSysCtrl.exe        Nicht gefunden        19.11.2012 05:57:45       
SaiMfd.exe        Nicht gefunden        19.11.2012 05:57:44       
CNSELANG.DLL        Nicht gefunden        19.11.2012 05:57:07       
UNINSTALL_MonkeyIsland103.exe        Nicht definiert        18.11.2012 21:16:26       
FreeAudioCDBurner.exe        Nicht definiert        18.11.2012 21:16:09       
uninstall.exe        Nicht definiert        18.11.2012 21:16:09       
UNINSTALL_MonkeyIsland100.exe        Nicht definiert        18.11.2012 21:15:47       
Uninstall.exe        Nicht definiert        18.11.2012 21:15:34       
Remove-Bryce7_Win32.exe        Nicht definiert        18.11.2012 21:15:06       
No23Recorder.exe        Nicht definiert        18.11.2012 21:14:51       
No23Recorder.exe        Nicht definiert        18.11.2012 21:14:51       
uninst.exe        Nicht definiert        18.11.2012 21:14:45       
uninst.exe        Nicht definiert        18.11.2012 21:14:12       
zenmap.exe        Nicht definiert        18.11.2012 21:13:50       
Py2Exe        Nicht definiert        18.11.2012 21:13:50       
FreeYouTubeToMP3Converter.exe        Nicht definiert        18.11.2012 21:13:28       
EMI Launcher.exe        Nicht definiert        18.11.2012 21:13:09       
uninstall.exe        Nicht definiert        18.11.2012 21:13:08       
UNINSTALL_MonkeyIsland101.exe        Nicht definiert        18.11.2012 21:12:51       
wlanapi.dll        Nicht definiert        18.11.2012 21:12:29       
uninstall.exe        Nicht definiert        18.11.2012 21:11:42       
uninstall.exe        Nicht definiert        18.11.2012 21:11:39       
uninstall.exe        Nicht definiert        18.11.2012 21:11:22       
Uninstall.exe        Nicht definiert        18.11.2012 21:11:11       
Uninstall.exe        Nicht definiert        18.11.2012 21:10:27       
x264vfw-uninstall.exe        Nicht definiert        18.11.2012 21:10:19       
UNINSTALL_MonkeyIsland102.exe        Nicht definiert        18.11.2012 21:10:10       
uninst.exe        Nicht definiert        18.11.2012 21:10:00       
UNINSTALL_MonkeyIsland105.exe        Nicht definiert        18.11.2012 21:09:41       
Uninstall.exe        Nicht definiert        18.11.2012 21:09:39       
UNINSTALL_MonkeyIsland104.exe        Nicht definiert        18.11.2012 21:09:28       
data0001        Gelöscht        18.11.2012 21:09:05       
data0002        Gelöscht        18.11.2012 21:09:05       
Vorschlag Logo2.pdf        Gelöscht        18.11.2012 21:09:05       
data0000        Gelöscht        18.11.2012 21:09:05       
data0000        Gelöscht        18.11.2012 21:08:53       
Vorschlag Logo.pdf        Gelöscht        18.11.2012 21:08:53       
data0002        Gelöscht        18.11.2012 21:08:53       
data0001        Gelöscht        18.11.2012 21:08:53       
tassen.pdf        Gelöscht        18.11.2012 21:08:40       
data0000        Gelöscht        18.11.2012 21:08:40       
data0001        Gelöscht        18.11.2012 21:08:40       
data0002        Gelöscht        18.11.2012 21:08:40       
SoF2MP.exe        Nicht definiert        18.11.2012 21:08:26       
Sof2.exe        Nicht definiert        18.11.2012 21:08:25       
tishell.msg        Gelöscht        18.11.2012 21:06:10       
tishell.dll        Gelöscht        18.11.2012 21:06:10       
tishell.xml        Gelöscht        18.11.2012 21:06:10       
uliahci.sys        Nicht definiert        18.11.2012 21:04:37       
sym_hi.sys        Nicht definiert        18.11.2012 21:04:35       
symc8xx.sys        Nicht definiert        18.11.2012 21:04:34       
sisraid4.sys        Nicht definiert        18.11.2012 21:04:32       
Si3531.sys        Nicht definiert        18.11.2012 21:04:31       
ql2300.sys        Nicht definiert        18.11.2012 21:04:28       
ql40xx.sys        Nicht definiert        18.11.2012 21:04:28       
megasas.sys        Nicht definiert        18.11.2012 21:04:17       
lsi_sas.sys        Nicht definiert        18.11.2012 21:04:16       
lsi_fc.sys        Nicht definiert        18.11.2012 21:04:15       
iaStorV.sys        Nicht definiert        18.11.2012 21:04:12       
HpCISSs.sys        Nicht definiert        18.11.2012 21:04:08       
elxstor.sys        Nicht definiert        18.11.2012 21:04:06       
E1G60I32.sys        Nicht definiert        18.11.2012 21:04:05       
BrSerId.sys        Nicht definiert        18.11.2012 21:04:03       
arc.sys        Nicht definiert        18.11.2012 21:04:01       
djsvs.sys        Nicht definiert        18.11.2012 21:04:00       
adpu160m.sys        Nicht definiert        18.11.2012 21:03:59       
adpu320.sys        Nicht definiert        18.11.2012 21:03:59       
adp94xx.sys        Nicht definiert        18.11.2012 21:03:58       
adpahci.sys        Nicht definiert        18.11.2012 21:03:58       
schedul2.msg        Wird nach dem Neustart des Computers verarbeitet        18.11.2012 21:03:57       
schedul2.exe        Wird nach dem Neustart des Computers verarbeitet        18.11.2012 21:03:57       
Get_Started_for_Win.exe        Nicht definiert        18.11.2012 21:02:26       
afcdpsrv.exe        Nicht definiert        18.11.2012 20:58:01       
Settings.ini        Wird nach dem Neustart des Computers verarbeitet        18.11.2012 20:57:50       
FlashPlayerPlugin_11_4_402_287.exe        Wird nach dem Neustart des Computers verarbeitet        18.11.2012 20:46:50       
js?wp_id=100097&clickurl=http%3A%2F%2Fadfarm1.adition.com%3A80%2Fredi*lid%3D5812240393982116122%2Fsid%3D494808%2Fkid%3D289308%2Fbid%3D1010160%2Fc%3D43709%2Fkeyword%3D%2Fsr%3D10%2Fclickurl%3D        Inaktiv        18.11.2012 20:41:02       
ads?rt=3&et=1&i=10472&se=p&cs=828&ts=5812240393982116122        Inaktiv        18.11.2012 20:41:02       
heias.ret.pu        Inaktiv        18.11.2012 20:41:02       
js?wp_id=566404&clickurl=http%3A%2F%2Fadfarm1.adition.com%3A80%2Fredi*lid%3D5812240393982771482%2Fsid%3D494808%2Fkid%3D377600%2Fbid%3D1396521%2Fc%3D3440%2Fkeyword%3D%2Fsr%3D10%2Fclickurl%3D        Inaktiv        18.11.2012 20:41:02       
97444194?tsID=ps10001-rubifbneu&c_id=affl_cco_affiliate_ps_10001-rubifbneu        Inaktiv        18.11.2012 20:41:01
Habe bemerkt, dass zum 2. oder 3. mal eine Fehlermeldung kam, als sich der Firefox aufgehängt hat:
Nicht antwortendes Skript. Ein skript auf dieser Seite... usw
Skript: chrome://browser/content/browser.js:10838

Vielleicht hilft das.

cosinus 20.11.2012 14:19
Und was ist mit anderen Scannern? Malwarebytes, gab es sonst noch Funde?

aupex 20.11.2012 19:09
So Malwarebytes ist durch. Keine Funde. Siehe Log.
Beim ersten mal lies sich Malwarebytes nicht starten. Es kam eine Fehlermeldung:
Es werden zu viele Dateien von 16 Bit Programmen verwendet. Bitte erhöhen sie in der Config.sys den Wert Files= (oder so ähnlich).

Log:
Code:
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.20.03

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Aupex :: STEFANLAPTOP [Administrator]

20.11.2012 16:26:09
mbam-log-2012-11-20 (16-26-09).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 603784
Laufzeit: 2 Stunde(n), 21 Minute(n), 31 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Scan mit Super Anti Spyware läuft gleich.

cosinus 20.11.2012 19:25
Zitat:
Scan mit Super Anti Spyware läuft gleich.
Was soll das denn jetzt?! :balla:
Ich hab dich am Anfang gebeten alles richtig durchzulesen was du offensichtlich nicht getan hast! Dritter Punkt, erste Antwort:

Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

Du solltest weder mit Malwarebytes noch mit sasw scannen lassen, ich hab nur nach schon vorhandenen Logs gefragt!

Wenn du schon die Einleitung (ersten Hinweise) nicht richtig liest wie soll das denn erst bei schwierigen und langen Anleitungen laufen? :wtf:

aupex 20.11.2012 20:59
Dann hab ich wohl was falsch verstanden.
War etwas missverständlich ausgedrückt...
Scan abbrechen?

cosinus 20.11.2012 21:23
Nein lass durchlaufen ;)

aupex 21.11.2012 06:00
So fertig. 9 Funde
Um gleich gegenzusteuern: Der SOF2Bloodpatch ist kein Keygen und kein Crack sondern ein Mod von der grössten SOF2 Community im Netz. Das Spiel ist im Original vorhanden.
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 11/20/2012 at 11:37 PM

Application Version : 5.6.1014

Core Rules Database Version : 9608
Trace Rules Database Version: 7420

Scan type      : Complete Scan
Total Scan Time : 04:33:06

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Limited User (Administrator User)

Memory items scanned      : 713
Memory threats detected  : 0
Registry items scanned    : 60071
Registry threats detected : 0
File items scanned        : 443819
File threats detected    : 9

Trojan.Agent/Gen-Krpytik
        D:\DOWN\SOF107F_BLOODPATCH\SOF107F_BLLOODPATCH.EXE
        D:\SPIELE\SOLDIER OF FORTUNE II - DOUBLE HELIX\SOF107F_BLLOODPATCH.EXE

Adware.Tracking Cookie
        .partyaccount.com [ C:\USERS\AUPEX\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
        secure.partyaccount.com [ C:\USERS\AUPEX\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
        secure.partyaccount.com [ C:\USERS\AUPEX\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
        secure.partyaccount.com [ C:\USERS\AUPEX\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
        secure.partyaccount.com [ C:\USERS\AUPEX\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
        secure.partyaccount.com [ C:\USERS\AUPEX\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
        earlyexperience.partyaccount.com [ C:\USERS\AUPEX\APPDATA\ROAMING\MOZILLA-CACHE\PARTY\PARTYPOKER\COOKIES.TXT ]
"Remove Threats" oder "Abbrechen" ?

cosinus 21.11.2012 15:29
Ich weiß was ein Bloodpatch ist ;)

1. aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehlalarm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.


2. TDSS-Killer

Download TDSS-Killer auf Desktop siehe => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

aupex 21.11.2012 16:27
Kurze zwischenfrage: Superantispyware möchte nach dem scan immer noch eine Antwort. Remove Threats oder Abbrechen? (Du hast ja gesagt nix unternehmen ohne zustimmung:party: ) Soll ich Remove machen?

cosinus 21.11.2012 16:51
Lass sasw mal so, also nichts entfernen. Sind eh nur Cookies und dein extrem wichtiger bloodpatch :uglyhammer:

aupex 21.11.2012 20:31
aswMBR.log
Code:
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-21 18:08:57
-----------------------------
18:08:57.616    OS Version: Windows 6.0.6002 Service Pack 2
18:08:57.616    Number of processors: 2 586 0xF0D
18:08:57.622    ComputerName: STEFANLAPTOP  UserName: Aupex
18:09:00.822    Initialize success
18:12:14.341    AVAST engine defs: 12112100
18:12:25.268    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
18:12:25.271    Disk 0 Vendor: WDC_WD2500BEVS-22UST0 01.01A01 Size: 238475MB BusType: 3
18:12:25.276    Disk 0 MBR read successfully
18:12:25.280    Disk 0 MBR scan
18:12:25.285    Disk 0 Windows VISTA default MBR code
18:12:25.289    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        6000 MB offset 63
18:12:25.317    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        42108 MB offset 12289725
18:12:25.338    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      190364 MB offset 98527232
18:12:25.349    Disk 0 scanning sectors +488392704
18:12:25.444    Disk 0 scanning C:\Windows\system32\drivers
18:12:37.564    Service scanning
18:12:47.708    Service KL1 C:\Windows\system32\DRIVERS\kl1.sys **LOCKED** 5
18:12:48.109    Service kl2 C:\Windows\system32\DRIVERS\kl2.sys **LOCKED** 5
18:12:48.218    Service KLIM6 C:\Windows\system32\DRIVERS\klim6.sys **LOCKED** 5
18:12:48.256    Service klmouflt C:\Windows\system32\DRIVERS\klmouflt.sys **LOCKED** 5
18:13:11.681    Modules scanning
18:13:25.132    Disk 0 trace - called modules:
18:13:25.173    ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll intelide.sys PCIIDEX.SYS atapi.sys
18:13:25.182    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8ad3a5c0]
18:13:25.192    3 CLASSPNP.SYS[8f16a8b3] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x89b17ae8]
18:13:26.001    AVAST engine scan C:\Windows
18:13:33.139    AVAST engine scan C:\Windows\system32
18:18:17.142    AVAST engine scan C:\Windows\system32\drivers
18:18:36.180    AVAST engine scan C:\Users\Aupex
18:34:07.929    AVAST engine scan C:\ProgramData
18:52:38.432    Scan finished successfully
19:46:50.200    Disk 0 MBR has been saved successfully to "C:\Users\Aupex\Desktop\trojanerboard\MBR.dat"
19:46:50.212    The log file has been saved successfully to "C:\Users\Aupex\Desktop\trojanerboard\aswMBR.txt"
TDSSKiller
Code:
19:47:36.0332 3992  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
19:47:36.0562 3992  ============================================================
19:47:36.0562 3992  Current date / time: 2012/11/21 19:47:36.0562
19:47:36.0562 3992  SystemInfo:
19:47:36.0562 3992 
19:47:36.0562 3992  OS Version: 6.0.6002 ServicePack: 2.0
19:47:36.0562 3992  Product type: Workstation
19:47:36.0562 3992  ComputerName: STEFANLAPTOP
19:47:36.0563 3992  UserName: Aupex
19:47:36.0563 3992  Windows directory: C:\Windows
19:47:36.0563 3992  System windows directory: C:\Windows
19:47:36.0563 3992  Processor architecture: Intel x86
19:47:36.0563 3992  Number of processors: 2
19:47:36.0563 3992  Page size: 0x1000
19:47:36.0563 3992  Boot type: Normal boot
19:47:36.0563 3992  ============================================================
19:47:38.0293 3992  Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
19:47:38.0358 3992  ============================================================
19:47:38.0358 3992  \Device\Harddisk0\DR0:
19:47:38.0372 3992  MBR partitions:
19:47:38.0372 3992  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xBB86BD, BlocksNum 0x523E143
19:47:38.0372 3992  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x5DF6800, BlocksNum 0x173CE000
19:47:38.0372 3992  ============================================================
19:47:38.0496 3992  C: <-> \Device\Harddisk0\DR0\Partition1
19:47:38.0646 3992  D: <-> \Device\Harddisk0\DR0\Partition2
19:47:38.0646 3992  ============================================================
19:47:38.0647 3992  Initialize success
19:47:38.0647 3992  ============================================================
19:48:04.0118 1964  ============================================================
19:48:04.0119 1964  Scan started
19:48:04.0119 1964  Mode: Manual; SigCheck; TDLFS;
19:48:04.0119 1964  ============================================================
19:48:04.0818 1964  ================ Scan system memory ========================
19:48:04.0818 1964  System memory - ok
19:48:04.0818 1964  ================ Scan services =============================
19:48:04.0948 1964  [ 01E81C84AD1D0ACC61CF3CFD06632210 ] !SASCORE        D:\Program Files\suparaasyp\SASCORE.EXE
19:48:05.0039 1964  !SASCORE - ok
19:48:05.0199 1964  [ ADC420616C501B45D26C0FD3EF1E54E4 ] ACDaemon        C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
19:48:05.0239 1964  ACDaemon - ok
19:48:05.0402 1964  [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI            C:\Windows\system32\drivers\acpi.sys
19:48:05.0423 1964  ACPI - ok
19:48:05.0503 1964  [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
19:48:05.0515 1964  AdobeARMservice - ok
19:48:05.0591 1964  [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
19:48:05.0604 1964  AdobeFlashPlayerUpdateSvc - ok
19:48:05.0649 1964  [ 2EDC5BBAC6C651ECE337BDE8ED97C9FB ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
19:48:05.0674 1964  adp94xx - ok
19:48:05.0729 1964  [ B84088CA3CDCA97DA44A984C6CE1CCAD ] adpahci        C:\Windows\system32\drivers\adpahci.sys
19:48:05.0745 1964  adpahci - ok
19:48:05.0763 1964  [ 7880C67BCCC27C86FD05AA2AFB5EA469 ] adpu160m        C:\Windows\system32\drivers\adpu160m.sys
19:48:05.0775 1964  adpu160m - ok
19:48:05.0790 1964  [ 9AE713F8E30EFC2ABCCD84904333DF4D ] adpu320        C:\Windows\system32\drivers\adpu320.sys
19:48:05.0804 1964  adpu320 - ok
19:48:05.0857 1964  [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
19:48:05.0879 1964  AeLookupSvc - ok
19:48:05.0927 1964  [ F132D0BFDE7C5EA1AB42325C5694A969 ] afcdp          C:\Windows\system32\DRIVERS\afcdp.sys
19:48:05.0940 1964  afcdp - ok
19:48:06.0065 1964  [ 986A134B1A1770599B7AF9354CBB066F ] afcdpsrv        C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
19:48:06.0192 1964  afcdpsrv - ok
19:48:06.0251 1964  [ 3911B972B55FEA0478476B2E777B29FA ] AFD            C:\Windows\system32\drivers\afd.sys
19:48:06.0273 1964  AFD - ok
19:48:06.0318 1964  [ 39E435C90C9C4F780FA0ED05CA3C3A1B ] AgereModemAudio C:\Windows\system32\agrsmsvc.exe
19:48:06.0332 1964  AgereModemAudio - ok
19:48:06.0382 1964  [ CE91B158FA490CF4C4D487A4130F4660 ] AgereSoftModem  C:\Windows\system32\DRIVERS\AGRSM.sys
19:48:06.0458 1964  AgereSoftModem - ok
19:48:06.0489 1964  [ EF23439CDD587F64C2C1B8825CEAD7D8 ] agp440          C:\Windows\system32\drivers\agp440.sys
19:48:06.0501 1964  agp440 - ok
19:48:06.0534 1964  [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx        C:\Windows\system32\drivers\djsvs.sys
19:48:06.0547 1964  aic78xx - ok
19:48:06.0574 1964  [ A1545B731579895D8CC44FC0481C1192 ] ALG            C:\Windows\System32\alg.exe
19:48:06.0600 1964  ALG - ok
19:48:06.0617 1964  [ 90395B64600EBB4552E26E178C94B2E4 ] aliide          C:\Windows\system32\drivers\aliide.sys
19:48:06.0630 1964  aliide - ok
19:48:06.0642 1964  [ 2B13E304C9DFDFA5EB582F6A149FA2C7 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
19:48:06.0654 1964  amdagp - ok
19:48:06.0673 1964  [ 0577DF1D323FE75A739C787893D300EA ] amdide          C:\Windows\system32\drivers\amdide.sys
19:48:06.0685 1964  amdide - ok
19:48:06.0719 1964  [ DC487885BCEF9F28EECE6FAC0E5DDFC5 ] AmdK7          C:\Windows\system32\drivers\amdk7.sys
19:48:06.0757 1964  AmdK7 - ok
19:48:06.0771 1964  [ 0CA0071DA4315B00FC1328CA86B425DA ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
19:48:06.0810 1964  AmdK8 - ok
19:48:06.0851 1964  [ DD8D9C597AF7CD2F6B70A3D6A4A1ACEA ] androidusb      C:\Windows\system32\Drivers\ssadadb.sys
19:48:06.0865 1964  androidusb - ok
19:48:06.0900 1964  [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo        C:\Windows\System32\appinfo.dll
19:48:06.0929 1964  Appinfo - ok
19:48:06.0971 1964  [ 5F673180268BB1FDB69C99B6619FE379 ] arc            C:\Windows\system32\drivers\arc.sys
19:48:06.0982 1964  arc - ok
19:48:07.0018 1964  [ 957F7540B5E7F602E44648C7DE5A1C05 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
19:48:07.0030 1964  arcsas - ok
19:48:07.0135 1964  [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
19:48:07.0148 1964  aspnet_state - ok
19:48:07.0190 1964  [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
19:48:07.0243 1964  AsyncMac - ok
19:48:07.0291 1964  [ 1F05B78AB91C9075565A9D8A4B880BC4 ] atapi          C:\Windows\system32\drivers\atapi.sys
19:48:07.0306 1964  atapi - ok
19:48:07.0362 1964  [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
19:48:07.0388 1964  AudioEndpointBuilder - ok
19:48:07.0406 1964  [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv        C:\Windows\System32\Audiosrv.dll
19:48:07.0428 1964  Audiosrv - ok
19:48:07.0596 1964  [ 38AE54966E8C0004F20965BBC00F74FB ] AVP            D:\Program Files\Kaspersky Security Suite CBE 12\avp.exe
19:48:07.0609 1964  AVP - ok
19:48:07.0654 1964  [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep            C:\Windows\system32\drivers\Beep.sys
19:48:07.0702 1964  Beep - ok
19:48:07.0767 1964  [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE            C:\Windows\System32\bfe.dll
19:48:07.0794 1964  BFE - ok
19:48:07.0858 1964  [ 93952506C6D67330367F7E7934B6A02F ] BITS            C:\Windows\system32\qmgr.dll
19:48:07.0905 1964  BITS - ok
19:48:07.0911 1964  blbdrive - ok
19:48:07.0993 1964  [ F832F1505AD8B83474BD9A5B1B985E01 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
19:48:08.0013 1964  Bonjour Service - ok
19:48:08.0045 1964  [ 35F376253F687BDE63976CCB3F2108CA ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
19:48:08.0059 1964  bowser - ok
19:48:08.0103 1964  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\Windows\system32\drivers\brfiltlo.sys
19:48:08.0123 1964  BrFiltLo - ok
19:48:08.0133 1964  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\Windows\system32\drivers\brfiltup.sys
19:48:08.0155 1964  BrFiltUp - ok
19:48:08.0184 1964  [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser        C:\Windows\System32\browser.dll
19:48:08.0209 1964  Browser - ok
19:48:08.0244 1964  [ B304E75CFF293029EDDF094246747113 ] Brserid        C:\Windows\system32\drivers\brserid.sys
19:48:08.0283 1964  Brserid - ok
19:48:08.0294 1964  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\Windows\system32\drivers\brserwdm.sys
19:48:08.0333 1964  BrSerWdm - ok
19:48:08.0349 1964  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\Windows\system32\drivers\brusbmdm.sys
19:48:08.0389 1964  BrUsbMdm - ok
19:48:08.0405 1964  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\Windows\system32\drivers\brusbser.sys
19:48:08.0443 1964  BrUsbSer - ok
19:48:08.0475 1964  [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
19:48:08.0516 1964  BTHMODEM - ok
19:48:08.0619 1964  catchme - ok
19:48:08.0674 1964  [ AFAB1D4CAB04218CBAB0AE69625D0D65 ] cbfs3          C:\Windows\system32\drivers\cbfs3.sys
19:48:08.0696 1964  cbfs3 - ok
19:48:08.0740 1964  [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
19:48:08.0767 1964  cdfs - ok
19:48:08.0811 1964  [ 6B4BFFB9BECD728097024276430DB314 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
19:48:08.0837 1964  cdrom - ok
19:48:08.0890 1964  [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc    C:\Windows\System32\certprop.dll
19:48:08.0913 1964  CertPropSvc - ok
19:48:08.0943 1964  [ E5D4133F37219DBCFE102BC61072589D ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
19:48:08.0973 1964  circlass - ok
19:48:09.0015 1964  [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS            C:\Windows\system32\CLFS.sys
19:48:09.0037 1964  CLFS - ok
19:48:09.0082 1964  [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
19:48:09.0097 1964  clr_optimization_v2.0.50727_32 - ok
19:48:09.0138 1964  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
19:48:09.0163 1964  clr_optimization_v4.0.30319_32 - ok
19:48:09.0195 1964  [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
19:48:09.0233 1964  CmBatt - ok
19:48:09.0259 1964  [ 45201046C776FFDAF3FC8A0029C581C8 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
19:48:09.0279 1964  cmdide - ok
19:48:09.0310 1964  [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
19:48:09.0330 1964  Compbatt - ok
19:48:09.0337 1964  COMSysApp - ok
19:48:09.0347 1964  [ 2A213AE086BBEC5E937553C7D9A2B22C ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
19:48:09.0366 1964  crcdisk - ok
19:48:09.0384 1964  [ 22A7F883508176489F559EE745B5BF5D ] Crusoe          C:\Windows\system32\drivers\crusoe.sys
19:48:09.0433 1964  Crusoe - ok
19:48:09.0491 1964  [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
19:48:09.0508 1964  CryptSvc - ok
19:48:09.0557 1964  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch      C:\Windows\system32\rpcss.dll
19:48:09.0602 1964  DcomLaunch - ok
19:48:09.0620 1964  [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
19:48:09.0636 1964  DfsC - ok
19:48:09.0736 1964  [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR            C:\Windows\system32\DFSR.exe
19:48:09.0852 1964  DFSR - ok
19:48:09.0917 1964  [ 9028559C132146FB75EB7ACF384B086A ] Dhcp            C:\Windows\System32\dhcpcsvc.dll
19:48:09.0939 1964  Dhcp - ok
19:48:09.0973 1964  [ 5D4AEFC3386920236A548271F8F1AF6A ] disk            C:\Windows\system32\drivers\disk.sys
19:48:09.0987 1964  disk - ok
19:48:10.0039 1964  [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache        C:\Windows\System32\dnsrslvr.dll
19:48:10.0054 1964  Dnscache - ok
19:48:10.0087 1964  [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc        C:\Windows\System32\dot3svc.dll
19:48:10.0108 1964  dot3svc - ok
19:48:10.0171 1964  [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS            C:\Windows\system32\dps.dll
19:48:10.0197 1964  DPS - ok
19:48:10.0220 1964  [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
19:48:10.0238 1964  drmkaud - ok
19:48:10.0282 1964  [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
19:48:10.0323 1964  DXGKrnl - ok
19:48:10.0352 1964  [ F88FB26547FD2CE6D0A5AF2985892C48 ] E1G60          C:\Windows\system32\DRIVERS\E1G60I32.sys
19:48:10.0392 1964  E1G60 - ok
19:48:10.0443 1964  [ C0B95E40D85CD807D614E264248A45B9 ] EapHost        C:\Windows\System32\eapsvc.dll
19:48:10.0514 1964  EapHost - ok
19:48:10.0559 1964  [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache          C:\Windows\system32\drivers\ecache.sys
19:48:10.0576 1964  Ecache - ok
19:48:10.0618 1964  [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
19:48:10.0648 1964  ehRecvr - ok
19:48:10.0672 1964  [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched        C:\Windows\ehome\ehsched.exe
19:48:10.0686 1964  ehSched - ok
19:48:10.0696 1964  [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart        C:\Windows\ehome\ehstart.dll
19:48:10.0709 1964  ehstart - ok
19:48:10.0756 1964  [ E8F3F21A71720C84BCF423B80028359F ] elxstor        C:\Windows\system32\drivers\elxstor.sys
19:48:10.0773 1964  elxstor - ok
19:48:10.0815 1964  [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt        C:\Windows\system32\emdmgmt.dll
19:48:10.0899 1964  EMDMgmt - ok
19:48:10.0935 1964  [ 29DCAEB81DDE6F154AA4D36B18ECBB1F ] enecir          C:\Windows\system32\DRIVERS\enecir.sys
19:48:10.0948 1964  enecir - ok
19:48:11.0004 1964  [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem    C:\Windows\system32\es.dll
19:48:11.0028 1964  EventSystem - ok
19:48:11.0099 1964  [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat          C:\Windows\system32\drivers\exfat.sys
19:48:11.0127 1964  exfat - ok
19:48:11.0196 1964  Fabs - ok
19:48:11.0232 1964  [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
19:48:11.0257 1964  fastfat - ok
19:48:11.0284 1964  [ 63BDADA84951B9C03E641800E176898A ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
19:48:11.0331 1964  fdc - ok
19:48:11.0365 1964  [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost        C:\Windows\system32\fdPHost.dll
19:48:11.0397 1964  fdPHost - ok
19:48:11.0442 1964  [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub        C:\Windows\system32\fdrespub.dll
19:48:11.0481 1964  FDResPub - ok
19:48:11.0509 1964  [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
19:48:11.0522 1964  FileInfo - ok
19:48:11.0548 1964  [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
19:48:11.0571 1964  Filetrace - ok
19:48:11.0680 1964  [ FFF1130F7C9FA01D093A1EDFC5CCE8FC ] FirebirdServerMAGIXInstance C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
19:48:11.0827 1964  FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - warning
19:48:11.0827 1964  FirebirdServerMAGIXInstance - detected UnsignedFile.Multi.Generic (1)
19:48:11.0886 1964  [ ABEDFD48AC042C6AAAD32452E77217A1 ] FLEXnet Licensing Service C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
19:48:11.0941 1964  FLEXnet Licensing Service - ok
19:48:11.0971 1964  [ 6603957EFF5EC62D25075EA8AC27DE68 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
19:48:12.0010 1964  flpydisk - ok
19:48:12.0044 1964  [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
19:48:12.0064 1964  FltMgr - ok
19:48:12.0139 1964  [ 8CE364388C8ECA59B14B539179276D44 ] FontCache      C:\Windows\system32\FntCache.dll
19:48:12.0219 1964  FontCache - ok
19:48:12.0277 1964  [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
19:48:12.0289 1964  FontCache3.0.0.0 - ok
19:48:12.0319 1964  [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
19:48:12.0333 1964  Fs_Rec - ok
19:48:12.0372 1964  [ AAE37F0F2F613218DCE17B42A18C38DB ] FTDIBUS        C:\Windows\system32\drivers\ftdibus.sys
19:48:12.0382 1964  FTDIBUS - ok
19:48:12.0417 1964  [ 48BFD1BA45C9C9E7AB339E25ABFBA1D2 ] FTSER2K        C:\Windows\system32\drivers\ftser2k.sys
19:48:12.0426 1964  FTSER2K - ok
19:48:12.0458 1964  [ 4E1CD0A45C50A8882616CAE5BF82F3C5 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
19:48:12.0470 1964  gagp30kx - ok
19:48:12.0547 1964  [ 0879DC7444A201DF84E69C5DD5083D61 ] getPlusHelper  C:\Program Files\NOS\bin\getPlus_Helper.dll
19:48:12.0559 1964  getPlusHelper - ok
19:48:12.0615 1964  [ 007AEA2E06E7CEF7372E40C277163959 ] ggflt          C:\Windows\system32\DRIVERS\ggflt.sys
19:48:12.0626 1964  ggflt - ok
19:48:12.0676 1964  [ C73DE35960CA75C5AB4AE636B127C64E ] ggsemc          C:\Windows\system32\DRIVERS\ggsemc.sys
19:48:12.0686 1964  ggsemc - ok
19:48:12.0733 1964  [ 77EBF3E9386DAA51551AF429052D88D0 ] giveio          C:\Windows\system32\giveio.sys
19:48:12.0737 1964  giveio ( UnsignedFile.Multi.Generic ) - warning
19:48:12.0738 1964  giveio - detected UnsignedFile.Multi.Generic (1)
19:48:12.0775 1964  [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc          C:\Windows\System32\gpsvc.dll
19:48:12.0818 1964  gpsvc - ok
19:48:12.0919 1964  [ F02A533F517EB38333CB12A9E8963773 ] gupdate        C:\Program Files\Google\Update\GoogleUpdate.exe
19:48:12.0932 1964  gupdate - ok
19:48:12.0953 1964  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
19:48:12.0963 1964  gupdatem - ok
19:48:13.0012 1964  [ 3F90E001369A07243763BD5A523D8722 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
19:48:13.0040 1964  HdAudAddService - ok
19:48:13.0087 1964  [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
19:48:13.0118 1964  HDAudBus - ok
19:48:13.0149 1964  [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth          C:\Windows\system32\drivers\hidbth.sys
19:48:13.0188 1964  HidBth - ok
19:48:13.0208 1964  [ D8DF3722D5E961BAA1292AA2F12827E2 ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
19:48:13.0226 1964  HidIr - ok
19:48:13.0256 1964  [ 84067081F3318162797385E11A8F0582 ] hidserv        C:\Windows\System32\hidserv.dll
19:48:13.0271 1964  hidserv - ok
19:48:13.0305 1964  [ CCA4B519B17E23A00B826C55716809CC ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
19:48:13.0324 1964  HidUsb - ok
19:48:13.0342 1964  [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc          C:\Windows\system32\kmsvc.dll
19:48:13.0368 1964  hkmsvc - ok
19:48:13.0430 1964  [ 9E05F872290E5595AFD4871CDEE550A3 ] hotcore3        C:\Windows\system32\DRIVERS\hotcore3.sys
19:48:13.0441 1964  hotcore3 - ok
19:48:13.0454 1964  [ DF353B401001246853763C4B7AAA6F50 ] HpCISSs        C:\Windows\system32\drivers\hpcisss.sys
19:48:13.0469 1964  HpCISSs - ok
19:48:13.0509 1964  [ F870AA3E254628EBEAFE754108D664DE ] HTTP            C:\Windows\system32\drivers\HTTP.sys
19:48:13.0562 1964  HTTP - ok
19:48:13.0574 1964  [ 324C2152FF2C61ABAE92D09F3CCA4D63 ] i2omp          C:\Windows\system32\drivers\i2omp.sys
19:48:13.0586 1964  i2omp - ok
19:48:13.0640 1964  [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
19:48:13.0661 1964  i8042prt - ok
19:48:13.0676 1964  [ C957BF4B5D80B46C5017BF0101E6C906 ] iaStorV        C:\Windows\system32\drivers\iastorv.sys
19:48:13.0692 1964  iaStorV - ok
19:48:13.0854 1964  [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT        C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
19:48:13.0884 1964  IDriverT ( UnsignedFile.Multi.Generic ) - warning
19:48:13.0884 1964  IDriverT - detected UnsignedFile.Multi.Generic (1)
19:48:13.0960 1964  [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc          C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
19:48:14.0020 1964  idsvc - ok
19:48:14.0043 1964  [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
19:48:14.0054 1964  iirsp - ok
19:48:14.0145 1964  [ F82BC30BB2B608AF8B5540CDBAEA93A6 ] IJPLMSVC        C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
19:48:14.0160 1964  IJPLMSVC - ok
19:48:14.0197 1964  [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT          C:\Windows\System32\ikeext.dll
19:48:14.0227 1964  IKEEXT - ok
19:48:14.0313 1964  [ 97CAC2A7E92FFCB30C15101AB002ED30 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
19:48:14.0419 1964  IntcAzAudAddService - ok
19:48:14.0468 1964  [ 83AA759F3189E6370C30DE5DC5590718 ] intelide        C:\Windows\system32\drivers\intelide.sys
19:48:14.0481 1964  intelide - ok
19:48:14.0501 1964  [ 224191001E78C89DFA78924C3EA595FF ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
19:48:14.0526 1964  intelppm - ok
19:48:14.0551 1964  [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
19:48:14.0576 1964  IPBusEnum - ok
19:48:14.0607 1964  [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
19:48:14.0630 1964  IpFilterDriver - ok
19:48:14.0668 1964  [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
19:48:14.0686 1964  iphlpsvc - ok
19:48:14.0691 1964  IpInIp - ok
19:48:14.0714 1964  [ 40F34F8ABA2A015D780E4B09138B6C17 ] IPMIDRV        C:\Windows\system32\drivers\ipmidrv.sys
19:48:14.0752 1964  IPMIDRV - ok
19:48:14.0782 1964  [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT          C:\Windows\system32\DRIVERS\ipnat.sys
19:48:14.0806 1964  IPNAT - ok
19:48:14.0833 1964  [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
19:48:14.0856 1964  IRENUM - ok
19:48:14.0871 1964  [ 350FCA7E73CF65BCEF43FAE1E4E91293 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
19:48:14.0883 1964  isapnp - ok
19:48:14.0918 1964  [ 232FA340531D940AAC623B121A595034 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
19:48:14.0934 1964  iScsiPrt - ok
19:48:14.0945 1964  [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi        C:\Windows\system32\drivers\iteatapi.sys
19:48:14.0957 1964  iteatapi - ok
19:48:14.0971 1964  [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid        C:\Windows\system32\drivers\iteraid.sys
19:48:14.0983 1964  iteraid - ok
19:48:15.0023 1964  [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
19:48:15.0036 1964  kbdclass - ok
19:48:15.0063 1964  [ EDE59EC70E25C24581ADD1FBEC7325F7 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
19:48:15.0082 1964  kbdhid - ok
19:48:15.0113 1964  [ A3E186B4B935905B829219502557314E ] KeyIso          C:\Windows\system32\lsass.exe
19:48:15.0145 1964  KeyIso - ok
19:48:15.0176 1964  [ 186B54479D98E48AEE0E9ADA4B3C4D31 ] KL1            C:\Windows\system32\DRIVERS\kl1.sys
19:48:15.0189 1964  KL1 - ok
19:48:15.0203 1964  [ BF485BFBA13C0AB116701FD9C55324D0 ] kl2            C:\Windows\system32\DRIVERS\kl2.sys
19:48:15.0212 1964  kl2 - ok
19:48:15.0291 1964  [ AF04D0CE7939324E9A605B159295706C ] KLIF            C:\Windows\system32\DRIVERS\klif.sys
19:48:15.0319 1964  KLIF - ok
19:48:15.0331 1964  [ 6295A19003F935ECC6CCBE9E2376427B ] KLIM6          C:\Windows\system32\DRIVERS\klim6.sys
19:48:15.0342 1964  KLIM6 - ok
19:48:15.0360 1964  [ 3DE1771C135328420315E21DDE229BBA ] klmouflt        C:\Windows\system32\DRIVERS\klmouflt.sys
19:48:15.0371 1964  klmouflt - ok
19:48:15.0411 1964  [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
19:48:15.0436 1964  KSecDD - ok
19:48:15.0480 1964  [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm          C:\Windows\system32\msdtckrm.dll
19:48:15.0514 1964  KtmRm - ok
19:48:15.0552 1964  [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer    C:\Windows\System32\srvsvc.dll
19:48:15.0578 1964  LanmanServer - ok
19:48:15.0613 1964  [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
19:48:15.0631 1964  LanmanWorkstation - ok
19:48:15.0650 1964  Lavasoft Kernexplorer - ok
19:48:15.0697 1964  [ B7C19EC8B0DD7EFA58AD41FFEB8B8CDA ] Lbd            C:\Windows\system32\DRIVERS\Lbd.sys
19:48:15.0706 1964  Lbd - ok
19:48:15.0819 1964  [ 3AF6B73A3AD1FC37C5933441F66CEB91 ] LBTServ        C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
19:48:15.0831 1964  LBTServ - ok
19:48:15.0862 1964  LgBttPort - ok
19:48:15.0869 1964  lgbusenum - ok
19:48:15.0875 1964  LGVMODEM - ok
19:48:15.0926 1964  [ 7F9C7B28CF1C859E1C42619EEA946DC8 ] LHidFilt        C:\Windows\system32\DRIVERS\LHidFilt.Sys
19:48:15.0936 1964  LHidFilt - ok
19:48:15.0963 1964  [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
19:48:15.0988 1964  lltdio - ok
19:48:16.0024 1964  [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc        C:\Windows\System32\lltdsvc.dll
19:48:16.0050 1964  lltdsvc - ok
19:48:16.0073 1964  [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts        C:\Windows\System32\lmhsvc.dll
19:48:16.0113 1964  lmhosts - ok
19:48:16.0147 1964  [ AB33792A87285344F43B5CE23421BAB0 ] LMouFilt        C:\Windows\system32\DRIVERS\LMouFilt.Sys
19:48:16.0158 1964  LMouFilt - ok
19:48:16.0181 1964  [ A2262FB9F28935E862B4DB46438C80D2 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
19:48:16.0193 1964  LSI_FC - ok
19:48:16.0209 1964  [ 30D73327D390F72A62F32C103DAF1D6D ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
19:48:16.0222 1964  LSI_SAS - ok
19:48:16.0276 1964  [ E1E36FEFD45849A95F1AB81DE0159FE3 ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
19:48:16.0287 1964  LSI_SCSI - ok
19:48:16.0319 1964  [ 8F5C7426567798E62A3B3614965D62CC ] luafv          C:\Windows\system32\drivers\luafv.sys
19:48:16.0343 1964  luafv - ok
19:48:16.0388 1964  [ 77030525CD86A93F1AF34FA9B96D33CE ] LUsbFilt        C:\Windows\system32\Drivers\LUsbFilt.Sys
19:48:16.0400 1964  LUsbFilt - ok
19:48:16.0474 1964  [ 500D089CE760D83DA2B6CBA681AA9949 ] MBAMProtector  C:\Windows\system32\drivers\mbam.sys
19:48:16.0487 1964  MBAMProtector - ok
19:48:16.0599 1964  [ 85B16A92B117A5A800032ECD904B86DB ] MBAMScheduler  d:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
19:48:16.0616 1964  MBAMScheduler - ok
19:48:16.0683 1964  [ 20E2469DB709FC675E655CEAA11BE312 ] MBAMService    d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
19:48:16.0710 1964  MBAMService - ok
19:48:16.0831 1964  [ 92063C0AC741AD5DA57CE564E5913BF5 ] MCSWASVR        d:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe
19:48:16.0836 1964  MCSWASVR ( UnsignedFile.Multi.Generic ) - warning
19:48:16.0836 1964  MCSWASVR - detected UnsignedFile.Multi.Generic (1)
19:48:16.0870 1964  [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
19:48:16.0888 1964  Mcx2Svc - ok
19:48:16.0926 1964  [ D153B14FC6598EAE8422A2037553ADCE ] megasas        C:\Windows\system32\drivers\megasas.sys
19:48:16.0940 1964  megasas - ok
19:48:16.0971 1964  [ E5292521916CEA4937FBABCB1532F676 ] MGHwCtrl        C:\Windows\system32\drivers\MGHwCtrl.sys
19:48:16.0978 1964  MGHwCtrl ( UnsignedFile.Multi.Generic ) - warning
19:48:16.0978 1964  MGHwCtrl - detected UnsignedFile.Multi.Generic (1)
19:48:16.0998 1964  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS          C:\Windows\system32\mmcss.dll
19:48:17.0038 1964  MMCSS - ok
19:48:17.0062 1964  [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem          C:\Windows\system32\drivers\modem.sys
19:48:17.0101 1964  Modem - ok
19:48:17.0149 1964  [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
19:48:17.0177 1964  monitor - ok
19:48:17.0192 1964  [ 5BF6A1326A335C5298477754A506D263 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
19:48:17.0205 1964  mouclass - ok
19:48:17.0213 1964  [ 93B8D4869E12CFBE663915502900876F ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
19:48:17.0237 1964  mouhid - ok
19:48:17.0262 1964  [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr        C:\Windows\system32\drivers\mountmgr.sys
19:48:17.0275 1964  MountMgr - ok
19:48:17.0322 1964  [ 583A41F26278D9E0EA548163D6139397 ] mpio            C:\Windows\system32\drivers\mpio.sys
19:48:17.0334 1964  mpio - ok
19:48:17.0353 1964  [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
19:48:17.0373 1964  mpsdrv - ok
19:48:17.0413 1964  [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc          C:\Windows\system32\mpssvc.dll
19:48:17.0443 1964  MpsSvc - ok
19:48:17.0454 1964  [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x        C:\Windows\system32\drivers\mraid35x.sys
19:48:17.0467 1964  Mraid35x - ok
19:48:17.0504 1964  [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
19:48:17.0520 1964  MRxDAV - ok
19:48:17.0542 1964  [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
19:48:17.0557 1964  mrxsmb - ok
19:48:17.0587 1964  [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
19:48:17.0605 1964  mrxsmb10 - ok
19:48:17.0616 1964  [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
19:48:17.0630 1964  mrxsmb20 - ok
19:48:17.0642 1964  [ 742AED7939E734C36B7E8D6228CE26B7 ] msahci          C:\Windows\system32\drivers\msahci.sys
19:48:17.0654 1964  msahci - ok
19:48:17.0673 1964  [ 3FC82A2AE4CC149165A94699183D3028 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
19:48:17.0686 1964  msdsm - ok
19:48:17.0713 1964  [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC          C:\Windows\System32\msdtc.exe
19:48:17.0740 1964  MSDTC - ok
19:48:17.0772 1964  [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
19:48:17.0794 1964  Msfs - ok
19:48:17.0846 1964  [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
19:48:17.0858 1964  msisadrv - ok
19:48:17.0884 1964  [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
19:48:17.0909 1964  MSiSCSI - ok
19:48:17.0915 1964  msiserver - ok
19:48:17.0963 1964  [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
19:48:17.0987 1964  MSKSSRV - ok
19:48:18.0035 1964  [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
19:48:18.0059 1964  MSPCLOCK - ok
19:48:18.0081 1964  [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
19:48:18.0105 1964  MSPQM - ok
19:48:18.0136 1964  [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
19:48:18.0153 1964  MsRPC - ok
19:48:18.0174 1964  [ E384487CB84BE41D09711C30CA79646C ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
19:48:18.0188 1964  mssmbios - ok
19:48:18.0294 1964  MSSQL$JTLWAWI - ok
19:48:18.0336 1964  MSSQL$SQLEXPRESS - ok
19:48:18.0412 1964  [ 1D89EB4E2A99CABD4E81225F4F4C4B25 ] MSSQLServerADHelper C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
19:48:18.0425 1964  MSSQLServerADHelper - ok
19:48:18.0488 1964  [ F1761C8FB2B25A32C6D63E36BB88C3AE ] MSSQLServerADHelper100 C:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE
19:48:18.0500 1964  MSSQLServerADHelper100 - ok
19:48:18.0517 1964  [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
19:48:18.0541 1964  MSTEE - ok
19:48:18.0569 1964  [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup            C:\Windows\system32\Drivers\mup.sys
19:48:18.0581 1964  Mup - ok
19:48:18.0614 1964  [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent        C:\Windows\system32\qagentRT.dll
19:48:18.0640 1964  napagent - ok
19:48:18.0676 1964  [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
19:48:18.0693 1964  NativeWifiP - ok
19:48:18.0743 1964  [ 13AA2130F2A104DD775EAD0F0EE5417B ] NAUpdate        C:\Program Files\Nero\Update\NASvc.exe
19:48:18.0781 1964  NAUpdate - ok
19:48:18.0847 1964  [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS            C:\Windows\system32\drivers\ndis.sys
19:48:18.0874 1964  NDIS - ok
19:48:18.0904 1964  [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
19:48:18.0924 1964  NdisTapi - ok
19:48:18.0980 1964  [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
19:48:19.0003 1964  Ndisuio - ok
19:48:19.0037 1964  [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
19:48:19.0058 1964  NdisWan - ok
19:48:19.0077 1964  [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
19:48:19.0097 1964  NDProxy - ok
19:48:19.0110 1964  [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
19:48:19.0133 1964  NetBIOS - ok
19:48:19.0164 1964  [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt          C:\Windows\system32\DRIVERS\netbt.sys
19:48:19.0187 1964  netbt - ok
19:48:19.0192 1964  [ A3E186B4B935905B829219502557314E ] Netlogon        C:\Windows\system32\lsass.exe
19:48:19.0206 1964  Netlogon - ok
19:48:19.0234 1964  [ C8052711DAECC48B982434C5116CA401 ] Netman          C:\Windows\System32\netman.dll
19:48:19.0263 1964  Netman - ok
19:48:19.0298 1964  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
19:48:19.0311 1964  NetMsmqActivator - ok
19:48:19.0316 1964  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
19:48:19.0328 1964  NetPipeActivator - ok
19:48:19.0355 1964  [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm        C:\Windows\System32\netprofm.dll
19:48:19.0386 1964  netprofm - ok
19:48:19.0392 1964  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
19:48:19.0407 1964  NetTcpActivator - ok
19:48:19.0413 1964  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
19:48:19.0429 1964  NetTcpPortSharing - ok
19:48:19.0523 1964  [ CB3AF516A6797B27725E3F1E73F3496C ] NETw4v32        C:\Windows\system32\DRIVERS\NETw4v32.sys
19:48:19.0663 1964  NETw4v32 - ok
19:48:19.0674 1964  [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
19:48:19.0689 1964  nfrd960 - ok
19:48:19.0703 1964  [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc          C:\Windows\System32\nlasvc.dll
19:48:19.0737 1964  NlaSvc - ok
19:48:19.0780 1964  [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
19:48:19.0804 1964  Npfs - ok
19:48:19.0833 1964  [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi            C:\Windows\system32\nsisvc.dll
19:48:19.0864 1964  nsi - ok
19:48:19.0895 1964  [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
19:48:19.0924 1964  nsiproxy - ok
19:48:19.0983 1964  [ 6A4A98CEE84CF9E99564510DDA4BAA47 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
19:48:20.0066 1964  Ntfs - ok
19:48:20.0093 1964  [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi      C:\Windows\system32\drivers\ntrigdigi.sys
19:48:20.0140 1964  ntrigdigi - ok
19:48:20.0171 1964  [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null            C:\Windows\system32\drivers\Null.sys
19:48:20.0199 1964  Null - ok
19:48:20.0493 1964  [ 4152708C0C24E30DAE7FA87D5AFE1D7B ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
19:48:21.0014 1964  nvlddmkm - ok
19:48:21.0037 1964  [ E69E946F80C1C31C53003BFBF50CBB7C ] nvraid          C:\Windows\system32\drivers\nvraid.sys
19:48:21.0050 1964  nvraid - ok
19:48:21.0060 1964  [ 9E0BA19A28C498A6D323D065DB76DFFC ] nvstor          C:\Windows\system32\drivers\nvstor.sys
19:48:21.0072 1964  nvstor - ok
19:48:21.0117 1964  [ 26DB28B32E8D2F57CB5065A4A053801A ] nvsvc          C:\Windows\system32\nvvsvc.exe
19:48:21.0152 1964  nvsvc - ok
19:48:21.0195 1964  [ 07C186427EB8FCC3D8D7927187F260F7 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
19:48:21.0208 1964  nv_agp - ok
19:48:21.0213 1964  NwlnkFlt - ok
19:48:21.0219 1964  NwlnkFwd - ok
19:48:21.0310 1964  [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv          C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
19:48:21.0333 1964  odserv - ok
19:48:21.0395 1964  [ 6F310E890D46E246E0E261A63D9B36B4 ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
19:48:21.0415 1964  ohci1394 - ok
19:48:21.0477 1964  [ 5A432A042DAE460ABE7199B758E8606C ] ose            C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
19:48:21.0490 1964  ose - ok
19:48:21.0524 1964  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc        C:\Windows\system32\p2psvc.dll
19:48:21.0565 1964  p2pimsvc - ok
19:48:21.0578 1964  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc          C:\Windows\system32\p2psvc.dll
19:48:21.0604 1964  p2psvc - ok
19:48:21.0624 1964  [ 0FA9B5055484649D63C303FE404E5F4D ] Parport        C:\Windows\system32\drivers\parport.sys
19:48:21.0663 1964  Parport - ok
19:48:21.0698 1964  [ B9C2B89F08670E159F7181891E449CD9 ] partmgr        C:\Windows\system32\drivers\partmgr.sys
19:48:21.0711 1964  partmgr - ok
19:48:21.0727 1964  [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm          C:\Windows\system32\drivers\parvdm.sys
19:48:21.0765 1964  Parvdm - ok
19:48:21.0776 1964  [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc          C:\Windows\System32\pcasvc.dll
19:48:21.0808 1964  PcaSvc - ok
19:48:21.0848 1964  [ 941DC1D19E7E8620F40BBC206981EFDB ] pci            C:\Windows\system32\drivers\pci.sys
19:48:21.0863 1964  pci - ok
19:48:21.0873 1964  [ 3B1901E401473E03EB8C874271E50C26 ] pciide          C:\Windows\system32\drivers\pciide.sys
19:48:21.0886 1964  pciide - ok
19:48:21.0899 1964  [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
19:48:21.0914 1964  pcmcia - ok
19:48:21.0964 1964  [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
19:48:22.0046 1964  PEAUTH - ok
19:48:22.0117 1964  [ B1689DF169143F57053F795390C99DB3 ] pla            C:\Windows\system32\pla.dll
19:48:22.0219 1964  pla - ok
19:48:22.0257 1964  [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
19:48:22.0281 1964  PlugPlay - ok
19:48:22.0331 1964  [ 205E1B699FD3F2F9B036EEA2EC30C620 ] PnkBstrA        C:\Windows\system32\PnkBstrA.exe
19:48:22.0345 1964  PnkBstrA - ok
19:48:22.0369 1964  [ 7C01817ADF3207FB65A4B56E6D5AD833 ] PnkBstrB        C:\Windows\system32\PnkBstrB.exe
19:48:22.0386 1964  PnkBstrB - ok
19:48:22.0415 1964  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg    C:\Windows\system32\p2psvc.dll
19:48:22.0446 1964  PNRPAutoReg - ok
19:48:22.0481 1964  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc        C:\Windows\system32\p2psvc.dll
19:48:22.0512 1964  PNRPsvc - ok
19:48:22.0548 1964  [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
19:48:22.0582 1964  PolicyAgent - ok
19:48:22.0601 1964  [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
19:48:22.0630 1964  PptpMiniport - ok
19:48:22.0665 1964  [ 0E3CEF5D28B40CF273281D620C50700A ] Processor      C:\Windows\system32\drivers\processr.sys
19:48:22.0709 1964  Processor - ok
19:48:22.0743 1964  [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc        C:\Windows\system32\profsvc.dll
19:48:22.0766 1964  ProfSvc - ok
19:48:22.0782 1964  [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
19:48:22.0797 1964  ProtectedStorage - ok
19:48:22.0820 1964  [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched          C:\Windows\system32\DRIVERS\pacer.sys
19:48:22.0840 1964  PSched - ok
19:48:22.0891 1964  [ D24DFD16A1E2A76034DF5AA18125C35D ] PSI            C:\Windows\system32\DRIVERS\psi_mf.sys
19:48:22.0900 1964  PSI - ok
19:48:22.0948 1964  [ 681AE4F1927FE0FDEEE2863F1684088D ] pwdrvio        C:\Windows\system32\pwdrvio.sys
19:48:22.0962 1964  pwdrvio - ok
19:48:22.0983 1964  [ BC60895CE021309EBD887D2F22055654 ] pwdspio        C:\Windows\system32\pwdspio.sys
19:48:22.0996 1964  pwdspio - ok
19:48:23.0028 1964  [ E42E3433DBB4CFFE8FDD91EAB29AEA8E ] PxHelp20        C:\Windows\system32\Drivers\PxHelp20.sys
19:48:23.0039 1964  PxHelp20 - ok
19:48:23.0093 1964  [ CCDAC889326317792480C0A67156A1EC ] ql2300          C:\Windows\system32\drivers\ql2300.sys
19:48:23.0157 1964  ql2300 - ok
19:48:23.0185 1964  [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
19:48:23.0197 1964  ql40xx - ok
19:48:23.0223 1964  [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE          C:\Windows\system32\qwave.dll
19:48:23.0242 1964  QWAVE - ok
19:48:23.0272 1964  [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
19:48:23.0285 1964  QWAVEdrv - ok
19:48:23.0304 1964  [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
19:48:23.0327 1964  RasAcd - ok
19:48:23.0352 1964  [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto        C:\Windows\System32\rasauto.dll
19:48:23.0379 1964  RasAuto - ok
19:48:23.0398 1964  [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
19:48:23.0423 1964  Rasl2tp - ok
19:48:23.0453 1964  [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan          C:\Windows\System32\rasmans.dll
19:48:23.0477 1964  RasMan - ok
19:48:23.0507 1964  [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
19:48:23.0526 1964  RasPppoe - ok
19:48:23.0553 1964  [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
19:48:23.0567 1964  RasSstp - ok
19:48:23.0597 1964  [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
19:48:23.0619 1964  rdbss - ok
19:48:23.0654 1964  [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
19:48:23.0678 1964  RDPCDD - ok
19:48:23.0713 1964  [ E8BD98D46F2ED77132BA927FCCB47D8B ] rdpdr          C:\Windows\system32\drivers\rdpdr.sys
19:48:23.0754 1964  rdpdr - ok
19:48:23.0761 1964  [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
19:48:23.0784 1964  RDPENCDD - ok
19:48:23.0820 1964  [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
19:48:23.0836 1964  RDPWD - ok
19:48:23.0877 1964  [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess    C:\Windows\System32\mprdim.dll
19:48:23.0903 1964  RemoteAccess - ok
19:48:23.0930 1964  [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry  C:\Windows\system32\regsvc.dll
19:48:23.0957 1964  RemoteRegistry - ok
19:48:23.0977 1964  [ 355AAC141B214BEF1DBC1483AFD9BD50 ] rimmptsk        C:\Windows\system32\DRIVERS\rimmptsk.sys
19:48:23.0992 1964  rimmptsk - ok
19:48:24.0008 1964  [ A4216C71DD4F60B26418CCFD99CD0815 ] rimsptsk        C:\Windows\system32\DRIVERS\rimsptsk.sys
19:48:24.0020 1964  rimsptsk - ok
19:48:24.0072 1964  [ 75E8A6BFA7374ABA833AE92BF41AE4E6 ] ROOTMODEM      C:\Windows\system32\Drivers\RootMdm.sys
19:48:24.0096 1964  ROOTMODEM - ok
19:48:24.0115 1964  [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator      C:\Windows\system32\locator.exe
19:48:24.0139 1964  RpcLocator - ok
19:48:24.0178 1964  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs          C:\Windows\system32\rpcss.dll
19:48:24.0206 1964  RpcSs - ok
19:48:24.0255 1964  [ FD692C6FFADE58F7C4C3C3C9A0EC35BD ] RsFx0103        C:\Windows\system32\DRIVERS\RsFx0103.sys
19:48:24.0269 1964  RsFx0103 - ok
19:48:24.0300 1964  [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
19:48:24.0324 1964  rspndr - ok
19:48:24.0337 1964  [ B7E1C523E2F7787D700766FC78E01F77 ] RTL8169        C:\Windows\system32\DRIVERS\Rtlh86.sys
19:48:24.0373 1964  RTL8169 - ok
19:48:24.0413 1964  [ 59509AD6CBC28F2C73056268985B3E48 ] s0016bus        C:\Windows\system32\DRIVERS\s0016bus.sys
19:48:24.0424 1964  s0016bus - ok
19:48:24.0433 1964  [ B98C3A6F91F4FBA285AF9606A240C6B4 ] s0016mdfl      C:\Windows\system32\DRIVERS\s0016mdfl.sys
19:48:24.0443 1964  s0016mdfl - ok
19:48:24.0464 1964  [ 8A83426F4FB7B5212825D9DE76368B1A ] s0016mdm        C:\Windows\system32\DRIVERS\s0016mdm.sys
19:48:24.0476 1964  s0016mdm - ok
19:48:24.0498 1964  [ 7A78BBA97FEB5E6D24C49E93A3BF7287 ] s0016mgmt      C:\Windows\system32\DRIVERS\s0016mgmt.sys
19:48:24.0510 1964  s0016mgmt - ok
19:48:24.0542 1964  [ 34EF7B5F611957B73E7219DD5A222AD1 ] s0016nd5        C:\Windows\system32\DRIVERS\s0016nd5.sys
19:48:24.0552 1964  s0016nd5 - ok
19:48:24.0565 1964  [ 36792935847143E4A3CDA0DC87248487 ] s0016obex      C:\Windows\system32\DRIVERS\s0016obex.sys
19:48:24.0577 1964  s0016obex - ok
19:48:24.0601 1964  [ 927208754FB27FC3E7A659E77500C5D1 ] s0016unic      C:\Windows\system32\DRIVERS\s0016unic.sys
19:48:24.0612 1964  s0016unic - ok
19:48:24.0632 1964  [ C16D95BD9FDB381689053CB5ECAC9E40 ] SaiMini        C:\Windows\system32\DRIVERS\SaiMini.sys
19:48:24.0642 1964  SaiMini - ok
19:48:24.0694 1964  [ E549BF8B944A6CC6356B322CBB83C796 ] SaiNtBus        C:\Windows\system32\drivers\SaiBus.sys
19:48:24.0705 1964  SaiNtBus - ok
19:48:24.0719 1964  [ A3E186B4B935905B829219502557314E ] SamSs          C:\Windows\system32\lsass.exe
19:48:24.0732 1964  SamSs - ok
19:48:24.0783 1964  [ 39763504067962108505BFF25F024345 ] SASDIFSV        D:\Program Files\suparaasyp\SASDIFSV.SYS
19:48:24.0793 1964  SASDIFSV - ok
19:48:24.0812 1964  [ 77B9FC20084B48408AD3E87570EB4A85 ] SASKUTIL        D:\Program Files\suparaasyp\SASKUTIL.SYS
19:48:24.0824 1964  SASKUTIL - ok
19:48:24.0885 1964  [ A07D4747A6EBF15968CF5C891709D8F6 ] SbieDrv        d:\Program Files\Sandboxie\SbieDrv.sys
19:48:24.0889 1964  SbieDrv ( UnsignedFile.Multi.Generic ) - warning
19:48:24.0889 1964  SbieDrv - detected UnsignedFile.Multi.Generic (1)
19:48:24.0893 1964  [ 2B2B6189DC47F44D7549519AA7519777 ] SbieSvc        d:\Program Files\Sandboxie\SbieSvc.exe
19:48:24.0898 1964  SbieSvc ( UnsignedFile.Multi.Generic ) - warning
19:48:24.0898 1964  SbieSvc - detected UnsignedFile.Multi.Generic (1)
19:48:24.0935 1964  [ 3CE8F073A557E172B330109436984E30 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
19:48:24.0947 1964  sbp2port - ok
19:48:24.0998 1964  [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
19:48:25.0020 1964  SCardSvr - ok
19:48:25.0062 1964  [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule        C:\Windows\system32\schedsvc.dll
19:48:25.0104 1964  Schedule - ok
19:48:25.0134 1964  [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc    C:\Windows\System32\certprop.dll
19:48:25.0155 1964  SCPolicySvc - ok
19:48:25.0188 1964  [ 8F36B54688C31EED4580129040C6A3D3 ] sdbus          C:\Windows\system32\DRIVERS\sdbus.sys
19:48:25.0209 1964  sdbus - ok
19:48:25.0237 1964  [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
19:48:25.0254 1964  SDRSVC - ok
19:48:25.0266 1964  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
19:48:25.0305 1964  secdrv - ok
19:48:25.0331 1964  [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon        C:\Windows\system32\seclogon.dll
19:48:25.0362 1964  seclogon - ok
19:48:25.0452 1964  [ 2D0599DD0124764FC939C59985C860DE ] Secunia PSI Agent d:\Program Files\Secunia\PSI\PSIA.exe
19:48:25.0512 1964  Secunia PSI Agent - ok
19:48:25.0551 1964  [ 20B9E1ADBC58958B480933E4DA005DFB ] Secunia Update Agent d:\Program Files\Secunia\PSI\sua.exe
19:48:25.0574 1964  Secunia Update Agent - ok
19:48:25.0649 1964  [ E5B56569A9F79B70314FEDE6C953641E ] seehcri        C:\Windows\system32\DRIVERS\seehcri.sys
19:48:25.0678 1964  seehcri - ok
19:48:25.0692 1964  [ A9BBAB5759771E523F55563D6CBE140F ] SENS            C:\Windows\system32\sens.dll
19:48:25.0734 1964  SENS - ok
19:48:25.0788 1964  [ 7BFC84F24CC12DE5C26BEA6AA4AFDEF5 ] Ser2pl          C:\Windows\system32\DRIVERS\ser2pl.sys
19:48:25.0808 1964  Ser2pl - ok
19:48:25.0832 1964  [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
19:48:25.0894 1964  Serenum - ok
19:48:25.0914 1964  [ C70D69A918B178D3C3B06339B40C2E1B ] Serial          C:\Windows\system32\drivers\serial.sys
19:48:25.0978 1964  Serial - ok
19:48:26.0000 1964  [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
19:48:26.0027 1964  sermouse - ok
19:48:26.0057 1964  [ D2193326F729B163125610DBF3E17D57 ] SessionEnv      C:\Windows\system32\sessenv.dll
19:48:26.0084 1964  SessionEnv - ok
19:48:26.0104 1964  [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk        C:\Windows\system32\DRIVERS\sffdisk.sys
19:48:26.0124 1964  sffdisk - ok
19:48:26.0133 1964  [ 8FD08A310645FE872EEEC6E08C6BF3EE ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
19:48:26.0173 1964  sffp_mmc - ok
19:48:26.0199 1964  [ 9F66A46C55D6F1CCABC79BB7AFCCC545 ] sffp_sd        C:\Windows\system32\DRIVERS\sffp_sd.sys
19:48:26.0218 1964  sffp_sd - ok
19:48:26.0228 1964  [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
19:48:26.0267 1964  sfloppy - ok
19:48:26.0295 1964  [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
19:48:26.0323 1964  SharedAccess - ok
19:48:26.0358 1964  [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
19:48:26.0378 1964  ShellHWDetection - ok
19:48:26.0392 1964  [ 7471CF7CBB4CC7D92FDB7F6527A9008C ] Si3531          C:\Windows\system32\DRIVERS\Si3531.sys
19:48:26.0409 1964  Si3531 - ok
19:48:26.0439 1964  [ 72CF151FB410E544904DBC7D7F29B796 ] SiFilter        C:\Windows\system32\DRIVERS\SiWinAcc.sys
19:48:26.0451 1964  SiFilter - ok
19:48:26.0471 1964  [ 41A59F484188BE629087BA391FF60D74 ] SiRemFil        C:\Windows\system32\DRIVERS\SiRemFil.sys
19:48:26.0482 1964  SiRemFil - ok
19:48:26.0503 1964  [ D2A595D6EEBEEAF4334F8E50EFBC9931 ] sisagp          C:\Windows\system32\drivers\sisagp.sys
19:48:26.0515 1964  sisagp - ok
19:48:26.0528 1964  [ CEDD6F4E7D84E9F98B34B3FE988373AA ] SiSRaid2        C:\Windows\system32\drivers\sisraid2.sys
19:48:26.0541 1964  SiSRaid2 - ok
19:48:26.0560 1964  [ DF843C528C4F69D12CE41CE462E973A7 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
19:48:26.0573 1964  SiSRaid4 - ok
19:48:26.0612 1964  [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate    C:\Program Files\Skype\Updater\Updater.exe
19:48:26.0626 1964  SkypeUpdate - ok
19:48:26.0733 1964  [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc          C:\Windows\system32\SLsvc.exe
19:48:26.0895 1964  slsvc - ok
19:48:26.0936 1964  [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify      C:\Windows\system32\SLUINotify.dll
19:48:26.0958 1964  SLUINotify - ok
19:48:26.0979 1964  [ 7B75299A4D201D6A6533603D6914AB04 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
19:48:26.0999 1964  Smb - ok
19:48:27.0057 1964  [ FFD9B64DB2CD7B74B766C3A8452A5816 ] snapman        C:\Windows\system32\DRIVERS\snapman.sys
19:48:27.0070 1964  snapman - ok
19:48:27.0097 1964  [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
19:48:27.0112 1964  SNMPTRAP - ok
19:48:27.0156 1964  [ 3FA2E254BFBCE52B3C6F1BF23AAB6911 ] speedfan        C:\Windows\system32\speedfan.sys
19:48:27.0169 1964  speedfan - ok
19:48:27.0196 1964  [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr          C:\Windows\system32\drivers\spldr.sys
19:48:27.0208 1964  spldr - ok
19:48:27.0240 1964  [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler        C:\Windows\System32\spoolsv.exe
19:48:27.0257 1964  Spooler - ok
19:48:27.0341 1964  [ 71E276F6D189413266EA22171806597B ] sptd            C:\Windows\System32\Drivers\sptd.sys
19:48:27.0382 1964  sptd - ok
19:48:27.0421 1964  [ A687B5B326AFCFCF182C4931D1FF9771 ] SQLAgent$SQLEXPRESS C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE
19:48:27.0443 1964  SQLAgent$SQLEXPRESS - ok
19:48:27.0491 1964  [ B54B48F6D92423440C264E91225C5FF1 ] SQLBrowser      C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
19:48:27.0507 1964  SQLBrowser - ok
19:48:27.0553 1964  [ 637A0F23F9012358E92E6F99835494D1 ] SQLWriter      C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
19:48:27.0567 1964  SQLWriter - ok
19:48:27.0611 1964  [ 41987F9FC0E61ADF54F581E15029AD91 ] srv            C:\Windows\system32\DRIVERS\srv.sys
19:48:27.0630 1964  srv - ok
19:48:27.0663 1964  [ FF33AFF99564B1AA534F58868CBE41EF ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
19:48:27.0678 1964  srv2 - ok
19:48:27.0692 1964  [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
19:48:27.0708 1964  srvnet - ok
19:48:27.0746 1964  [ 64E44ACD8C238FCBBB78F0BA4BDC4B05 ] ssadbus        C:\Windows\system32\DRIVERS\ssadbus.sys
19:48:27.0775 1964  ssadbus - ok
19:48:27.0790 1964  [ BB2C84A15C765DA89FD832B0E73F26CE ] ssadmdfl        C:\Windows\system32\DRIVERS\ssadmdfl.sys
19:48:27.0803 1964  ssadmdfl - ok
19:48:27.0821 1964  [ 6D0D132DDC6F43EDA00DCED6D8B1CA31 ] ssadmdm        C:\Windows\system32\DRIVERS\ssadmdm.sys
19:48:27.0839 1964  ssadmdm - ok
19:48:27.0857 1964  [ 1A5A397BC459F346AB56492B61EF79F6 ] ssadserd        C:\Windows\system32\DRIVERS\ssadserd.sys
19:48:27.0876 1964  ssadserd - ok
19:48:27.0909 1964  [ 069351A1D7D291013177A90AE6EDCCBC ] sscdbus        C:\Windows\system32\DRIVERS\sscdbus.sys
19:48:27.0922 1964  sscdbus - ok
19:48:27.0962 1964  [ 1C925BE223A5C0F9F469252292A48DF6 ] sscdmdfl        C:\Windows\system32\DRIVERS\sscdmdfl.sys
19:48:27.0973 1964  sscdmdfl - ok
19:48:28.0005 1964  [ AE3E77AE0FBDB07EB1AC3FED74A0695E ] sscdmdm        C:\Windows\system32\DRIVERS\sscdmdm.sys
19:48:28.0019 1964  sscdmdm - ok
19:48:28.0048 1964  [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
19:48:28.0083 1964  SSDPSRV - ok
19:48:28.0131 1964  [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
19:48:28.0155 1964  SstpSvc - ok
19:48:28.0209 1964  [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc          C:\Windows\System32\wiaservc.dll
19:48:28.0240 1964  stisvc - ok
19:48:28.0269 1964  [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
19:48:28.0284 1964  swenum - ok
19:48:28.0326 1964  [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv          C:\Windows\System32\swprv.dll
19:48:28.0357 1964  swprv - ok
19:48:28.0377 1964  [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx        C:\Windows\system32\drivers\symc8xx.sys
19:48:28.0391 1964  Symc8xx - ok
19:48:28.0409 1964  [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi          C:\Windows\system32\drivers\sym_hi.sys
19:48:28.0424 1964  Sym_hi - ok
19:48:28.0438 1964  [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3          C:\Windows\system32\drivers\sym_u3.sys
19:48:28.0454 1964  Sym_u3 - ok
19:48:28.0500 1964  [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain        C:\Windows\system32\sysmain.dll
19:48:28.0547 1964  SysMain - ok
19:48:28.0578 1964  [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
19:48:28.0598 1964  TabletInputService - ok
19:48:28.0830 1964  [ 1FF41723B6CF6EF0D2456691B75131BB ] TabletServicePen C:\Program Files\Tablet\Pen\Pen_Tablet.exe
19:48:29.0107 1964  TabletServicePen - ok
19:48:29.0142 1964  [ 34F1BCB847A924A161422F106A79B9FF ] tap0901        C:\Windows\system32\DRIVERS\tap0901.sys
19:48:29.0151 1964  tap0901 ( UnsignedFile.Multi.Generic ) - warning
19:48:29.0151 1964  tap0901 - detected UnsignedFile.Multi.Generic (1)
19:48:29.0184 1964  [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv        C:\Windows\System32\tapisrv.dll
19:48:29.0210 1964  TapiSrv - ok
19:48:29.0245 1964  [ CB05822CD9CC6C688168E113C603DBE7 ] TBS            C:\Windows\System32\tbssvc.dll
19:48:29.0271 1964  TBS - ok
19:48:29.0325 1964  [ EE7E10BED85C312C1D5D30C435BDDA9F ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
19:48:29.0382 1964  Tcpip - ok
19:48:29.0400 1964  [ EE7E10BED85C312C1D5D30C435BDDA9F ] Tcpip6          C:\Windows\system32\DRIVERS\tcpip.sys
19:48:29.0444 1964  Tcpip6 - ok
19:48:29.0481 1964  [ 2C2D4CFF5E09C73908F9B5AF49A51365 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
19:48:29.0495 1964  tcpipreg - ok
19:48:29.0524 1964  [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
19:48:29.0547 1964  TDPIPE - ok
19:48:29.0594 1964  [ 3630F5B8181554DEECFE2E4252BC4C4C ] tdrpman251      C:\Windows\system32\DRIVERS\tdrpm251.sys
19:48:29.0658 1964  tdrpman251 - ok
19:48:29.0683 1964  [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
19:48:29.0708 1964  TDTCP - ok
19:48:29.0731 1964  [ 76B06EB8A01FC8624D699E7045303E54 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
19:48:29.0751 1964  tdx - ok
19:48:29.0771 1964  [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
19:48:29.0785 1964  TermDD - ok
19:48:29.0804 1964  [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService    C:\Windows\System32\termsrv.dll
19:48:29.0836 1964  TermService - ok
19:48:29.0863 1964  [ C7230FBEE14437716701C15BE02C27B8 ] Themes          C:\Windows\system32\shsvcs.dll
19:48:29.0880 1964  Themes - ok
19:48:29.0893 1964  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER    C:\Windows\system32\mmcss.dll
19:48:29.0917 1964  THREADORDER - ok
19:48:29.0948 1964  [ C820BFC70FEB25EC877C49E81CD477C1 ] timounter      C:\Windows\system32\DRIVERS\timntr.sys
19:48:29.0973 1964  timounter - ok
19:48:30.0034 1964  [ E44759CB4AC9F43464D8780501CC0470 ] TOSHIBA Bluetooth Service C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
19:48:30.0046 1964  TOSHIBA Bluetooth Service - ok
19:48:30.0086 1964  [ 2C15B4856F929AC7DD144044D8334B54 ] tosporte        C:\Windows\system32\DRIVERS\tosporte.sys
19:48:30.0110 1964  tosporte - ok
19:48:30.0147 1964  [ 6750328AB04AE5FAF01403A575D66978 ] tosrfbd        C:\Windows\system32\DRIVERS\tosrfbd.sys
19:48:30.0171 1964  tosrfbd - ok
19:48:30.0190 1964  [ E5E34CD8848742CDC946F589F802630F ] tosrfbnp        C:\Windows\system32\Drivers\tosrfbnp.sys
19:48:30.0203 1964  tosrfbnp - ok
19:48:30.0242 1964  [ C281D231BA7BC7955D39EA9E21374EFF ] Tosrfcom        C:\Windows\system32\Drivers\tosrfcom.sys
19:48:30.0254 1964  Tosrfcom - ok
19:48:30.0267 1964  [ 592CD9C8AB08EF02EA53905D30FB157E ] Tosrfhid        C:\Windows\system32\DRIVERS\Tosrfhid.sys
19:48:30.0292 1964  Tosrfhid - ok
19:48:30.0298 1964  [ 0F3FD4F55175CAEDDCE9EFD6C5CA45D3 ] tosrfnds        C:\Windows\system32\DRIVERS\tosrfnds.sys
19:48:30.0318 1964  tosrfnds - ok
19:48:30.0337 1964  [ F21031C35FE340A948FFDCA6DE74D333 ] TosRfSnd        C:\Windows\system32\drivers\tosrfsnd.sys
19:48:30.0349 1964  TosRfSnd - ok
19:48:30.0384 1964  [ C4245835D4FAC0494ED616F3BFE9EE0A ] Tosrfusb        C:\Windows\system32\DRIVERS\tosrfusb.sys
19:48:30.0406 1964  Tosrfusb - ok
19:48:30.0432 1964  [ C17EA46C3326A951DC3B8E883D661E0C ] TouchServicePen C:\Program Files\Tablet\Pen\Pen_TouchService.exe
19:48:30.0457 1964  TouchServicePen - ok
19:48:30.0489 1964  [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks          C:\Windows\System32\trkwks.dll
19:48:30.0516 1964  TrkWks - ok
19:48:30.0568 1964  [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
19:48:30.0586 1964  TrustedInstaller - ok
19:48:30.0624 1964  [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
19:48:30.0648 1964  tssecsrv - ok
19:48:30.0697 1964  [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp          C:\Windows\system32\DRIVERS\tunmp.sys
19:48:30.0711 1964  tunmp - ok
19:48:30.0746 1964  [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
19:48:30.0759 1964  tunnel - ok
19:48:30.0782 1964  [ C3ADE15414120033A36C0F293D4A4121 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
19:48:30.0793 1964  uagp35 - ok
19:48:30.0825 1964  [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
19:48:30.0847 1964  udfs - ok
19:48:30.0879 1964  [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
19:48:30.0906 1964  UI0Detect - ok
19:48:30.0912 1964  [ 75E6890EBFCE0841D3291B02E7A8BDB0 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
19:48:30.0924 1964  uliagpkx - ok
19:48:30.0949 1964  [ 3CD4EA35A6221B85DCC25DAA46313F8D ] uliahci        C:\Windows\system32\drivers\uliahci.sys
19:48:30.0964 1964  uliahci - ok
19:48:30.0980 1964  [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata          C:\Windows\system32\drivers\ulsata.sys
19:48:30.0994 1964  UlSata - ok
19:48:31.0008 1964  [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2        C:\Windows\system32\drivers\ulsata2.sys
19:48:31.0021 1964  ulsata2 - ok
19:48:31.0043 1964  [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
19:48:31.0067 1964  umbus - ok
19:48:31.0101 1964  [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost        C:\Windows\System32\upnphost.dll
19:48:31.0130 1964  upnphost - ok
19:48:31.0186 1964  [ 8E9DCCB2BA19C959A8C3A344445BB954 ] USB28xxBGA      C:\Windows\system32\DRIVERS\emBDA.sys
19:48:31.0212 1964  USB28xxBGA - ok
19:48:31.0256 1964  [ DA617CA98704142F10938089DD0738A4 ] USB28xxOEM      C:\Windows\system32\DRIVERS\emOEM.sys
19:48:31.0281 1964  USB28xxOEM - ok
19:48:31.0320 1964  [ 32DB9517628FF0D070682AAB61E688F0 ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
19:48:31.0339 1964  usbaudio - ok
19:48:31.0344 1964  usbbus - ok
19:48:31.0381 1964  [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
19:48:31.0402 1964  usbccgp - ok
19:48:31.0445 1964  [ E9476E6C486E76BC4898074768FB7131 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
19:48:31.0485 1964  usbcir - ok
19:48:31.0490 1964  UsbDiag - ok
19:48:31.0531 1964  [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
19:48:31.0549 1964  usbehci - ok
19:48:31.0569 1964  [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
19:48:31.0590 1964  usbhub - ok
19:48:31.0609 1964  USBModem - ok
19:48:31.0633 1964  [ 38DBC7DD6CC5A72011F187425384388B ] usbohci        C:\Windows\system32\drivers\usbohci.sys
19:48:31.0671 1964  usbohci - ok
19:48:31.0693 1964  [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
19:48:31.0717 1964  usbprint - ok
19:48:31.0745 1964  [ A508C9BD8724980512136B039BBA65E9 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
19:48:31.0764 1964  usbscan - ok
19:48:31.0780 1964  [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
19:48:31.0799 1964  USBSTOR - ok
19:48:31.0820 1964  [ 814D653EFC4D48BE3B04A307ECEFF56F ] usbuhci        C:\Windows\system32\DRIVERS\usbuhci.sys
19:48:31.0839 1964  usbuhci - ok
19:48:31.0881 1964  [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
19:48:31.0908 1964  usbvideo - ok
19:48:31.0938 1964  [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms          C:\Windows\System32\uxsms.dll
19:48:31.0960 1964  UxSms - ok
19:48:31.0989 1964  [ CD88D1B7776DC17A119049742EC07EB4 ] vds            C:\Windows\System32\vds.exe
19:48:32.0020 1964  vds - ok
19:48:32.0049 1964  [ 7D92BE0028ECDEDEC74617009084B5EF ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
19:48:32.0088 1964  vga - ok
19:48:32.0119 1964  [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave        C:\Windows\System32\drivers\vga.sys
19:48:32.0144 1964  VgaSave - ok
19:48:32.0157 1964  [ 045D9961E591CF0674A920B6BA3BA5CB ] viaagp          C:\Windows\system32\drivers\viaagp.sys
19:48:32.0169 1964  viaagp - ok
19:48:32.0184 1964  [ 56A4DE5F02F2E88182B0981119B4DD98 ] ViaC7          C:\Windows\system32\drivers\viac7.sys
19:48:32.0224 1964  ViaC7 - ok
19:48:32.0236 1964  [ FD2E3175FCADA350C7AB4521DCA187EC ] viaide          C:\Windows\system32\drivers\viaide.sys
19:48:32.0248 1964  viaide - ok
19:48:32.0257 1964  [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
19:48:32.0271 1964  volmgr - ok
19:48:32.0303 1964  [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
19:48:32.0322 1964  volmgrx - ok
19:48:32.0356 1964  [ 147281C01FCB1DF9252DE2A10D5E7093 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
19:48:32.0373 1964  volsnap - ok
19:48:32.0389 1964  [ D984439746D42B30FC65A4C3546C6829 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
19:48:32.0402 1964  vsmraid - ok
19:48:32.0457 1964  [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS            C:\Windows\system32\vssvc.exe
19:48:32.0533 1964  VSS - ok
19:48:32.0574 1964  [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time        C:\Windows\system32\w32time.dll
19:48:32.0599 1964  W32Time - ok
19:48:32.0652 1964  [ 427A8BC96F16C40DF81C2D2F4EDD32DD ] wacommousefilter C:\Windows\system32\DRIVERS\wacommousefilter.sys
19:48:32.0664 1964  wacommousefilter - ok
19:48:32.0675 1964  [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
19:48:32.0724 1964  WacomPen - ok
19:48:32.0769 1964  [ 846B58EA44BF8C92E4B59F4E2252C4C0 ] wacomvhid      C:\Windows\system32\DRIVERS\wacomvhid.sys
19:48:32.0779 1964  wacomvhid - ok
19:48:32.0803 1964  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp          C:\Windows\system32\DRIVERS\wanarp.sys
19:48:32.0823 1964  Wanarp - ok
19:48:32.0826 1964  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
19:48:32.0847 1964  Wanarpv6 - ok
19:48:32.0867 1964  [ A3CD60FD826381B49F03832590E069AF ] wcncsvc        C:\Windows\System32\wcncsvc.dll
19:48:32.0895 1964  wcncsvc - ok
19:48:32.0924 1964  [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
19:48:32.0946 1964  WcsPlugInService - ok
19:48:32.0965 1964  [ AFC5AD65B991C1E205CF25CFDBF7A6F4 ] Wd              C:\Windows\system32\drivers\wd.sys
19:48:32.0977 1964  Wd - ok
19:48:33.0018 1964  [ B6F0A7AD6D4BD325FBCD8BAC96CD8D96 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
19:48:33.0045 1964  Wdf01000 - ok
19:48:33.0074 1964  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost  C:\Windows\system32\wdi.dll
19:48:33.0101 1964  WdiServiceHost - ok
19:48:33.0105 1964  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost  C:\Windows\system32\wdi.dll
19:48:33.0131 1964  WdiSystemHost - ok
19:48:33.0166 1964  [ 04C37D8107320312FBAE09926103D5E2 ] WebClient      C:\Windows\System32\webclnt.dll
19:48:33.0185 1964  WebClient - ok
19:48:33.0216 1964  [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc          C:\Windows\system32\wecsvc.dll
19:48:33.0240 1964  Wecsvc - ok
19:48:33.0272 1964  [ 670FF720071ED741206D69BD995EA453 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
19:48:33.0293 1964  wercplsupport - ok
19:48:33.0326 1964  [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc          C:\Windows\System32\WerSvc.dll
19:48:33.0349 1964  WerSvc - ok
19:48:33.0402 1964  [ 4575AA12561C5648483403541D0D7F2B ] WinDefend      C:\Program Files\Windows Defender\mpsvc.dll
19:48:33.0420 1964  WinDefend - ok
19:48:33.0430 1964  WinHttpAutoProxySvc - ok
19:48:33.0472 1964  [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
19:48:33.0493 1964  Winmgmt - ok
19:48:33.0577 1964  [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM          C:\Windows\system32\WsmSvc.dll
19:48:33.0654 1964  WinRM - ok
19:48:33.0701 1964  [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc        C:\Windows\System32\wlansvc.dll
19:48:33.0741 1964  Wlansvc - ok
19:48:33.0866 1964  [ FB01D4AE207B9EFDBABFC55DC95C7E31 ] wlidsvc        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
19:48:33.0971 1964  wlidsvc - ok
19:48:33.0988 1964  [ 701A9F884A294327E9141D73746EE279 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
19:48:34.0027 1964  WmiAcpi - ok
19:48:34.0065 1964  [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
19:48:34.0086 1964  wmiApSrv - ok
19:48:34.0156 1964  [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc  C:\Program Files\Windows Media Player\wmpnetwk.exe
19:48:34.0222 1964  WMPNetworkSvc - ok
19:48:34.0255 1964  [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
19:48:34.0273 1964  WPCSvc - ok
19:48:34.0316 1964  [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
19:48:34.0332 1964  WPDBusEnum - ok
19:48:34.0358 1964  [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb          C:\Windows\system32\DRIVERS\wpdusb.sys
19:48:34.0371 1964  WpdUsb - ok
19:48:34.0484 1964  [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
19:48:34.0526 1964  WPFFontCache_v0400 - ok
19:48:34.0552 1964  [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
19:48:34.0576 1964  ws2ifsl - ok
19:48:34.0601 1964  [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc          C:\Windows\system32\wscsvc.dll
19:48:34.0618 1964  wscsvc - ok
19:48:34.0623 1964  WSearch - ok
19:48:34.0695 1964  [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv        C:\Windows\system32\wuaueng.dll
19:48:34.0804 1964  wuauserv - ok
19:48:34.0833 1964  [ AC13CB789D93412106B0FB6C7EB2BCB6 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
19:48:34.0857 1964  WUDFRd - ok
19:48:34.0887 1964  [ 575A4190D989F64732119E4114045A4F ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
19:48:34.0914 1964  wudfsvc - ok
19:48:34.0950 1964  ================ Scan global ===============================
19:48:34.0975 1964  [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
19:48:35.0018 1964  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
19:48:35.0051 1964  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
19:48:35.0088 1964  [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
19:48:35.0094 1964  [Global] - ok
19:48:35.0095 1964  ================ Scan MBR ==================================
19:48:35.0114 1964  [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
19:48:35.0452 1964  \Device\Harddisk0\DR0 - ok
19:48:35.0452 1964  ================ Scan VBR ==================================
19:48:35.0455 1964  [ 7CCBAD47AC4B33D7414CB9723352E35C ] \Device\Harddisk0\DR0\Partition1
19:48:35.0458 1964  \Device\Harddisk0\DR0\Partition1 - ok
19:48:35.0483 1964  [ 505F3AF4599D00C2B0EFFA7141E4B5BC ] \Device\Harddisk0\DR0\Partition2
19:48:35.0485 1964  \Device\Harddisk0\DR0\Partition2 - ok
19:48:35.0485 1964  ============================================================
19:48:35.0485 1964  Scan finished
19:48:35.0485 1964  ============================================================
19:48:35.0498 5792  Detected object count: 8
19:48:35.0498 5792  Actual detected object count: 8

cosinus 21.11.2012 21:15
Log vom TDSS-Killer ist unvollständig

aupex 21.11.2012 21:22
Keine Ahnung warum... :confused:

Code:
19:47:36.0332 3992  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
19:47:36.0562 3992  ============================================================
19:47:36.0562 3992  Current date / time: 2012/11/21 19:47:36.0562
19:47:36.0562 3992  SystemInfo:
19:47:36.0562 3992 
19:47:36.0562 3992  OS Version: 6.0.6002 ServicePack: 2.0
19:47:36.0562 3992  Product type: Workstation
19:47:36.0562 3992  ComputerName: STEFANLAPTOP
19:47:36.0563 3992  UserName: Aupex
19:47:36.0563 3992  Windows directory: C:\Windows
19:47:36.0563 3992  System windows directory: C:\Windows
19:47:36.0563 3992  Processor architecture: Intel x86
19:47:36.0563 3992  Number of processors: 2
19:47:36.0563 3992  Page size: 0x1000
19:47:36.0563 3992  Boot type: Normal boot
19:47:36.0563 3992  ============================================================
19:47:38.0293 3992  Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
19:47:38.0358 3992  ============================================================
19:47:38.0358 3992  \Device\Harddisk0\DR0:
19:47:38.0372 3992  MBR partitions:
19:47:38.0372 3992  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xBB86BD, BlocksNum 0x523E143
19:47:38.0372 3992  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x5DF6800, BlocksNum 0x173CE000
19:47:38.0372 3992  ============================================================
19:47:38.0496 3992  C: <-> \Device\Harddisk0\DR0\Partition1
19:47:38.0646 3992  D: <-> \Device\Harddisk0\DR0\Partition2
19:47:38.0646 3992  ============================================================
19:47:38.0647 3992  Initialize success
19:47:38.0647 3992  ============================================================
19:48:04.0118 1964  ============================================================
19:48:04.0119 1964  Scan started
19:48:04.0119 1964  Mode: Manual; SigCheck; TDLFS;
19:48:04.0119 1964  ============================================================
19:48:04.0818 1964  ================ Scan system memory ========================
19:48:04.0818 1964  System memory - ok
19:48:04.0818 1964  ================ Scan services =============================
19:48:04.0948 1964  [ 01E81C84AD1D0ACC61CF3CFD06632210 ] !SASCORE        D:\Program Files\suparaasyp\SASCORE.EXE
19:48:05.0039 1964  !SASCORE - ok
19:48:05.0199 1964  [ ADC420616C501B45D26C0FD3EF1E54E4 ] ACDaemon        C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
19:48:05.0239 1964  ACDaemon - ok
19:48:05.0402 1964  [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI            C:\Windows\system32\drivers\acpi.sys
19:48:05.0423 1964  ACPI - ok
19:48:05.0503 1964  [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
19:48:05.0515 1964  AdobeARMservice - ok
19:48:05.0591 1964  [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
19:48:05.0604 1964  AdobeFlashPlayerUpdateSvc - ok
19:48:05.0649 1964  [ 2EDC5BBAC6C651ECE337BDE8ED97C9FB ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
19:48:05.0674 1964  adp94xx - ok
19:48:05.0729 1964  [ B84088CA3CDCA97DA44A984C6CE1CCAD ] adpahci        C:\Windows\system32\drivers\adpahci.sys
19:48:05.0745 1964  adpahci - ok
19:48:05.0763 1964  [ 7880C67BCCC27C86FD05AA2AFB5EA469 ] adpu160m        C:\Windows\system32\drivers\adpu160m.sys
19:48:05.0775 1964  adpu160m - ok
19:48:05.0790 1964  [ 9AE713F8E30EFC2ABCCD84904333DF4D ] adpu320        C:\Windows\system32\drivers\adpu320.sys
19:48:05.0804 1964  adpu320 - ok
19:48:05.0857 1964  [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
19:48:05.0879 1964  AeLookupSvc - ok
19:48:05.0927 1964  [ F132D0BFDE7C5EA1AB42325C5694A969 ] afcdp          C:\Windows\system32\DRIVERS\afcdp.sys
19:48:05.0940 1964  afcdp - ok
19:48:06.0065 1964  [ 986A134B1A1770599B7AF9354CBB066F ] afcdpsrv        C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
19:48:06.0192 1964  afcdpsrv - ok
19:48:06.0251 1964  [ 3911B972B55FEA0478476B2E777B29FA ] AFD            C:\Windows\system32\drivers\afd.sys
19:48:06.0273 1964  AFD - ok
19:48:06.0318 1964  [ 39E435C90C9C4F780FA0ED05CA3C3A1B ] AgereModemAudio C:\Windows\system32\agrsmsvc.exe
19:48:06.0332 1964  AgereModemAudio - ok
19:48:06.0382 1964  [ CE91B158FA490CF4C4D487A4130F4660 ] AgereSoftModem  C:\Windows\system32\DRIVERS\AGRSM.sys
19:48:06.0458 1964  AgereSoftModem - ok
19:48:06.0489 1964  [ EF23439CDD587F64C2C1B8825CEAD7D8 ] agp440          C:\Windows\system32\drivers\agp440.sys
19:48:06.0501 1964  agp440 - ok
19:48:06.0534 1964  [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx        C:\Windows\system32\drivers\djsvs.sys
19:48:06.0547 1964  aic78xx - ok
19:48:06.0574 1964  [ A1545B731579895D8CC44FC0481C1192 ] ALG            C:\Windows\System32\alg.exe
19:48:06.0600 1964  ALG - ok
19:48:06.0617 1964  [ 90395B64600EBB4552E26E178C94B2E4 ] aliide          C:\Windows\system32\drivers\aliide.sys
19:48:06.0630 1964  aliide - ok
19:48:06.0642 1964  [ 2B13E304C9DFDFA5EB582F6A149FA2C7 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
19:48:06.0654 1964  amdagp - ok
19:48:06.0673 1964  [ 0577DF1D323FE75A739C787893D300EA ] amdide          C:\Windows\system32\drivers\amdide.sys
19:48:06.0685 1964  amdide - ok
19:48:06.0719 1964  [ DC487885BCEF9F28EECE6FAC0E5DDFC5 ] AmdK7          C:\Windows\system32\drivers\amdk7.sys
19:48:06.0757 1964  AmdK7 - ok
19:48:06.0771 1964  [ 0CA0071DA4315B00FC1328CA86B425DA ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
19:48:06.0810 1964  AmdK8 - ok
19:48:06.0851 1964  [ DD8D9C597AF7CD2F6B70A3D6A4A1ACEA ] androidusb      C:\Windows\system32\Drivers\ssadadb.sys
19:48:06.0865 1964  androidusb - ok
19:48:06.0900 1964  [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo        C:\Windows\System32\appinfo.dll
19:48:06.0929 1964  Appinfo - ok
19:48:06.0971 1964  [ 5F673180268BB1FDB69C99B6619FE379 ] arc            C:\Windows\system32\drivers\arc.sys
19:48:06.0982 1964  arc - ok
19:48:07.0018 1964  [ 957F7540B5E7F602E44648C7DE5A1C05 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
19:48:07.0030 1964  arcsas - ok
19:48:07.0135 1964  [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
19:48:07.0148 1964  aspnet_state - ok
19:48:07.0190 1964  [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
19:48:07.0243 1964  AsyncMac - ok
19:48:07.0291 1964  [ 1F05B78AB91C9075565A9D8A4B880BC4 ] atapi          C:\Windows\system32\drivers\atapi.sys
19:48:07.0306 1964  atapi - ok
19:48:07.0362 1964  [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
19:48:07.0388 1964  AudioEndpointBuilder - ok
19:48:07.0406 1964  [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv        C:\Windows\System32\Audiosrv.dll
19:48:07.0428 1964  Audiosrv - ok
19:48:07.0596 1964  [ 38AE54966E8C0004F20965BBC00F74FB ] AVP            D:\Program Files\Kaspersky Security Suite CBE 12\avp.exe
19:48:07.0609 1964  AVP - ok
19:48:07.0654 1964  [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep            C:\Windows\system32\drivers\Beep.sys
19:48:07.0702 1964  Beep - ok
19:48:07.0767 1964  [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE            C:\Windows\System32\bfe.dll
19:48:07.0794 1964  BFE - ok
19:48:07.0858 1964  [ 93952506C6D67330367F7E7934B6A02F ] BITS            C:\Windows\system32\qmgr.dll
19:48:07.0905 1964  BITS - ok
19:48:07.0911 1964  blbdrive - ok
19:48:07.0993 1964  [ F832F1505AD8B83474BD9A5B1B985E01 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
19:48:08.0013 1964  Bonjour Service - ok
19:48:08.0045 1964  [ 35F376253F687BDE63976CCB3F2108CA ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
19:48:08.0059 1964  bowser - ok
19:48:08.0103 1964  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\Windows\system32\drivers\brfiltlo.sys
19:48:08.0123 1964  BrFiltLo - ok
19:48:08.0133 1964  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\Windows\system32\drivers\brfiltup.sys
19:48:08.0155 1964  BrFiltUp - ok
19:48:08.0184 1964  [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser        C:\Windows\System32\browser.dll
19:48:08.0209 1964  Browser - ok
19:48:08.0244 1964  [ B304E75CFF293029EDDF094246747113 ] Brserid        C:\Windows\system32\drivers\brserid.sys
19:48:08.0283 1964  Brserid - ok
19:48:08.0294 1964  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\Windows\system32\drivers\brserwdm.sys
19:48:08.0333 1964  BrSerWdm - ok
19:48:08.0349 1964  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\Windows\system32\drivers\brusbmdm.sys
19:48:08.0389 1964  BrUsbMdm - ok
19:48:08.0405 1964  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\Windows\system32\drivers\brusbser.sys
19:48:08.0443 1964  BrUsbSer - ok
19:48:08.0475 1964  [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
19:48:08.0516 1964  BTHMODEM - ok
19:48:08.0619 1964  catchme - ok
19:48:08.0674 1964  [ AFAB1D4CAB04218CBAB0AE69625D0D65 ] cbfs3          C:\Windows\system32\drivers\cbfs3.sys
19:48:08.0696 1964  cbfs3 - ok
19:48:08.0740 1964  [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
19:48:08.0767 1964  cdfs - ok
19:48:08.0811 1964  [ 6B4BFFB9BECD728097024276430DB314 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
19:48:08.0837 1964  cdrom - ok
19:48:08.0890 1964  [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc    C:\Windows\System32\certprop.dll
19:48:08.0913 1964  CertPropSvc - ok
19:48:08.0943 1964  [ E5D4133F37219DBCFE102BC61072589D ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
19:48:08.0973 1964  circlass - ok
19:48:09.0015 1964  [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS            C:\Windows\system32\CLFS.sys
19:48:09.0037 1964  CLFS - ok
19:48:09.0082 1964  [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
19:48:09.0097 1964  clr_optimization_v2.0.50727_32 - ok
19:48:09.0138 1964  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
19:48:09.0163 1964  clr_optimization_v4.0.30319_32 - ok
19:48:09.0195 1964  [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
19:48:09.0233 1964  CmBatt - ok
19:48:09.0259 1964  [ 45201046C776FFDAF3FC8A0029C581C8 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
19:48:09.0279 1964  cmdide - ok
19:48:09.0310 1964  [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
19:48:09.0330 1964  Compbatt - ok
19:48:09.0337 1964  COMSysApp - ok
19:48:09.0347 1964  [ 2A213AE086BBEC5E937553C7D9A2B22C ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
19:48:09.0366 1964  crcdisk - ok
19:48:09.0384 1964  [ 22A7F883508176489F559EE745B5BF5D ] Crusoe          C:\Windows\system32\drivers\crusoe.sys
19:48:09.0433 1964  Crusoe - ok
19:48:09.0491 1964  [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
19:48:09.0508 1964  CryptSvc - ok
19:48:09.0557 1964  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch      C:\Windows\system32\rpcss.dll
19:48:09.0602 1964  DcomLaunch - ok
19:48:09.0620 1964  [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
19:48:09.0636 1964  DfsC - ok
19:48:09.0736 1964  [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR            C:\Windows\system32\DFSR.exe
19:48:09.0852 1964  DFSR - ok
19:48:09.0917 1964  [ 9028559C132146FB75EB7ACF384B086A ] Dhcp            C:\Windows\System32\dhcpcsvc.dll
19:48:09.0939 1964  Dhcp - ok
19:48:09.0973 1964  [ 5D4AEFC3386920236A548271F8F1AF6A ] disk            C:\Windows\system32\drivers\disk.sys
19:48:09.0987 1964  disk - ok
19:48:10.0039 1964  [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache        C:\Windows\System32\dnsrslvr.dll
19:48:10.0054 1964  Dnscache - ok
19:48:10.0087 1964  [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc        C:\Windows\System32\dot3svc.dll
19:48:10.0108 1964  dot3svc - ok
19:48:10.0171 1964  [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS            C:\Windows\system32\dps.dll
19:48:10.0197 1964  DPS - ok
19:48:10.0220 1964  [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
19:48:10.0238 1964  drmkaud - ok
19:48:10.0282 1964  [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
19:48:10.0323 1964  DXGKrnl - ok
19:48:10.0352 1964  [ F88FB26547FD2CE6D0A5AF2985892C48 ] E1G60          C:\Windows\system32\DRIVERS\E1G60I32.sys
19:48:10.0392 1964  E1G60 - ok
19:48:10.0443 1964  [ C0B95E40D85CD807D614E264248A45B9 ] EapHost        C:\Windows\System32\eapsvc.dll
19:48:10.0514 1964  EapHost - ok
19:48:10.0559 1964  [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache          C:\Windows\system32\drivers\ecache.sys
19:48:10.0576 1964  Ecache - ok
19:48:10.0618 1964  [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
19:48:10.0648 1964  ehRecvr - ok
19:48:10.0672 1964  [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched        C:\Windows\ehome\ehsched.exe
19:48:10.0686 1964  ehSched - ok
19:48:10.0696 1964  [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart        C:\Windows\ehome\ehstart.dll
19:48:10.0709 1964  ehstart - ok
19:48:10.0756 1964  [ E8F3F21A71720C84BCF423B80028359F ] elxstor        C:\Windows\system32\drivers\elxstor.sys
19:48:10.0773 1964  elxstor - ok
19:48:10.0815 1964  [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt        C:\Windows\system32\emdmgmt.dll
19:48:10.0899 1964  EMDMgmt - ok
19:48:10.0935 1964  [ 29DCAEB81DDE6F154AA4D36B18ECBB1F ] enecir          C:\Windows\system32\DRIVERS\enecir.sys
19:48:10.0948 1964  enecir - ok
19:48:11.0004 1964  [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem    C:\Windows\system32\es.dll
19:48:11.0028 1964  EventSystem - ok
19:48:11.0099 1964  [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat          C:\Windows\system32\drivers\exfat.sys
19:48:11.0127 1964  exfat - ok
19:48:11.0196 1964  Fabs - ok
19:48:11.0232 1964  [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
19:48:11.0257 1964  fastfat - ok
19:48:11.0284 1964  [ 63BDADA84951B9C03E641800E176898A ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
19:48:11.0331 1964  fdc - ok
19:48:11.0365 1964  [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost        C:\Windows\system32\fdPHost.dll
19:48:11.0397 1964  fdPHost - ok
19:48:11.0442 1964  [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub        C:\Windows\system32\fdrespub.dll
19:48:11.0481 1964  FDResPub - ok
19:48:11.0509 1964  [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
19:48:11.0522 1964  FileInfo - ok
19:48:11.0548 1964  [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
19:48:11.0571 1964  Filetrace - ok
19:48:11.0680 1964  [ FFF1130F7C9FA01D093A1EDFC5CCE8FC ] FirebirdServerMAGIXInstance C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
19:48:11.0827 1964  FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - warning
19:48:11.0827 1964  FirebirdServerMAGIXInstance - detected UnsignedFile.Multi.Generic (1)
19:48:11.0886 1964  [ ABEDFD48AC042C6AAAD32452E77217A1 ] FLEXnet Licensing Service C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
19:48:11.0941 1964  FLEXnet Licensing Service - ok
19:48:11.0971 1964  [ 6603957EFF5EC62D25075EA8AC27DE68 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
19:48:12.0010 1964  flpydisk - ok
19:48:12.0044 1964  [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
19:48:12.0064 1964  FltMgr - ok
19:48:12.0139 1964  [ 8CE364388C8ECA59B14B539179276D44 ] FontCache      C:\Windows\system32\FntCache.dll
19:48:12.0219 1964  FontCache - ok
19:48:12.0277 1964  [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
19:48:12.0289 1964  FontCache3.0.0.0 - ok
19:48:12.0319 1964  [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
19:48:12.0333 1964  Fs_Rec - ok
19:48:12.0372 1964  [ AAE37F0F2F613218DCE17B42A18C38DB ] FTDIBUS        C:\Windows\system32\drivers\ftdibus.sys
19:48:12.0382 1964  FTDIBUS - ok
19:48:12.0417 1964  [ 48BFD1BA45C9C9E7AB339E25ABFBA1D2 ] FTSER2K        C:\Windows\system32\drivers\ftser2k.sys
19:48:12.0426 1964  FTSER2K - ok
19:48:12.0458 1964  [ 4E1CD0A45C50A8882616CAE5BF82F3C5 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
19:48:12.0470 1964  gagp30kx - ok
19:48:12.0547 1964  [ 0879DC7444A201DF84E69C5DD5083D61 ] getPlusHelper  C:\Program Files\NOS\bin\getPlus_Helper.dll
19:48:12.0559 1964  getPlusHelper - ok
19:48:12.0615 1964  [ 007AEA2E06E7CEF7372E40C277163959 ] ggflt          C:\Windows\system32\DRIVERS\ggflt.sys
19:48:12.0626 1964  ggflt - ok
19:48:12.0676 1964  [ C73DE35960CA75C5AB4AE636B127C64E ] ggsemc          C:\Windows\system32\DRIVERS\ggsemc.sys
19:48:12.0686 1964  ggsemc - ok
19:48:12.0733 1964  [ 77EBF3E9386DAA51551AF429052D88D0 ] giveio          C:\Windows\system32\giveio.sys
19:48:12.0737 1964  giveio ( UnsignedFile.Multi.Generic ) - warning
19:48:12.0738 1964  giveio - detected UnsignedFile.Multi.Generic (1)
19:48:12.0775 1964  [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc          C:\Windows\System32\gpsvc.dll
19:48:12.0818 1964  gpsvc - ok
19:48:12.0919 1964  [ F02A533F517EB38333CB12A9E8963773 ] gupdate        C:\Program Files\Google\Update\GoogleUpdate.exe
19:48:12.0932 1964  gupdate - ok
19:48:12.0953 1964  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
19:48:12.0963 1964  gupdatem - ok
19:48:13.0012 1964  [ 3F90E001369A07243763BD5A523D8722 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
19:48:13.0040 1964  HdAudAddService - ok
19:48:13.0087 1964  [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
19:48:13.0118 1964  HDAudBus - ok
19:48:13.0149 1964  [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth          C:\Windows\system32\drivers\hidbth.sys
19:48:13.0188 1964  HidBth - ok
19:48:13.0208 1964  [ D8DF3722D5E961BAA1292AA2F12827E2 ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
19:48:13.0226 1964  HidIr - ok
19:48:13.0256 1964  [ 84067081F3318162797385E11A8F0582 ] hidserv        C:\Windows\System32\hidserv.dll
19:48:13.0271 1964  hidserv - ok
19:48:13.0305 1964  [ CCA4B519B17E23A00B826C55716809CC ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
19:48:13.0324 1964  HidUsb - ok
19:48:13.0342 1964  [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc          C:\Windows\system32\kmsvc.dll
19:48:13.0368 1964  hkmsvc - ok
19:48:13.0430 1964  [ 9E05F872290E5595AFD4871CDEE550A3 ] hotcore3        C:\Windows\system32\DRIVERS\hotcore3.sys
19:48:13.0441 1964  hotcore3 - ok
19:48:13.0454 1964  [ DF353B401001246853763C4B7AAA6F50 ] HpCISSs        C:\Windows\system32\drivers\hpcisss.sys
19:48:13.0469 1964  HpCISSs - ok
19:48:13.0509 1964  [ F870AA3E254628EBEAFE754108D664DE ] HTTP            C:\Windows\system32\drivers\HTTP.sys
19:48:13.0562 1964  HTTP - ok
19:48:13.0574 1964  [ 324C2152FF2C61ABAE92D09F3CCA4D63 ] i2omp          C:\Windows\system32\drivers\i2omp.sys
19:48:13.0586 1964  i2omp - ok
19:48:13.0640 1964  [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
19:48:13.0661 1964  i8042prt - ok
19:48:13.0676 1964  [ C957BF4B5D80B46C5017BF0101E6C906 ] iaStorV        C:\Windows\system32\drivers\iastorv.sys
19:48:13.0692 1964  iaStorV - ok
19:48:13.0854 1964  [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT        C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
19:48:13.0884 1964  IDriverT ( UnsignedFile.Multi.Generic ) - warning
19:48:13.0884 1964  IDriverT - detected UnsignedFile.Multi.Generic (1)
19:48:13.0960 1964  [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc          C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
19:48:14.0020 1964  idsvc - ok
19:48:14.0043 1964  [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
19:48:14.0054 1964  iirsp - ok
19:48:14.0145 1964  [ F82BC30BB2B608AF8B5540CDBAEA93A6 ] IJPLMSVC        C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
19:48:14.0160 1964  IJPLMSVC - ok
19:48:14.0197 1964  [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT          C:\Windows\System32\ikeext.dll
19:48:14.0227 1964  IKEEXT - ok
19:48:14.0313 1964  [ 97CAC2A7E92FFCB30C15101AB002ED30 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
19:48:14.0419 1964  IntcAzAudAddService - ok
19:48:14.0468 1964  [ 83AA759F3189E6370C30DE5DC5590718 ] intelide        C:\Windows\system32\drivers\intelide.sys
19:48:14.0481 1964  intelide - ok
19:48:14.0501 1964  [ 224191001E78C89DFA78924C3EA595FF ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
19:48:14.0526 1964  intelppm - ok
19:48:14.0551 1964  [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
19:48:14.0576 1964  IPBusEnum - ok
19:48:14.0607 1964  [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
19:48:14.0630 1964  IpFilterDriver - ok
19:48:14.0668 1964  [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
19:48:14.0686 1964  iphlpsvc - ok
19:48:14.0691 1964  IpInIp - ok
19:48:14.0714 1964  [ 40F34F8ABA2A015D780E4B09138B6C17 ] IPMIDRV        C:\Windows\system32\drivers\ipmidrv.sys
19:48:14.0752 1964  IPMIDRV - ok
19:48:14.0782 1964  [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT          C:\Windows\system32\DRIVERS\ipnat.sys
19:48:14.0806 1964  IPNAT - ok
19:48:14.0833 1964  [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
19:48:14.0856 1964  IRENUM - ok
19:48:14.0871 1964  [ 350FCA7E73CF65BCEF43FAE1E4E91293 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
19:48:14.0883 1964  isapnp - ok
19:48:14.0918 1964  [ 232FA340531D940AAC623B121A595034 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
19:48:14.0934 1964  iScsiPrt - ok
19:48:14.0945 1964  [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi        C:\Windows\system32\drivers\iteatapi.sys
19:48:14.0957 1964  iteatapi - ok
19:48:14.0971 1964  [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid        C:\Windows\system32\drivers\iteraid.sys
19:48:14.0983 1964  iteraid - ok
19:48:15.0023 1964  [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
19:48:15.0036 1964  kbdclass - ok
19:48:15.0063 1964  [ EDE59EC70E25C24581ADD1FBEC7325F7 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
19:48:15.0082 1964  kbdhid - ok
19:48:15.0113 1964  [ A3E186B4B935905B829219502557314E ] KeyIso          C:\Windows\system32\lsass.exe
19:48:15.0145 1964  KeyIso - ok
19:48:15.0176 1964  [ 186B54479D98E48AEE0E9ADA4B3C4D31 ] KL1            C:\Windows\system32\DRIVERS\kl1.sys
19:48:15.0189 1964  KL1 - ok
19:48:15.0203 1964  [ BF485BFBA13C0AB116701FD9C55324D0 ] kl2            C:\Windows\system32\DRIVERS\kl2.sys
19:48:15.0212 1964  kl2 - ok
19:48:15.0291 1964  [ AF04D0CE7939324E9A605B159295706C ] KLIF            C:\Windows\system32\DRIVERS\klif.sys
19:48:15.0319 1964  KLIF - ok
19:48:15.0331 1964  [ 6295A19003F935ECC6CCBE9E2376427B ] KLIM6          C:\Windows\system32\DRIVERS\klim6.sys
19:48:15.0342 1964  KLIM6 - ok
19:48:15.0360 1964  [ 3DE1771C135328420315E21DDE229BBA ] klmouflt        C:\Windows\system32\DRIVERS\klmouflt.sys
19:48:15.0371 1964  klmouflt - ok
19:48:15.0411 1964  [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
19:48:15.0436 1964  KSecDD - ok
19:48:15.0480 1964  [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm          C:\Windows\system32\msdtckrm.dll
19:48:15.0514 1964  KtmRm - ok
19:48:15.0552 1964  [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer    C:\Windows\System32\srvsvc.dll
19:48:15.0578 1964  LanmanServer - ok
19:48:15.0613 1964  [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
19:48:15.0631 1964  LanmanWorkstation - ok
19:48:15.0650 1964  Lavasoft Kernexplorer - ok
19:48:15.0697 1964  [ B7C19EC8B0DD7EFA58AD41FFEB8B8CDA ] Lbd            C:\Windows\system32\DRIVERS\Lbd.sys
19:48:15.0706 1964  Lbd - ok
19:48:15.0819 1964  [ 3AF6B73A3AD1FC37C5933441F66CEB91 ] LBTServ        C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
19:48:15.0831 1964  LBTServ - ok
19:48:15.0862 1964  LgBttPort - ok
19:48:15.0869 1964  lgbusenum - ok
19:48:15.0875 1964  LGVMODEM - ok
19:48:15.0926 1964  [ 7F9C7B28CF1C859E1C42619EEA946DC8 ] LHidFilt        C:\Windows\system32\DRIVERS\LHidFilt.Sys
19:48:15.0936 1964  LHidFilt - ok
19:48:15.0963 1964  [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
19:48:15.0988 1964  lltdio - ok
19:48:16.0024 1964  [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc        C:\Windows\System32\lltdsvc.dll
19:48:16.0050 1964  lltdsvc - ok
19:48:16.0073 1964  [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts        C:\Windows\System32\lmhsvc.dll
19:48:16.0113 1964  lmhosts - ok
19:48:16.0147 1964  [ AB33792A87285344F43B5CE23421BAB0 ] LMouFilt        C:\Windows\system32\DRIVERS\LMouFilt.Sys
19:48:16.0158 1964  LMouFilt - ok
19:48:16.0181 1964  [ A2262FB9F28935E862B4DB46438C80D2 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
19:48:16.0193 1964  LSI_FC - ok
19:48:16.0209 1964  [ 30D73327D390F72A62F32C103DAF1D6D ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
19:48:16.0222 1964  LSI_SAS - ok
19:48:16.0276 1964  [ E1E36FEFD45849A95F1AB81DE0159FE3 ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
19:48:16.0287 1964  LSI_SCSI - ok
19:48:16.0319 1964  [ 8F5C7426567798E62A3B3614965D62CC ] luafv          C:\Windows\system32\drivers\luafv.sys
19:48:16.0343 1964  luafv - ok
19:48:16.0388 1964  [ 77030525CD86A93F1AF34FA9B96D33CE ] LUsbFilt        C:\Windows\system32\Drivers\LUsbFilt.Sys
19:48:16.0400 1964  LUsbFilt - ok
19:48:16.0474 1964  [ 500D089CE760D83DA2B6CBA681AA9949 ] MBAMProtector  C:\Windows\system32\drivers\mbam.sys
19:48:16.0487 1964  MBAMProtector - ok
19:48:16.0599 1964  [ 85B16A92B117A5A800032ECD904B86DB ] MBAMScheduler  d:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
19:48:16.0616 1964  MBAMScheduler - ok
19:48:16.0683 1964  [ 20E2469DB709FC675E655CEAA11BE312 ] MBAMService    d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
19:48:16.0710 1964  MBAMService - ok
19:48:16.0831 1964  [ 92063C0AC741AD5DA57CE564E5913BF5 ] MCSWASVR        d:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe
19:48:16.0836 1964  MCSWASVR ( UnsignedFile.Multi.Generic ) - warning
19:48:16.0836 1964  MCSWASVR - detected UnsignedFile.Multi.Generic (1)
19:48:16.0870 1964  [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
19:48:16.0888 1964  Mcx2Svc - ok
19:48:16.0926 1964  [ D153B14FC6598EAE8422A2037553ADCE ] megasas        C:\Windows\system32\drivers\megasas.sys
19:48:16.0940 1964  megasas - ok
19:48:16.0971 1964  [ E5292521916CEA4937FBABCB1532F676 ] MGHwCtrl        C:\Windows\system32\drivers\MGHwCtrl.sys
19:48:16.0978 1964  MGHwCtrl ( UnsignedFile.Multi.Generic ) - warning
19:48:16.0978 1964  MGHwCtrl - detected UnsignedFile.Multi.Generic (1)
19:48:16.0998 1964  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS          C:\Windows\system32\mmcss.dll
19:48:17.0038 1964  MMCSS - ok
19:48:17.0062 1964  [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem          C:\Windows\system32\drivers\modem.sys
19:48:17.0101 1964  Modem - ok
19:48:17.0149 1964  [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
19:48:17.0177 1964  monitor - ok
19:48:17.0192 1964  [ 5BF6A1326A335C5298477754A506D263 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
19:48:17.0205 1964  mouclass - ok
19:48:17.0213 1964  [ 93B8D4869E12CFBE663915502900876F ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
19:48:17.0237 1964  mouhid - ok
19:48:17.0262 1964  [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr        C:\Windows\system32\drivers\mountmgr.sys
19:48:17.0275 1964  MountMgr - ok
19:48:17.0322 1964  [ 583A41F26278D9E0EA548163D6139397 ] mpio            C:\Windows\system32\drivers\mpio.sys
19:48:17.0334 1964  mpio - ok
19:48:17.0353 1964  [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
19:48:17.0373 1964  mpsdrv - ok
19:48:17.0413 1964  [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc          C:\Windows\system32\mpssvc.dll
19:48:17.0443 1964  MpsSvc - ok
19:48:17.0454 1964  [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x        C:\Windows\system32\drivers\mraid35x.sys
19:48:17.0467 1964  Mraid35x - ok
19:48:17.0504 1964  [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
19:48:17.0520 1964  MRxDAV - ok
19:48:17.0542 1964  [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
19:48:17.0557 1964  mrxsmb - ok
19:48:17.0587 1964  [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
19:48:17.0605 1964  mrxsmb10 - ok
19:48:17.0616 1964  [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
19:48:17.0630 1964  mrxsmb20 - ok
19:48:17.0642 1964  [ 742AED7939E734C36B7E8D6228CE26B7 ] msahci          C:\Windows\system32\drivers\msahci.sys
19:48:17.0654 1964  msahci - ok
19:48:17.0673 1964  [ 3FC82A2AE4CC149165A94699183D3028 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
19:48:17.0686 1964  msdsm - ok
19:48:17.0713 1964  [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC          C:\Windows\System32\msdtc.exe
19:48:17.0740 1964  MSDTC - ok
19:48:17.0772 1964  [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
19:48:17.0794 1964  Msfs - ok
19:48:17.0846 1964  [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
19:48:17.0858 1964  msisadrv - ok
19:48:17.0884 1964  [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
19:48:17.0909 1964  MSiSCSI - ok
19:48:17.0915 1964  msiserver - ok
19:48:17.0963 1964  [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
19:48:17.0987 1964  MSKSSRV - ok
19:48:18.0035 1964  [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
19:48:18.0059 1964  MSPCLOCK - ok
19:48:18.0081 1964  [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
19:48:18.0105 1964  MSPQM - ok
19:48:18.0136 1964  [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
19:48:18.0153 1964  MsRPC - ok
19:48:18.0174 1964  [ E384487CB84BE41D09711C30CA79646C ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
19:48:18.0188 1964  mssmbios - ok
19:48:18.0294 1964  MSSQL$JTLWAWI - ok
19:48:18.0336 1964  MSSQL$SQLEXPRESS - ok
19:48:18.0412 1964  [ 1D89EB4E2A99CABD4E81225F4F4C4B25 ] MSSQLServerADHelper C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
19:48:18.0425 1964  MSSQLServerADHelper - ok
19:48:18.0488 1964  [ F1761C8FB2B25A32C6D63E36BB88C3AE ] MSSQLServerADHelper100 C:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE
19:48:18.0500 1964  MSSQLServerADHelper100 - ok
19:48:18.0517 1964  [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
19:48:18.0541 1964  MSTEE - ok
19:48:18.0569 1964  [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup            C:\Windows\system32\Drivers\mup.sys
19:48:18.0581 1964  Mup - ok
19:48:18.0614 1964  [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent        C:\Windows\system32\qagentRT.dll
19:48:18.0640 1964  napagent - ok
19:48:18.0676 1964  [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
19:48:18.0693 1964  NativeWifiP - ok
19:48:18.0743 1964  [ 13AA2130F2A104DD775EAD0F0EE5417B ] NAUpdate        C:\Program Files\Nero\Update\NASvc.exe
19:48:18.0781 1964  NAUpdate - ok
19:48:18.0847 1964  [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS            C:\Windows\system32\drivers\ndis.sys
19:48:18.0874 1964  NDIS - ok
19:48:18.0904 1964  [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
19:48:18.0924 1964  NdisTapi - ok
19:48:18.0980 1964  [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
19:48:19.0003 1964  Ndisuio - ok
19:48:19.0037 1964  [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
19:48:19.0058 1964  NdisWan - ok
19:48:19.0077 1964  [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
19:48:19.0097 1964  NDProxy - ok
19:48:19.0110 1964  [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
19:48:19.0133 1964  NetBIOS - ok
19:48:19.0164 1964  [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt          C:\Windows\system32\DRIVERS\netbt.sys
19:48:19.0187 1964  netbt - ok
19:48:19.0192 1964  [ A3E186B4B935905B829219502557314E ] Netlogon        C:\Windows\system32\lsass.exe
19:48:19.0206 1964  Netlogon - ok
19:48:19.0234 1964  [ C8052711DAECC48B982434C5116CA401 ] Netman          C:\Windows\System32\netman.dll
19:48:19.0263 1964  Netman - ok
19:48:19.0298 1964  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
19:48:19.0311 1964  NetMsmqActivator - ok
19:48:19.0316 1964  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
19:48:19.0328 1964  NetPipeActivator - ok
19:48:19.0355 1964  [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm        C:\Windows\System32\netprofm.dll
19:48:19.0386 1964  netprofm - ok
19:48:19.0392 1964  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
19:48:19.0407 1964  NetTcpActivator - ok
19:48:19.0413 1964  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
19:48:19.0429 1964  NetTcpPortSharing - ok
19:48:19.0523 1964  [ CB3AF516A6797B27725E3F1E73F3496C ] NETw4v32        C:\Windows\system32\DRIVERS\NETw4v32.sys
19:48:19.0663 1964  NETw4v32 - ok
19:48:19.0674 1964  [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
19:48:19.0689 1964  nfrd960 - ok
19:48:19.0703 1964  [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc          C:\Windows\System32\nlasvc.dll
19:48:19.0737 1964  NlaSvc - ok
19:48:19.0780 1964  [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
19:48:19.0804 1964  Npfs - ok
19:48:19.0833 1964  [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi            C:\Windows\system32\nsisvc.dll
19:48:19.0864 1964  nsi - ok
19:48:19.0895 1964  [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
19:48:19.0924 1964  nsiproxy - ok
19:48:19.0983 1964  [ 6A4A98CEE84CF9E99564510DDA4BAA47 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
19:48:20.0066 1964  Ntfs - ok
19:48:20.0093 1964  [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi      C:\Windows\system32\drivers\ntrigdigi.sys
19:48:20.0140 1964  ntrigdigi - ok
19:48:20.0171 1964  [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null            C:\Windows\system32\drivers\Null.sys
19:48:20.0199 1964  Null - ok
19:48:20.0493 1964  [ 4152708C0C24E30DAE7FA87D5AFE1D7B ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
19:48:21.0014 1964  nvlddmkm - ok
19:48:21.0037 1964  [ E69E946F80C1C31C53003BFBF50CBB7C ] nvraid          C:\Windows\system32\drivers\nvraid.sys
19:48:21.0050 1964  nvraid - ok
19:48:21.0060 1964  [ 9E0BA19A28C498A6D323D065DB76DFFC ] nvstor          C:\Windows\system32\drivers\nvstor.sys
19:48:21.0072 1964  nvstor - ok
19:48:21.0117 1964  [ 26DB28B32E8D2F57CB5065A4A053801A ] nvsvc          C:\Windows\system32\nvvsvc.exe
19:48:21.0152 1964  nvsvc - ok
19:48:21.0195 1964  [ 07C186427EB8FCC3D8D7927187F260F7 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
19:48:21.0208 1964  nv_agp - ok
19:48:21.0213 1964  NwlnkFlt - ok
19:48:21.0219 1964  NwlnkFwd - ok
19:48:21.0310 1964  [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv          C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
19:48:21.0333 1964  odserv - ok
19:48:21.0395 1964  [ 6F310E890D46E246E0E261A63D9B36B4 ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
19:48:21.0415 1964  ohci1394 - ok
19:48:21.0477 1964  [ 5A432A042DAE460ABE7199B758E8606C ] ose            C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
19:48:21.0490 1964  ose - ok
19:48:21.0524 1964  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc        C:\Windows\system32\p2psvc.dll
19:48:21.0565 1964  p2pimsvc - ok
19:48:21.0578 1964  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc          C:\Windows\system32\p2psvc.dll
19:48:21.0604 1964  p2psvc - ok
19:48:21.0624 1964  [ 0FA9B5055484649D63C303FE404E5F4D ] Parport        C:\Windows\system32\drivers\parport.sys
19:48:21.0663 1964  Parport - ok
19:48:21.0698 1964  [ B9C2B89F08670E159F7181891E449CD9 ] partmgr        C:\Windows\system32\drivers\partmgr.sys
19:48:21.0711 1964  partmgr - ok
19:48:21.0727 1964  [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm          C:\Windows\system32\drivers\parvdm.sys
19:48:21.0765 1964  Parvdm - ok
19:48:21.0776 1964  [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc          C:\Windows\System32\pcasvc.dll
19:48:21.0808 1964  PcaSvc - ok
19:48:21.0848 1964  [ 941DC1D19E7E8620F40BBC206981EFDB ] pci            C:\Windows\system32\drivers\pci.sys
19:48:21.0863 1964  pci - ok
19:48:21.0873 1964  [ 3B1901E401473E03EB8C874271E50C26 ] pciide          C:\Windows\system32\drivers\pciide.sys
19:48:21.0886 1964  pciide - ok
19:48:21.0899 1964  [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
19:48:21.0914 1964  pcmcia - ok
19:48:21.0964 1964  [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
19:48:22.0046 1964  PEAUTH - ok
19:48:22.0117 1964  [ B1689DF169143F57053F795390C99DB3 ] pla            C:\Windows\system32\pla.dll
19:48:22.0219 1964  pla - ok
19:48:22.0257 1964  [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
19:48:22.0281 1964  PlugPlay - ok
19:48:22.0331 1964  [ 205E1B699FD3F2F9B036EEA2EC30C620 ] PnkBstrA        C:\Windows\system32\PnkBstrA.exe
19:48:22.0345 1964  PnkBstrA - ok
19:48:22.0369 1964  [ 7C01817ADF3207FB65A4B56E6D5AD833 ] PnkBstrB        C:\Windows\system32\PnkBstrB.exe
19:48:22.0386 1964  PnkBstrB - ok
19:48:22.0415 1964  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg    C:\Windows\system32\p2psvc.dll
19:48:22.0446 1964  PNRPAutoReg - ok
19:48:22.0481 1964  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc        C:\Windows\system32\p2psvc.dll
19:48:22.0512 1964  PNRPsvc - ok
19:48:22.0548 1964  [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
19:48:22.0582 1964  PolicyAgent - ok
19:48:22.0601 1964  [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
19:48:22.0630 1964  PptpMiniport - ok
19:48:22.0665 1964  [ 0E3CEF5D28B40CF273281D620C50700A ] Processor      C:\Windows\system32\drivers\processr.sys
19:48:22.0709 1964  Processor - ok
19:48:22.0743 1964  [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc        C:\Windows\system32\profsvc.dll
19:48:22.0766 1964  ProfSvc - ok
19:48:22.0782 1964  [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
19:48:22.0797 1964  ProtectedStorage - ok
19:48:22.0820 1964  [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched          C:\Windows\system32\DRIVERS\pacer.sys
19:48:22.0840 1964  PSched - ok
19:48:22.0891 1964  [ D24DFD16A1E2A76034DF5AA18125C35D ] PSI            C:\Windows\system32\DRIVERS\psi_mf.sys
19:48:22.0900 1964  PSI - ok
19:48:22.0948 1964  [ 681AE4F1927FE0FDEEE2863F1684088D ] pwdrvio        C:\Windows\system32\pwdrvio.sys
19:48:22.0962 1964  pwdrvio - ok
19:48:22.0983 1964  [ BC60895CE021309EBD887D2F22055654 ] pwdspio        C:\Windows\system32\pwdspio.sys
19:48:22.0996 1964  pwdspio - ok
19:48:23.0028 1964  [ E42E3433DBB4CFFE8FDD91EAB29AEA8E ] PxHelp20        C:\Windows\system32\Drivers\PxHelp20.sys
19:48:23.0039 1964  PxHelp20 - ok
19:48:23.0093 1964  [ CCDAC889326317792480C0A67156A1EC ] ql2300          C:\Windows\system32\drivers\ql2300.sys
19:48:23.0157 1964  ql2300 - ok
19:48:23.0185 1964  [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
19:48:23.0197 1964  ql40xx - ok
19:48:23.0223 1964  [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE          C:\Windows\system32\qwave.dll
19:48:23.0242 1964  QWAVE - ok
19:48:23.0272 1964  [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
19:48:23.0285 1964  QWAVEdrv - ok
19:48:23.0304 1964  [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
19:48:23.0327 1964  RasAcd - ok
19:48:23.0352 1964  [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto        C:\Windows\System32\rasauto.dll
19:48:23.0379 1964  RasAuto - ok
19:48:23.0398 1964  [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
19:48:23.0423 1964  Rasl2tp - ok
19:48:23.0453 1964  [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan          C:\Windows\System32\rasmans.dll
19:48:23.0477 1964  RasMan - ok
19:48:23.0507 1964  [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
19:48:23.0526 1964  RasPppoe - ok
19:48:23.0553 1964  [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
19:48:23.0567 1964  RasSstp - ok
19:48:23.0597 1964  [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
19:48:23.0619 1964  rdbss - ok
19:48:23.0654 1964  [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
19:48:23.0678 1964  RDPCDD - ok
19:48:23.0713 1964  [ E8BD98D46F2ED77132BA927FCCB47D8B ] rdpdr          C:\Windows\system32\drivers\rdpdr.sys
19:48:23.0754 1964  rdpdr - ok
19:48:23.0761 1964  [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
19:48:23.0784 1964  RDPENCDD - ok
19:48:23.0820 1964  [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
19:48:23.0836 1964  RDPWD - ok
19:48:23.0877 1964  [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess    C:\Windows\System32\mprdim.dll
19:48:23.0903 1964  RemoteAccess - ok
19:48:23.0930 1964  [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry  C:\Windows\system32\regsvc.dll
19:48:23.0957 1964  RemoteRegistry - ok
19:48:23.0977 1964  [ 355AAC141B214BEF1DBC1483AFD9BD50 ] rimmptsk        C:\Windows\system32\DRIVERS\rimmptsk.sys
19:48:23.0992 1964  rimmptsk - ok
19:48:24.0008 1964  [ A4216C71DD4F60B26418CCFD99CD0815 ] rimsptsk        C:\Windows\system32\DRIVERS\rimsptsk.sys
19:48:24.0020 1964  rimsptsk - ok
19:48:24.0072 1964  [ 75E8A6BFA7374ABA833AE92BF41AE4E6 ] ROOTMODEM      C:\Windows\system32\Drivers\RootMdm.sys
19:48:24.0096 1964  ROOTMODEM - ok
19:48:24.0115 1964  [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator      C:\Windows\system32\locator.exe
19:48:24.0139 1964  RpcLocator - ok
19:48:24.0178 1964  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs          C:\Windows\system32\rpcss.dll
19:48:24.0206 1964  RpcSs - ok
19:48:24.0255 1964  [ FD692C6FFADE58F7C4C3C3C9A0EC35BD ] RsFx0103        C:\Windows\system32\DRIVERS\RsFx0103.sys
19:48:24.0269 1964  RsFx0103 - ok
19:48:24.0300 1964  [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
19:48:24.0324 1964  rspndr - ok
19:48:24.0337 1964  [ B7E1C523E2F7787D700766FC78E01F77 ] RTL8169        C:\Windows\system32\DRIVERS\Rtlh86.sys
19:48:24.0373 1964  RTL8169 - ok
19:48:24.0413 1964  [ 59509AD6CBC28F2C73056268985B3E48 ] s0016bus        C:\Windows\system32\DRIVERS\s0016bus.sys
19:48:24.0424 1964  s0016bus - ok
19:48:24.0433 1964  [ B98C3A6F91F4FBA285AF9606A240C6B4 ] s0016mdfl      C:\Windows\system32\DRIVERS\s0016mdfl.sys
19:48:24.0443 1964  s0016mdfl - ok
19:48:24.0464 1964  [ 8A83426F4FB7B5212825D9DE76368B1A ] s0016mdm        C:\Windows\system32\DRIVERS\s0016mdm.sys
19:48:24.0476 1964  s0016mdm - ok
19:48:24.0498 1964  [ 7A78BBA97FEB5E6D24C49E93A3BF7287 ] s0016mgmt      C:\Windows\system32\DRIVERS\s0016mgmt.sys
19:48:24.0510 1964  s0016mgmt - ok
19:48:24.0542 1964  [ 34EF7B5F611957B73E7219DD5A222AD1 ] s0016nd5        C:\Windows\system32\DRIVERS\s0016nd5.sys
19:48:24.0552 1964  s0016nd5 - ok
19:48:24.0565 1964  [ 36792935847143E4A3CDA0DC87248487 ] s0016obex      C:\Windows\system32\DRIVERS\s0016obex.sys
19:48:24.0577 1964  s0016obex - ok
19:48:24.0601 1964  [ 927208754FB27FC3E7A659E77500C5D1 ] s0016unic      C:\Windows\system32\DRIVERS\s0016unic.sys
19:48:24.0612 1964  s0016unic - ok
19:48:24.0632 1964  [ C16D95BD9FDB381689053CB5ECAC9E40 ] SaiMini        C:\Windows\system32\DRIVERS\SaiMini.sys
19:48:24.0642 1964  SaiMini - ok
19:48:24.0694 1964  [ E549BF8B944A6CC6356B322CBB83C796 ] SaiNtBus        C:\Windows\system32\drivers\SaiBus.sys
19:48:24.0705 1964  SaiNtBus - ok
19:48:24.0719 1964  [ A3E186B4B935905B829219502557314E ] SamSs          C:\Windows\system32\lsass.exe
19:48:24.0732 1964  SamSs - ok
19:48:24.0783 1964  [ 39763504067962108505BFF25F024345 ] SASDIFSV        D:\Program Files\suparaasyp\SASDIFSV.SYS
19:48:24.0793 1964  SASDIFSV - ok
19:48:24.0812 1964  [ 77B9FC20084B48408AD3E87570EB4A85 ] SASKUTIL        D:\Program Files\suparaasyp\SASKUTIL.SYS
19:48:24.0824 1964  SASKUTIL - ok
19:48:24.0885 1964  [ A07D4747A6EBF15968CF5C891709D8F6 ] SbieDrv        d:\Program Files\Sandboxie\SbieDrv.sys
19:48:24.0889 1964  SbieDrv ( UnsignedFile.Multi.Generic ) - warning
19:48:24.0889 1964  SbieDrv - detected UnsignedFile.Multi.Generic (1)
19:48:24.0893 1964  [ 2B2B6189DC47F44D7549519AA7519777 ] SbieSvc        d:\Program Files\Sandboxie\SbieSvc.exe
19:48:24.0898 1964  SbieSvc ( UnsignedFile.Multi.Generic ) - warning
19:48:24.0898 1964  SbieSvc - detected UnsignedFile.Multi.Generic (1)
19:48:24.0935 1964  [ 3CE8F073A557E172B330109436984E30 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
19:48:24.0947 1964  sbp2port - ok
19:48:24.0998 1964  [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
19:48:25.0020 1964  SCardSvr - ok
19:48:25.0062 1964  [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule        C:\Windows\system32\schedsvc.dll
19:48:25.0104 1964  Schedule - ok
19:48:25.0134 1964  [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc    C:\Windows\System32\certprop.dll
19:48:25.0155 1964  SCPolicySvc - ok
19:48:25.0188 1964  [ 8F36B54688C31EED4580129040C6A3D3 ] sdbus          C:\Windows\system32\DRIVERS\sdbus.sys
19:48:25.0209 1964  sdbus - ok
19:48:25.0237 1964  [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
19:48:25.0254 1964  SDRSVC - ok
19:48:25.0266 1964  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
19:48:25.0305 1964  secdrv - ok
19:48:25.0331 1964  [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon        C:\Windows\system32\seclogon.dll
19:48:25.0362 1964  seclogon - ok
19:48:25.0452 1964  [ 2D0599DD0124764FC939C59985C860DE ] Secunia PSI Agent d:\Program Files\Secunia\PSI\PSIA.exe
19:48:25.0512 1964  Secunia PSI Agent - ok
19:48:25.0551 1964  [ 20B9E1ADBC58958B480933E4DA005DFB ] Secunia Update Agent d:\Program Files\Secunia\PSI\sua.exe
19:48:25.0574 1964  Secunia Update Agent - ok
19:48:25.0649 1964  [ E5B56569A9F79B70314FEDE6C953641E ] seehcri        C:\Windows\system32\DRIVERS\seehcri.sys
19:48:25.0678 1964  seehcri - ok
19:48:25.0692 1964  [ A9BBAB5759771E523F55563D6CBE140F ] SENS            C:\Windows\system32\sens.dll
19:48:25.0734 1964  SENS - ok
19:48:25.0788 1964  [ 7BFC84F24CC12DE5C26BEA6AA4AFDEF5 ] Ser2pl          C:\Windows\system32\DRIVERS\ser2pl.sys
19:48:25.0808 1964  Ser2pl - ok
19:48:25.0832 1964  [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
19:48:25.0894 1964  Serenum - ok
19:48:25.0914 1964  [ C70D69A918B178D3C3B06339B40C2E1B ] Serial          C:\Windows\system32\drivers\serial.sys
19:48:25.0978 1964  Serial - ok
19:48:26.0000 1964  [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
19:48:26.0027 1964  sermouse - ok
19:48:26.0057 1964  [ D2193326F729B163125610DBF3E17D57 ] SessionEnv      C:\Windows\system32\sessenv.dll
19:48:26.0084 1964  SessionEnv - ok
19:48:26.0104 1964  [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk        C:\Windows\system32\DRIVERS\sffdisk.sys
19:48:26.0124 1964  sffdisk - ok
19:48:26.0133 1964  [ 8FD08A310645FE872EEEC6E08C6BF3EE ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
19:48:26.0173 1964  sffp_mmc - ok
19:48:26.0199 1964  [ 9F66A46C55D6F1CCABC79BB7AFCCC545 ] sffp_sd        C:\Windows\system32\DRIVERS\sffp_sd.sys
19:48:26.0218 1964  sffp_sd - ok
19:48:26.0228 1964  [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
19:48:26.0267 1964  sfloppy - ok
19:48:26.0295 1964  [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
19:48:26.0323 1964  SharedAccess - ok
19:48:26.0358 1964  [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
19:48:26.0378 1964  ShellHWDetection - ok
19:48:26.0392 1964  [ 7471CF7CBB4CC7D92FDB7F6527A9008C ] Si3531          C:\Windows\system32\DRIVERS\Si3531.sys
19:48:26.0409 1964  Si3531 - ok
19:48:26.0439 1964  [ 72CF151FB410E544904DBC7D7F29B796 ] SiFilter        C:\Windows\system32\DRIVERS\SiWinAcc.sys
19:48:26.0451 1964  SiFilter - ok
19:48:26.0471 1964  [ 41A59F484188BE629087BA391FF60D74 ] SiRemFil        C:\Windows\system32\DRIVERS\SiRemFil.sys
19:48:26.0482 1964  SiRemFil - ok
19:48:26.0503 1964  [ D2A595D6EEBEEAF4334F8E50EFBC9931 ] sisagp          C:\Windows\system32\drivers\sisagp.sys
19:48:26.0515 1964  sisagp - ok
19:48:26.0528 1964  [ CEDD6F4E7D84E9F98B34B3FE988373AA ] SiSRaid2        C:\Windows\system32\drivers\sisraid2.sys
19:48:26.0541 1964  SiSRaid2 - ok
19:48:26.0560 1964  [ DF843C528C4F69D12CE41CE462E973A7 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
19:48:26.0573 1964  SiSRaid4 - ok
19:48:26.0612 1964  [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate    C:\Program Files\Skype\Updater\Updater.exe
19:48:26.0626 1964  SkypeUpdate - ok
19:48:26.0733 1964  [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc          C:\Windows\system32\SLsvc.exe
19:48:26.0895 1964  slsvc - ok
19:48:26.0936 1964  [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify      C:\Windows\system32\SLUINotify.dll
19:48:26.0958 1964  SLUINotify - ok
19:48:26.0979 1964  [ 7B75299A4D201D6A6533603D6914AB04 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
19:48:26.0999 1964  Smb - ok
19:48:27.0057 1964  [ FFD9B64DB2CD7B74B766C3A8452A5816 ] snapman        C:\Windows\system32\DRIVERS\snapman.sys
19:48:27.0070 1964  snapman - ok
19:48:27.0097 1964  [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
19:48:27.0112 1964  SNMPTRAP - ok
19:48:27.0156 1964  [ 3FA2E254BFBCE52B3C6F1BF23AAB6911 ] speedfan        C:\Windows\system32\speedfan.sys
19:48:27.0169 1964  speedfan - ok
19:48:27.0196 1964  [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr          C:\Windows\system32\drivers\spldr.sys
19:48:27.0208 1964  spldr - ok
19:48:27.0240 1964  [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler        C:\Windows\System32\spoolsv.exe
19:48:27.0257 1964  Spooler - ok
19:48:27.0341 1964  [ 71E276F6D189413266EA22171806597B ] sptd            C:\Windows\System32\Drivers\sptd.sys
19:48:27.0382 1964  sptd - ok
19:48:27.0421 1964  [ A687B5B326AFCFCF182C4931D1FF9771 ] SQLAgent$SQLEXPRESS C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE
19:48:27.0443 1964  SQLAgent$SQLEXPRESS - ok
19:48:27.0491 1964  [ B54B48F6D92423440C264E91225C5FF1 ] SQLBrowser      C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
19:48:27.0507 1964  SQLBrowser - ok
19:48:27.0553 1964  [ 637A0F23F9012358E92E6F99835494D1 ] SQLWriter      C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
19:48:27.0567 1964  SQLWriter - ok
19:48:27.0611 1964  [ 41987F9FC0E61ADF54F581E15029AD91 ] srv            C:\Windows\system32\DRIVERS\srv.sys
19:48:27.0630 1964  srv - ok
19:48:27.0663 1964  [ FF33AFF99564B1AA534F58868CBE41EF ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
19:48:27.0678 1964  srv2 - ok
19:48:27.0692 1964  [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
19:48:27.0708 1964  srvnet - ok
19:48:27.0746 1964  [ 64E44ACD8C238FCBBB78F0BA4BDC4B05 ] ssadbus        C:\Windows\system32\DRIVERS\ssadbus.sys
19:48:27.0775 1964  ssadbus - ok
19:48:27.0790 1964  [ BB2C84A15C765DA89FD832B0E73F26CE ] ssadmdfl        C:\Windows\system32\DRIVERS\ssadmdfl.sys
19:48:27.0803 1964  ssadmdfl - ok
19:48:27.0821 1964  [ 6D0D132DDC6F43EDA00DCED6D8B1CA31 ] ssadmdm        C:\Windows\system32\DRIVERS\ssadmdm.sys
19:48:27.0839 1964  ssadmdm - ok
19:48:27.0857 1964  [ 1A5A397BC459F346AB56492B61EF79F6 ] ssadserd        C:\Windows\system32\DRIVERS\ssadserd.sys
19:48:27.0876 1964  ssadserd - ok
19:48:27.0909 1964  [ 069351A1D7D291013177A90AE6EDCCBC ] sscdbus        C:\Windows\system32\DRIVERS\sscdbus.sys
19:48:27.0922 1964  sscdbus - ok
19:48:27.0962 1964  [ 1C925BE223A5C0F9F469252292A48DF6 ] sscdmdfl        C:\Windows\system32\DRIVERS\sscdmdfl.sys
19:48:27.0973 1964  sscdmdfl - ok
19:48:28.0005 1964  [ AE3E77AE0FBDB07EB1AC3FED74A0695E ] sscdmdm        C:\Windows\system32\DRIVERS\sscdmdm.sys
19:48:28.0019 1964  sscdmdm - ok
19:48:28.0048 1964  [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
19:48:28.0083 1964  SSDPSRV - ok
19:48:28.0131 1964  [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
19:48:28.0155 1964  SstpSvc - ok
19:48:28.0209 1964  [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc          C:\Windows\System32\wiaservc.dll
19:48:28.0240 1964  stisvc - ok
19:48:28.0269 1964  [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
19:48:28.0284 1964  swenum - ok
19:48:28.0326 1964  [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv          C:\Windows\System32\swprv.dll
19:48:28.0357 1964  swprv - ok
19:48:28.0377 1964  [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx        C:\Windows\system32\drivers\symc8xx.sys
19:48:28.0391 1964  Symc8xx - ok
19:48:28.0409 1964  [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi          C:\Windows\system32\drivers\sym_hi.sys
19:48:28.0424 1964  Sym_hi - ok
19:48:28.0438 1964  [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3          C:\Windows\system32\drivers\sym_u3.sys
19:48:28.0454 1964  Sym_u3 - ok
19:48:28.0500 1964  [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain        C:\Windows\system32\sysmain.dll
19:48:28.0547 1964  SysMain - ok
19:48:28.0578 1964  [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
19:48:28.0598 1964  TabletInputService - ok
19:48:28.0830 1964  [ 1FF41723B6CF6EF0D2456691B75131BB ] TabletServicePen C:\Program Files\Tablet\Pen\Pen_Tablet.exe
19:48:29.0107 1964  TabletServicePen - ok
19:48:29.0142 1964  [ 34F1BCB847A924A161422F106A79B9FF ] tap0901        C:\Windows\system32\DRIVERS\tap0901.sys
19:48:29.0151 1964  tap0901 ( UnsignedFile.Multi.Generic ) - warning
19:48:29.0151 1964  tap0901 - detected UnsignedFile.Multi.Generic (1)
19:48:29.0184 1964  [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv        C:\Windows\System32\tapisrv.dll
19:48:29.0210 1964  TapiSrv - ok
19:48:29.0245 1964  [ CB05822CD9CC6C688168E113C603DBE7 ] TBS            C:\Windows\System32\tbssvc.dll
19:48:29.0271 1964  TBS - ok
19:48:29.0325 1964  [ EE7E10BED85C312C1D5D30C435BDDA9F ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
19:48:29.0382 1964  Tcpip - ok
19:48:29.0400 1964  [ EE7E10BED85C312C1D5D30C435BDDA9F ] Tcpip6          C:\Windows\system32\DRIVERS\tcpip.sys
19:48:29.0444 1964  Tcpip6 - ok
19:48:29.0481 1964  [ 2C2D4CFF5E09C73908F9B5AF49A51365 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
19:48:29.0495 1964  tcpipreg - ok
19:48:29.0524 1964  [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
19:48:29.0547 1964  TDPIPE - ok
19:48:29.0594 1964  [ 3630F5B8181554DEECFE2E4252BC4C4C ] tdrpman251      C:\Windows\system32\DRIVERS\tdrpm251.sys
19:48:29.0658 1964  tdrpman251 - ok
19:48:29.0683 1964  [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
19:48:29.0708 1964  TDTCP - ok
19:48:29.0731 1964  [ 76B06EB8A01FC8624D699E7045303E54 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
19:48:29.0751 1964  tdx - ok
19:48:29.0771 1964  [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
19:48:29.0785 1964  TermDD - ok
19:48:29.0804 1964  [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService    C:\Windows\System32\termsrv.dll
19:48:29.0836 1964  TermService - ok
19:48:29.0863 1964  [ C7230FBEE14437716701C15BE02C27B8 ] Themes          C:\Windows\system32\shsvcs.dll
19:48:29.0880 1964  Themes - ok
19:48:29.0893 1964  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER    C:\Windows\system32\mmcss.dll
19:48:29.0917 1964  THREADORDER - ok
19:48:29.0948 1964  [ C820BFC70FEB25EC877C49E81CD477C1 ] timounter      C:\Windows\system32\DRIVERS\timntr.sys
19:48:29.0973 1964  timounter - ok
19:48:30.0034 1964  [ E44759CB4AC9F43464D8780501CC0470 ] TOSHIBA Bluetooth Service C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
19:48:30.0046 1964  TOSHIBA Bluetooth Service - ok
19:48:30.0086 1964  [ 2C15B4856F929AC7DD144044D8334B54 ] tosporte        C:\Windows\system32\DRIVERS\tosporte.sys
19:48:30.0110 1964  tosporte - ok
19:48:30.0147 1964  [ 6750328AB04AE5FAF01403A575D66978 ] tosrfbd        C:\Windows\system32\DRIVERS\tosrfbd.sys
19:48:30.0171 1964  tosrfbd - ok
19:48:30.0190 1964  [ E5E34CD8848742CDC946F589F802630F ] tosrfbnp        C:\Windows\system32\Drivers\tosrfbnp.sys
19:48:30.0203 1964  tosrfbnp - ok
19:48:30.0242 1964  [ C281D231BA7BC7955D39EA9E21374EFF ] Tosrfcom        C:\Windows\system32\Drivers\tosrfcom.sys
19:48:30.0254 1964  Tosrfcom - ok
19:48:30.0267 1964  [ 592CD9C8AB08EF02EA53905D30FB157E ] Tosrfhid        C:\Windows\system32\DRIVERS\Tosrfhid.sys
19:48:30.0292 1964  Tosrfhid - ok
19:48:30.0298 1964  [ 0F3FD4F55175CAEDDCE9EFD6C5CA45D3 ] tosrfnds        C:\Windows\system32\DRIVERS\tosrfnds.sys
19:48:30.0318 1964  tosrfnds - ok
19:48:30.0337 1964  [ F21031C35FE340A948FFDCA6DE74D333 ] TosRfSnd        C:\Windows\system32\drivers\tosrfsnd.sys
19:48:30.0349 1964  TosRfSnd - ok
19:48:30.0384 1964  [ C4245835D4FAC0494ED616F3BFE9EE0A ] Tosrfusb        C:\Windows\system32\DRIVERS\tosrfusb.sys
19:48:30.0406 1964  Tosrfusb - ok
19:48:30.0432 1964  [ C17EA46C3326A951DC3B8E883D661E0C ] TouchServicePen C:\Program Files\Tablet\Pen\Pen_TouchService.exe
19:48:30.0457 1964  TouchServicePen - ok
19:48:30.0489 1964  [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks          C:\Windows\System32\trkwks.dll
19:48:30.0516 1964  TrkWks - ok
19:48:30.0568 1964  [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
19:48:30.0586 1964  TrustedInstaller - ok
19:48:30.0624 1964  [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
19:48:30.0648 1964  tssecsrv - ok
19:48:30.0697 1964  [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp          C:\Windows\system32\DRIVERS\tunmp.sys
19:48:30.0711 1964  tunmp - ok
19:48:30.0746 1964  [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
19:48:30.0759 1964  tunnel - ok
19:48:30.0782 1964  [ C3ADE15414120033A36C0F293D4A4121 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
19:48:30.0793 1964  uagp35 - ok
19:48:30.0825 1964  [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
19:48:30.0847 1964  udfs - ok
19:48:30.0879 1964  [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
19:48:30.0906 1964  UI0Detect - ok
19:48:30.0912 1964  [ 75E6890EBFCE0841D3291B02E7A8BDB0 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
19:48:30.0924 1964  uliagpkx - ok
19:48:30.0949 1964  [ 3CD4EA35A6221B85DCC25DAA46313F8D ] uliahci        C:\Windows\system32\drivers\uliahci.sys
19:48:30.0964 1964  uliahci - ok
19:48:30.0980 1964  [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata          C:\Windows\system32\drivers\ulsata.sys
19:48:30.0994 1964  UlSata - ok
19:48:31.0008 1964  [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2        C:\Windows\system32\drivers\ulsata2.sys
19:48:31.0021 1964  ulsata2 - ok
19:48:31.0043 1964  [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
19:48:31.0067 1964  umbus - ok
19:48:31.0101 1964  [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost        C:\Windows\System32\upnphost.dll
19:48:31.0130 1964  upnphost - ok
19:48:31.0186 1964  [ 8E9DCCB2BA19C959A8C3A344445BB954 ] USB28xxBGA      C:\Windows\system32\DRIVERS\emBDA.sys
19:48:31.0212 1964  USB28xxBGA - ok
19:48:31.0256 1964  [ DA617CA98704142F10938089DD0738A4 ] USB28xxOEM      C:\Windows\system32\DRIVERS\emOEM.sys
19:48:31.0281 1964  USB28xxOEM - ok
19:48:31.0320 1964  [ 32DB9517628FF0D070682AAB61E688F0 ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
19:48:31.0339 1964  usbaudio - ok
19:48:31.0344 1964  usbbus - ok
19:48:31.0381 1964  [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
19:48:31.0402 1964  usbccgp - ok
19:48:31.0445 1964  [ E9476E6C486E76BC4898074768FB7131 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
19:48:31.0485 1964  usbcir - ok
19:48:31.0490 1964  UsbDiag - ok
19:48:31.0531 1964  [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
19:48:31.0549 1964  usbehci - ok
19:48:31.0569 1964  [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
19:48:31.0590 1964  usbhub - ok
19:48:31.0609 1964  USBModem - ok
19:48:31.0633 1964  [ 38DBC7DD6CC5A72011F187425384388B ] usbohci        C:\Windows\system32\drivers\usbohci.sys
19:48:31.0671 1964  usbohci - ok
19:48:31.0693 1964  [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
19:48:31.0717 1964  usbprint - ok
19:48:31.0745 1964  [ A508C9BD8724980512136B039BBA65E9 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
19:48:31.0764 1964  usbscan - ok
19:48:31.0780 1964  [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
19:48:31.0799 1964  USBSTOR - ok
19:48:31.0820 1964  [ 814D653EFC4D48BE3B04A307ECEFF56F ] usbuhci        C:\Windows\system32\DRIVERS\usbuhci.sys
19:48:31.0839 1964  usbuhci - ok
19:48:31.0881 1964  [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
19:48:31.0908 1964  usbvideo - ok
19:48:31.0938 1964  [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms          C:\Windows\System32\uxsms.dll
19:48:31.0960 1964  UxSms - ok
19:48:31.0989 1964  [ CD88D1B7776DC17A119049742EC07EB4 ] vds            C:\Windows\System32\vds.exe
19:48:32.0020 1964  vds - ok
19:48:32.0049 1964  [ 7D92BE0028ECDEDEC74617009084B5EF ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
19:48:32.0088 1964  vga - ok
19:48:32.0119 1964  [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave        C:\Windows\System32\drivers\vga.sys
19:48:32.0144 1964  VgaSave - ok
19:48:32.0157 1964  [ 045D9961E591CF0674A920B6BA3BA5CB ] viaagp          C:\Windows\system32\drivers\viaagp.sys
19:48:32.0169 1964  viaagp - ok
19:48:32.0184 1964  [ 56A4DE5F02F2E88182B0981119B4DD98 ] ViaC7          C:\Windows\system32\drivers\viac7.sys
19:48:32.0224 1964  ViaC7 - ok
19:48:32.0236 1964  [ FD2E3175FCADA350C7AB4521DCA187EC ] viaide          C:\Windows\system32\drivers\viaide.sys
19:48:32.0248 1964  viaide - ok
19:48:32.0257 1964  [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
19:48:32.0271 1964  volmgr - ok
19:48:32.0303 1964  [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
19:48:32.0322 1964  volmgrx - ok
19:48:32.0356 1964  [ 147281C01FCB1DF9252DE2A10D5E7093 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
19:48:32.0373 1964  volsnap - ok
19:48:32.0389 1964  [ D984439746D42B30FC65A4C3546C6829 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
19:48:32.0402 1964  vsmraid - ok
19:48:32.0457 1964  [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS            C:\Windows\system32\vssvc.exe
19:48:32.0533 1964  VSS - ok
19:48:32.0574 1964  [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time        C:\Windows\system32\w32time.dll
19:48:32.0599 1964  W32Time - ok
19:48:32.0652 1964  [ 427A8BC96F16C40DF81C2D2F4EDD32DD ] wacommousefilter C:\Windows\system32\DRIVERS\wacommousefilter.sys
19:48:32.0664 1964  wacommousefilter - ok
19:48:32.0675 1964  [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
19:48:32.0724 1964  WacomPen - ok
19:48:32.0769 1964  [ 846B58EA44BF8C92E4B59F4E2252C4C0 ] wacomvhid      C:\Windows\system32\DRIVERS\wacomvhid.sys
19:48:32.0779 1964  wacomvhid - ok
19:48:32.0803 1964  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp          C:\Windows\system32\DRIVERS\wanarp.sys
19:48:32.0823 1964  Wanarp - ok
19:48:32.0826 1964  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
19:48:32.0847 1964  Wanarpv6 - ok
19:48:32.0867 1964  [ A3CD60FD826381B49F03832590E069AF ] wcncsvc        C:\Windows\System32\wcncsvc.dll
19:48:32.0895 1964  wcncsvc - ok
19:48:32.0924 1964  [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
19:48:32.0946 1964  WcsPlugInService - ok
19:48:32.0965 1964  [ AFC5AD65B991C1E205CF25CFDBF7A6F4 ] Wd              C:\Windows\system32\drivers\wd.sys
19:48:32.0977 1964  Wd - ok
19:48:33.0018 1964  [ B6F0A7AD6D4BD325FBCD8BAC96CD8D96 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
19:48:33.0045 1964  Wdf01000 - ok
19:48:33.0074 1964  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost  C:\Windows\system32\wdi.dll
19:48:33.0101 1964  WdiServiceHost - ok
19:48:33.0105 1964  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost  C:\Windows\system32\wdi.dll
19:48:33.0131 1964  WdiSystemHost - ok
19:48:33.0166 1964  [ 04C37D8107320312FBAE09926103D5E2 ] WebClient      C:\Windows\System32\webclnt.dll
19:48:33.0185 1964  WebClient - ok
19:48:33.0216 1964  [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc          C:\Windows\system32\wecsvc.dll
19:48:33.0240 1964  Wecsvc - ok
19:48:33.0272 1964  [ 670FF720071ED741206D69BD995EA453 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
19:48:33.0293 1964  wercplsupport - ok
19:48:33.0326 1964  [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc          C:\Windows\System32\WerSvc.dll
19:48:33.0349 1964  WerSvc - ok
19:48:33.0402 1964  [ 4575AA12561C5648483403541D0D7F2B ] WinDefend      C:\Program Files\Windows Defender\mpsvc.dll
19:48:33.0420 1964  WinDefend - ok
19:48:33.0430 1964  WinHttpAutoProxySvc - ok
19:48:33.0472 1964  [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
19:48:33.0493 1964  Winmgmt - ok
19:48:33.0577 1964  [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM          C:\Windows\system32\WsmSvc.dll
19:48:33.0654 1964  WinRM - ok
19:48:33.0701 1964  [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc        C:\Windows\System32\wlansvc.dll
19:48:33.0741 1964  Wlansvc - ok
19:48:33.0866 1964  [ FB01D4AE207B9EFDBABFC55DC95C7E31 ] wlidsvc        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
19:48:33.0971 1964  wlidsvc - ok
19:48:33.0988 1964  [ 701A9F884A294327E9141D73746EE279 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
19:48:34.0027 1964  WmiAcpi - ok
19:48:34.0065 1964  [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
19:48:34.0086 1964  wmiApSrv - ok
19:48:34.0156 1964  [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc  C:\Program Files\Windows Media Player\wmpnetwk.exe
19:48:34.0222 1964  WMPNetworkSvc - ok
19:48:34.0255 1964  [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
19:48:34.0273 1964  WPCSvc - ok
19:48:34.0316 1964  [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
19:48:34.0332 1964  WPDBusEnum - ok
19:48:34.0358 1964  [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb          C:\Windows\system32\DRIVERS\wpdusb.sys
19:48:34.0371 1964  WpdUsb - ok
19:48:34.0484 1964  [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
19:48:34.0526 1964  WPFFontCache_v0400 - ok
19:48:34.0552 1964  [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
19:48:34.0576 1964  ws2ifsl - ok
19:48:34.0601 1964  [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc          C:\Windows\system32\wscsvc.dll
19:48:34.0618 1964  wscsvc - ok
19:48:34.0623 1964  WSearch - ok
19:48:34.0695 1964  [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv        C:\Windows\system32\wuaueng.dll
19:48:34.0804 1964  wuauserv - ok
19:48:34.0833 1964  [ AC13CB789D93412106B0FB6C7EB2BCB6 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
19:48:34.0857 1964  WUDFRd - ok
19:48:34.0887 1964  [ 575A4190D989F64732119E4114045A4F ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
19:48:34.0914 1964  wudfsvc - ok
19:48:34.0950 1964  ================ Scan global ===============================
19:48:34.0975 1964  [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
19:48:35.0018 1964  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
19:48:35.0051 1964  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
19:48:35.0088 1964  [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
19:48:35.0094 1964  [Global] - ok
19:48:35.0095 1964  ================ Scan MBR ==================================
19:48:35.0114 1964  [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
19:48:35.0452 1964  \Device\Harddisk0\DR0 - ok
19:48:35.0452 1964  ================ Scan VBR ==================================
19:48:35.0455 1964  [ 7CCBAD47AC4B33D7414CB9723352E35C ] \Device\Harddisk0\DR0\Partition1
19:48:35.0458 1964  \Device\Harddisk0\DR0\Partition1 - ok
19:48:35.0483 1964  [ 505F3AF4599D00C2B0EFFA7141E4B5BC ] \Device\Harddisk0\DR0\Partition2
19:48:35.0485 1964  \Device\Harddisk0\DR0\Partition2 - ok
19:48:35.0485 1964  ============================================================
19:48:35.0485 1964  Scan finished
19:48:35.0485 1964  ============================================================
19:48:35.0498 5792  Detected object count: 8
19:48:35.0498 5792  Actual detected object count: 8
20:31:09.0965 5792  FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - skipped by user
20:31:09.0965 5792  FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:31:09.0967 5792  giveio ( UnsignedFile.Multi.Generic ) - skipped by user
20:31:09.0967 5792  giveio ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:31:09.0969 5792  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
20:31:09.0969 5792  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:31:09.0972 5792  MCSWASVR ( UnsignedFile.Multi.Generic ) - skipped by user
20:31:09.0972 5792  MCSWASVR ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:31:09.0974 5792  MGHwCtrl ( UnsignedFile.Multi.Generic ) - skipped by user
20:31:09.0974 5792  MGHwCtrl ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:31:09.0976 5792  SbieDrv ( UnsignedFile.Multi.Generic ) - skipped by user
20:31:09.0976 5792  SbieDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:31:09.0978 5792  SbieSvc ( UnsignedFile.Multi.Generic ) - skipped by user
20:31:09.0978 5792  SbieSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:31:09.0981 5792  tap0901 ( UnsignedFile.Multi.Generic ) - skipped by user
20:31:09.0981 5792  tap0901 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:34:27.0985 4972  Deinitialize success

cosinus 22.11.2012 12:04
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

aupex 22.11.2012 15:36
Code:
ComboFix 12-11-22.03 - Aupex 22.11.2012  14:59:16.3.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3069.1746 [GMT 1:00]
ausgeführt von:: c:\users\Aupex\Desktop\trojanerboard\ComboFix.exe
AV: Kaspersky Security Suite CBE *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky Security Suite CBE *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: Kaspersky Security Suite CBE *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\cleanup.exe
c:\users\Aupex\AppData\Local\Temp\_MEI57402\_ctypes.pyd
c:\users\Aupex\AppData\Local\temp\_MEI57402\_elementtree.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\_hashlib.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\_socket.pyd
c:\users\Aupex\AppData\Local\temp\_MEI57402\_ssl.pyd
c:\users\Aupex\AppData\Local\temp\_MEI57402\pyexpat.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\pysqlite2._sqlite.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\python26.dll
c:\users\Aupex\AppData\Local\Temp\_MEI57402\pythoncom26.dll
c:\users\Aupex\AppData\Local\Temp\_MEI57402\PyWinTypes26.dll
c:\users\Aupex\AppData\Local\Temp\_MEI57402\select.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\unicodedata.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\win32api.pyd
c:\users\Aupex\AppData\Local\temp\_MEI57402\win32com.shell.shell.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\win32crypt.pyd
c:\users\Aupex\AppData\Local\temp\_MEI57402\win32event.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\win32file.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\win32inet.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\win32pdh.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\win32process.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\win32profile.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\win32security.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\win32ts.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\windows._cacheinvalidation.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\wx._controls_.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\wx._core_.pyd
c:\users\Aupex\AppData\Local\temp\_MEI57402\wx._gdi_.pyd
c:\users\Aupex\AppData\Local\temp\_MEI57402\wx._html2.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\wx._misc_.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\wx._windows_.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\wx._wizard.pyd
c:\users\Aupex\AppData\Local\Temp\_MEI57402\wxbase293u_net_vc.dll
c:\users\Aupex\AppData\Local\Temp\_MEI57402\wxbase293u_vc.dll
c:\users\Aupex\AppData\Local\Temp\_MEI57402\wxmsw293u_adv_vc.dll
c:\users\Aupex\AppData\Local\Temp\_MEI57402\wxmsw293u_core_vc.dll
c:\users\Aupex\AppData\Local\Temp\_MEI57402\wxmsw293u_html_vc.dll
c:\users\Aupex\AppData\Local\temp\_MEI57402\wxmsw293u_webview_vc.dll
c:\users\Aupex\AppData\Local\Temp\08f56ff6-864d-4a92-944a-57b870198cb2\CliSecureRT.dll
c:\users\Aupex\AppData\Roaming\AcroIEHelpe.txt
c:\windows\system32\~.inf
c:\windows\system32\drivers\~GLH0014.TMP
c:\windows\system32\muzapp.exe
c:\windows\system32\System32\MASetupCleaner.exe
c:\windows\system32\System32\muzapp.exe
C:\zip.exe
D:\install.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-10-22 bis 2012-11-22  ))))))))))))))))))))))))))))))
.
.
2012-11-22 14:11 . 2012-11-22 14:23        --------        d-----w-        c:\users\Aupex\AppData\Local\temp
2012-11-22 14:11 . 2012-11-22 14:11        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2012-11-22 14:11 . 2012-11-22 14:11        --------        d-----w-        c:\users\Public\AppData\Local\temp
2012-11-22 14:11 . 2012-11-22 14:11        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-11-22 14:11 . 2012-11-22 14:11        --------        d-----w-        c:\users\Administrator\AppData\Local\temp
2012-11-20 15:26 . 2012-11-08 18:00        6812136        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{8FB319D0-8551-499E-86EF-6D819096699A}\mpengine.dll
2012-11-14 15:14 . 2012-09-25 16:19        75776        ----a-w-        c:\windows\system32\synceng.dll
2012-11-14 15:14 . 2012-10-12 14:29        2047488        ----a-w-        c:\windows\system32\win32k.sys
2012-11-10 16:32 . 2012-11-10 16:32        --------        d-----w-        c:\program files\Common Files\Canon_Inc_IC
2012-11-10 16:31 . 2012-11-10 16:31        --------        d-----w-        c:\programdata\Canon_Inc_IC
2012-11-06 19:42 . 2012-11-06 19:42        --------        d-----w-        c:\program files\Alan Hadley
2012-11-02 17:26 . 2012-11-02 17:26        --------        d-----w-        c:\program files\Common Files\Borland Shared
2012-11-02 17:26 . 2012-11-02 17:26        --------        d-----w-        c:\program files\ERGO SOFT
2012-11-02 17:19 . 2012-11-02 17:19        --------        d-----w-        c:\users\Aupex\AppData\Local\ErgoFAKT
2012-11-02 17:17 . 2012-11-02 17:17        --------        d-----w-        c:\programdata\ErgoFAKT
2012-10-25 18:49 . 2012-10-25 18:49        --------        d-----w-        c:\users\Aupex\AppData\Roaming\inkscape
2012-10-25 09:45 . 2012-10-25 10:20        --------        d-sh--w-        c:\users\Aupex\AppData\Local\.#
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-24 14:19 . 2011-07-26 10:42        6504151        ----a-w-        c:\windows\system32\~.tmp
2012-10-09 06:32 . 2012-04-02 06:28        696760        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-10-09 06:32 . 2011-05-17 14:43        73656        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-29 17:54 . 2011-01-31 17:02        22856        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-09-13 13:28 . 2012-10-10 17:34        2048        ----a-w-        c:\windows\system32\tzres.dll
2012-08-29 11:27 . 2012-10-10 17:33        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-08-29 11:27 . 2012-10-10 17:33        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-08-24 15:53 . 2012-10-10 17:34        172544        ----a-w-        c:\windows\system32\wintrust.dll
2006-05-03 10:06        163328        --sha-r-        c:\windows\System32\flvDX.dll
2007-02-21 11:47        31232        --sha-r-        c:\windows\System32\msfDX.dll
2008-03-16 13:30        216064        --sha-r-        c:\windows\System32\nbDX.dll
2010-01-06 22:00        107520        --sha-r-        c:\windows\System32\TAKDSDecoder.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2012-10-08 08:28 . D41D8CD98F00B204E9800998ECF8427E . 0 . . [------] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16455_none_d319def060227a5d\mshtml.dll
[7] 2012-10-08 . F7B251DA2FA89933771289793DCAA08B . 12321280 . . [9.00.8112.16421] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20562_none_d395aaf1794aea13\mshtml.dll
[7] 2012-08-24 . 975D1EA99A0FE8104B72440995B3C20B . 12319744 . . [9.00.8112.16421] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20557_none_d3a57c4f793e4cd5\mshtml.dll
[7] 2012-08-24 . BB197F54A8F69EEA8356B7F70E6D3A20 . 12319744 . . [9.00.8112.16421] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16450_none_d314dd7e6026fbaa\mshtml.dll
[7] 2012-06-29 . 5E8E869E1342308752A37A2C90CCA79D . 12317184 . . [9.00.8112.16421] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16448_none_d327afba6017aa71\mshtml.dll
[7] 2012-06-28 . AEC51857AEC2F5CE4520366240AFC671 . 12317184 . . [9.00.8112.16421] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20554_none_d3a27b71794100d0\mshtml.dll
[7] 2012-06-02 . 6820A9E91AFF7CB3A510360D8CCD9BDD . 12314624 . . [9.00.8112.16421] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16447_none_d326af706018911a\mshtml.dll
[7] 2012-06-02 . 1ABF770552EA9D4FE90F654468FAF4CE . 12314624 . . [9.00.8112.16421] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20553_none_d3a17b277941e779\mshtml.dll
[7] 2012-05-17 . 9FB58F71104107D44540AF1195F7A14D . 12314624 . . [9.00.8112.16421] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16446_none_d325af26601977c3\mshtml.dll
[7] 2012-05-17 . 761D9111F5A2619CB5060661D36FBFFF . 12314624 . . [9.00.8112.16421] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20551_none_d39f7a937943b4cb\mshtml.dll
[7] 2012-04-21 . 497C9C3DB953A60EC4F43A097E15F75E . 12282368 . . [9.00.8112.16421] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16441_none_d320adb4601df910\mshtml.dll
[7] 2012-02-28 . 6758A38197024E71F71FFF507A1AD2F1 . 5980672 . . [8.00.6001.23318] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.6001.23318_none_f6b2e34b5115671c\mshtml.dll
[7] 2012-02-28 . 5F25D5561F5BDA32EDE1193EC01529BF . 5978624 . . [8.00.6001.19222] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.6001.19222_none_f61874d838054b39\mshtml.dll
[7] 2012-02-28 . F82BF2CB075B49E9FAB5FF213C45C020 . 12281856 . . [9.00.8112.16421] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16443_none_d322ae48601c2bbe\mshtml.dll
[7] 2012-02-28 . B9E083B14B1994F1255983F2DF31C7DF . 12281856 . . [9.00.8112.16421] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20548_none_d3b14c8579354a3b\mshtml.dll
[7] 2011-12-15 . 0FB4CBF8B6F2407B821266F80C4EAA88 . 5980160 . . [8.00.6001.23286] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.6001.23286_none_f665315d514ffade\mshtml.dll
[7] 2011-12-15 . 62CA6A044EE909202D74C138012DD9AF . 5979136 . . [8.00.6001.19190] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.6001.19190_none_f5cac2ea383fdefb\mshtml.dll
[7] 2011-11-03 . D4D63FCD03E8B58D5F1DDE6D64E0FF1B . 5978624 . . [8.00.6001.23266] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.6001.23266_none_f67ad135513fc2fc\mshtml.dll
[7] 2011-11-03 . 73D666A49DEC07192D7D1C367A142333 . 5978112 . . [8.00.6001.19170] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.6001.19170_none_f5e062c2382fa719\mshtml.dll
[7] 2011-09-30 . 59CC0E3A960D0B8A4BBDB6FC65340EB9 . 5972992 . . [8.00.6001.23250] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.6001.23250_none_f67f9f65513d0f01\mshtml.dll
[7] 2011-09-30 . 7E6C9B54B10123EA983ECDF7FBFFEA86 . 5971456 . . [8.00.6001.19154] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.6001.19154_none_f5fa03c2381bd493\mshtml.dll
[7] 2011-07-23 . 8DF22BFA121C76BF1EE346AB9F12F360 . 5971456 . . [8.00.6001.23216] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.6001.23216_none_f6b0e0d151173747\mshtml.dll
[7] 2011-07-23 . CAB330223469AC16EDB4863DF4C9976B . 5969920 . . [8.00.6001.19120] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.6001.19120_none_f616725e38071b64\mshtml.dll
[7] 2011-05-28 . 7AF8A6DB4596E3BB3309BABA661EB523 . 5967360 . . [8.00.6001.23181] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.6001.23181_none_f6602e0551547f04\mshtml.dll
[7] 2011-05-28 . 6D1E32A3C964BAF06B7973E7B18E3212 . 5964800 . . [8.00.6001.19088] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.6001.19088_none_f5dd93403830909b\mshtml.dll
.
c:\windows\System32\mshtml.dll ... Fehlt !!
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2010-05-15 14:55        155416        ----a-w-        c:\windows\System32\CbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2012-10-25 14:45        556056        ----a-w-        c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2012-10-25 14:45        556056        ----a-w-        c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2012-10-25 14:45        556056        ----a-w-        c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2012-10-25 14:45        556056        ----a-w-        c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\McsShellOverlayUpload]
@="{0774B5A9-ADB5-4D3A-915F-72C7EF9CD262}"
[HKEY_CLASSES_ROOT\CLSID\{0774B5A9-ADB5-4D3A-915F-72C7EF9CD262}]
2011-11-23 12:01        284160        ----a-w-        c:\windows\System32\DTAG.Mediencenter.ShellExtension.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="d:\program files\suparaasyp\SUPERAntiSpyware.exe" [2012-11-06 4763008]
"KiesPDLR"="d:\program files\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-02-22 21392]
"KiesHelper"="d:\program files\Kies\KiesHelper.exe" [2012-02-22 943504]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"GoogleDriveSync"="c:\program files\Google\Drive\googledrivesync.exe" [2012-10-25 16052192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2008-12-19 83336]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-09 4702208]
"ProfilerU"="c:\program files\Saitek\SD6\Software\ProfilerU.exe" [2010-07-29 227840]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-07-25 2569616]
"CanonSolutionMenuEx"="c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-09-14 1213848]
"IJNetworkScannerSelectorEX"="c:\program files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe" [2010-09-09 452016]
"TrayServer"="d:\program files\MAGIX\Video_deluxe_17_Plus_Sonderedition\TrayServer.exe" [2008-08-07 90112]
"AVP"="d:\program files\Kaspersky Security Suite CBE 12\avp.exe" [2012-04-10 202296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"BambooCore"="c:\program files\Bamboo Dock\BambooCore.exe" [2011-09-27 646232]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\suparaasyp\SASSEH.DLL" [2011-08-05 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21        548352        ----a-w-        d:\program files\suparaasyp\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux9"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKLM\~\startupfolder\C:^Users^Aupex^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\Aupex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2009-09-12 16:09        357800        ----a-w-        c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-03-21 18:56        1230704        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
2012-02-22 05:57        943504        ----a-w-        d:\program files\kies\KiesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2012-02-22 05:57        3508624        ----a-w-        d:\program files\kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent]
2010-03-26 08:52        1234216        ----a-w-        d:\program files\nero10\Nero BackItUp\NBAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-08-03 11:22        1826816        ----a-w-        c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3814163011-2074231880-4065175572-1000]
"EnableNotificationsRef"=dword:00000002
.
S2 !SASCORE;SAS Core Service;d:\program files\suparaasyp\SASCORE.EXE [x]
S2 afcdpsrv;Acronis Nonstop Backup service;c:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [x]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
getPlusHelper        REG_MULTI_SZ          getPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2012-11-22 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 06:32]
.
2012-11-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-23 14:01]
.
2012-11-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-23 14:01]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: add to &BOM - d:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta
IE: Alles mit FDM herunterladen - file://d:\program files\Free Download Manager\dlall.htm
IE: Auswahl mit FDM herunterladen - file://d:\program files\Free Download Manager\dlselected.htm
IE: Datei mit FDM herunterladen - file://d:\program files\Free Download Manager\dllink.htm
IE: Download with Xilisoft Download YouTube Video - d:\program files\Xilisoft\Download YouTube Video\upod_link.HTM
IE: Free YouTube to Mp3 Converter - c:\users\Aupex\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Hinzufügen zu Anti-Banner - d:\program files\Kaspersky Security Suite CBE 12\ie_banner_deny.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Videos mit FDM herunterladen - file://d:\program files\Free Download Manager\dlfvideo.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Aupex\AppData\Roaming\Mozilla\Firefox\Profiles\z8fjhgyp.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - ExtSQL: !HIDDEN! 2009-07-01 18:45; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-CloneCDTray - d:\program files\SlySoft\CloneCD\CloneCDTray.exe
MSConfigStartUp-SpybotSD TeaTimer - d:\program files\Spybot2\TeaTimer.exe
AddRemove-01_Simmental - d:\program files\kies\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - d:\program files\kies\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - d:\program files\kies\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - d:\program files\kies\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - d:\program files\kies\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - d:\program files\kies\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - d:\program files\kies\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - d:\program files\kies\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - d:\program files\kies\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - d:\program files\kies\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - d:\program files\kies\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - d:\program files\kies\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - d:\program files\kies\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - d:\program files\kies\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - d:\program files\kies\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-22_WiBro_WiMAX - d:\program files\kies\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - d:\program files\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - d:\program files\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-11-22 15:23
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(1112)
c:\windows\system32\CbFsNetRdr3.dll
.
- - - - - - - > 'Explorer.exe'(5632)
c:\windows\system32\CbFsMntNtf3.dll
c:\windows\system32\CbFsNetRdr3.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Tablet\Pen\Pen_TouchService.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
d:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
d:\program files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\program files\Nero\Update\NASvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
d:\program files\Sandboxie\SbieSvc.exe
d:\program files\Secunia\PSI\sua.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Tablet\Pen\Pen_Tablet.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\program files\Tablet\Pen\Pen_TouchUser.exe
c:\program files\Tablet\Pen\Pen_TabletUser.exe
c:\program files\Tablet\Pen\Pen_Tablet.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-11-22  15:30:00 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-11-22 14:29
ComboFix2.txt  2011-06-08 13:24
ComboFix3.txt  2011-06-08 10:30
.
Vor Suchlauf: 740.704.256 Bytes frei
Nach Suchlauf: 1.735.602.176 Bytes frei
.
- - End Of File - - E0CBC1CDF39B843442B0DC76D82AB026
Allerdings ist der Laptop beim Scannen einmal heruntergefahren und beim Neustart hat sich Kaspersky und SAS wieder eingeschaltet. Fehlermeldung : Irgendwas mit Error starting Childprocess.

Gruß

cosinus 22.11.2012 17:45
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Folder::
c:\users\Aupex\AppData\Local\.#
c:\windows\system32\~.tmp
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

aupex 22.11.2012 20:37
Diesmal gabs keinen Neustart...

Code:
ComboFix 12-11-22.03 - Aupex 22.11.2012  20:22:06.4.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3069.1705 [GMT 1:00]
ausgeführt von:: c:\users\Aupex\Desktop\trojanerboard\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Aupex\Desktop\trojanerboard\cfscript.txt
AV: Kaspersky Security Suite CBE *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky Security Suite CBE *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: Kaspersky Security Suite CBE *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Aupex\4.0
c:\users\Aupex\AppData\Local\.#
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-10-22 bis 2012-11-22  ))))))))))))))))))))))))))))))
.
.
2012-11-22 19:32 . 2012-11-22 19:32        --------        d-----w-        c:\users\Aupex\AppData\Local\temp
2012-11-22 19:32 . 2012-11-22 19:32        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2012-11-22 19:32 . 2012-11-22 19:32        --------        d-----w-        c:\users\Public\AppData\Local\temp
2012-11-22 19:32 . 2012-11-22 19:32        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-11-22 19:32 . 2012-11-22 19:32        --------        d-----w-        c:\users\Administrator\AppData\Local\temp
2012-11-20 15:26 . 2012-11-08 18:00        6812136        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{8FB319D0-8551-499E-86EF-6D819096699A}\mpengine.dll
2012-11-14 15:14 . 2012-09-25 16:19        75776        ----a-w-        c:\windows\system32\synceng.dll
2012-11-14 15:14 . 2012-10-12 14:29        2047488        ----a-w-        c:\windows\system32\win32k.sys
2012-11-10 16:32 . 2012-11-10 16:32        --------        d-----w-        c:\program files\Common Files\Canon_Inc_IC
2012-11-10 16:31 . 2012-11-10 16:31        --------        d-----w-        c:\programdata\Canon_Inc_IC
2012-11-06 19:42 . 2012-11-06 19:42        --------        d-----w-        c:\program files\Alan Hadley
2012-11-02 17:26 . 2012-11-02 17:26        --------        d-----w-        c:\program files\Common Files\Borland Shared
2012-11-02 17:26 . 2012-11-02 17:26        --------        d-----w-        c:\program files\ERGO SOFT
2012-11-02 17:19 . 2012-11-02 17:19        --------        d-----w-        c:\users\Aupex\AppData\Local\ErgoFAKT
2012-11-02 17:17 . 2012-11-02 17:17        --------        d-----w-        c:\programdata\ErgoFAKT
2012-10-25 18:49 . 2012-10-25 18:49        --------        d-----w-        c:\users\Aupex\AppData\Roaming\inkscape
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-24 14:19 . 2011-07-26 10:42        6504151        ----a-w-        c:\windows\system32\~.tmp
2012-10-09 06:32 . 2012-04-02 06:28        696760        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-10-09 06:32 . 2011-05-17 14:43        73656        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-29 17:54 . 2011-01-31 17:02        22856        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-09-13 13:28 . 2012-10-10 17:34        2048        ----a-w-        c:\windows\system32\tzres.dll
2012-08-29 11:27 . 2012-10-10 17:33        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-08-29 11:27 . 2012-10-10 17:33        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe
2006-05-03 10:06        163328        --sha-r-        c:\windows\System32\flvDX.dll
2007-02-21 11:47        31232        --sha-r-        c:\windows\System32\msfDX.dll
2008-03-16 13:30        216064        --sha-r-        c:\windows\System32\nbDX.dll
2010-01-06 22:00        107520        --sha-r-        c:\windows\System32\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2010-05-15 14:55        155416        ----a-w-        c:\windows\System32\CbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2012-10-25 14:45        556056        ----a-w-        c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2012-10-25 14:45        556056        ----a-w-        c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2012-10-25 14:45        556056        ----a-w-        c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2012-10-25 14:45        556056        ----a-w-        c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\McsShellOverlayUpload]
@="{0774B5A9-ADB5-4D3A-915F-72C7EF9CD262}"
[HKEY_CLASSES_ROOT\CLSID\{0774B5A9-ADB5-4D3A-915F-72C7EF9CD262}]
2011-11-23 12:01        284160        ----a-w-        c:\windows\System32\DTAG.Mediencenter.ShellExtension.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="d:\program files\suparaasyp\SUPERAntiSpyware.exe" [2012-11-06 4763008]
"KiesPDLR"="d:\program files\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-02-22 21392]
"KiesHelper"="d:\program files\Kies\KiesHelper.exe" [2012-02-22 943504]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"GoogleDriveSync"="c:\program files\Google\Drive\googledrivesync.exe" [2012-10-25 16052192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2008-12-19 83336]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-09 4702208]
"ProfilerU"="c:\program files\Saitek\SD6\Software\ProfilerU.exe" [2010-07-29 227840]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-07-25 2569616]
"CanonSolutionMenuEx"="c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-09-14 1213848]
"IJNetworkScannerSelectorEX"="c:\program files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe" [2010-09-09 452016]
"TrayServer"="d:\program files\MAGIX\Video_deluxe_17_Plus_Sonderedition\TrayServer.exe" [2008-08-07 90112]
"AVP"="d:\program files\Kaspersky Security Suite CBE 12\avp.exe" [2012-04-10 202296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"BambooCore"="c:\program files\Bamboo Dock\BambooCore.exe" [2011-09-27 646232]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\suparaasyp\SASSEH.DLL" [2011-08-05 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21        548352        ----a-w-        d:\program files\suparaasyp\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux9"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKLM\~\startupfolder\C:^Users^Aupex^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\Aupex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2009-09-12 16:09        357800        ----a-w-        c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-03-21 18:56        1230704        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
2012-02-22 05:57        943504        ----a-w-        d:\program files\kies\KiesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2012-02-22 05:57        3508624        ----a-w-        d:\program files\kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent]
2010-03-26 08:52        1234216        ----a-w-        d:\program files\nero10\Nero BackItUp\NBAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-08-03 11:22        1826816        ----a-w-        c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3814163011-2074231880-4065175572-1000]
"EnableNotificationsRef"=dword:00000002
.
S2 !SASCORE;SAS Core Service;d:\program files\suparaasyp\SASCORE.EXE [x]
S2 afcdpsrv;Acronis Nonstop Backup service;c:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [x]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
getPlusHelper        REG_MULTI_SZ          getPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2012-11-22 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 06:32]
.
2012-11-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-23 14:01]
.
2012-11-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-23 14:01]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: add to &BOM - d:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta
IE: Alles mit FDM herunterladen - file://d:\program files\Free Download Manager\dlall.htm
IE: Auswahl mit FDM herunterladen - file://d:\program files\Free Download Manager\dlselected.htm
IE: Datei mit FDM herunterladen - file://d:\program files\Free Download Manager\dllink.htm
IE: Download with Xilisoft Download YouTube Video - d:\program files\Xilisoft\Download YouTube Video\upod_link.HTM
IE: Free YouTube to Mp3 Converter - c:\users\Aupex\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Videos mit FDM herunterladen - file://d:\program files\Free Download Manager\dlfvideo.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Aupex\AppData\Roaming\Mozilla\Firefox\Profiles\z8fjhgyp.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - ExtSQL: !HIDDEN! 2009-07-01 18:45; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-11-22 20:32
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(1112)
c:\windows\system32\CbFsNetRdr3.dll
.
- - - - - - - > 'Explorer.exe'(4920)
c:\windows\system32\CbFsMntNtf3.dll
c:\windows\system32\CbFsNetRdr3.dll
.
Zeit der Fertigstellung: 2012-11-22  20:34:54
ComboFix-quarantined-files.txt  2012-11-22 19:34
ComboFix2.txt  2012-11-22 14:30
ComboFix3.txt  2011-06-08 13:24
ComboFix4.txt  2011-06-08 10:30
.
Vor Suchlauf: 1.463.181.312 Bytes frei
Nach Suchlauf: 1.241.550.848 Bytes frei
.
- - End Of File - - AB4527F8029936A85D0A2944D220DBA2

cosinus 22.11.2012 20:55
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

aupex 23.11.2012 06:04
Code:
# AdwCleaner v2.008 - Datei am 23/11/2012 um 06:03:34 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : Aupex - STEFANLAPTOP
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Aupex\Desktop\trojanerboard\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gefunden : C:\Users\Aupex\AppData\Roaming\Mozilla\Firefox\Profiles\z8fjhgyp.default\searchplugins\Conduit.xml
Ordner Gefunden : C:\Program Files\Conduit
Ordner Gefunden : C:\Program Files\DAEMON Tools Toolbar
Ordner Gefunden : C:\ProgramData\boost_interprocess
Ordner Gefunden : C:\Users\Aupex\AppData\LocalLow\boost_interprocess
Ordner Gefunden : C:\Users\Aupex\AppData\Roaming\Mozilla\Firefox\Profiles\z8fjhgyp.default\Conduit

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gefunden : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gefunden : HKCU\Software\Conduit
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB9}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{4EF8BE6A-899C-4196-94E7-297C5F7A203E}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2319825
Schlüssel Gefunden : HKLM\Software\Conduit
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gefunden : HKU\S-1-5-21-3814163011-2074231880-4065175572-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB9}
Schlüssel Gefunden : HKU\S-1-5-21-3814163011-2074231880-4065175572-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v3.5 (de)

Profilname : default
Datei : C:\Users\Aupex\AppData\Roaming\Mozilla\Firefox\Profiles\z8fjhgyp.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [3155 octets] - [23/11/2012 06:03:34]

########## EOF - C:\AdwCleaner[R1].txt - [3215 octets] ##########

cosinus 23.11.2012 13:55
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Löschen.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x=fortlaufende Nummer)

Danach eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles in CODE-Tags hier in den Thread.

aupex 23.11.2012 17:22
Adw Log:
Code:
# AdwCleaner v2.008 - Datei am 23/11/2012 um 14:54:58 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : Aupex - STEFANLAPTOP
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Aupex\Desktop\trojanerboard\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Aupex\AppData\Roaming\Mozilla\Firefox\Profiles\z8fjhgyp.default\searchplugins\Conduit.xml
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Program Files\DAEMON Tools Toolbar
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\Users\Aupex\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\Aupex\AppData\Roaming\Mozilla\Firefox\Profiles\z8fjhgyp.default\Conduit

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{4EF8BE6A-899C-4196-94E7-297C5F7A203E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2319825
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v3.5 (de)

Profilname : default
Datei : C:\Users\Aupex\AppData\Roaming\Mozilla\Firefox\Profiles\z8fjhgyp.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [3284 octets] - [23/11/2012 06:03:34]
AdwCleaner[S1].txt - [2893 octets] - [23/11/2012 14:54:58]

########## EOF - C:\AdwCleaner[S1].txt - [2953 octets] ##########
OTL.TXT
Code:
OTL logfile created on: 23.11.2012 15:18:14 - Run 3
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Aupex\Desktop\trojanerboard
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,82 Gb Available Physical Memory | 60,61% Memory free
10,72 Gb Paging File | 9,23 Gb Available in Paging File | 86,04% Paging File free
Paging file location(s): d:\pagefile.sys 8000 8000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 41,12 Gb Total Space | 1,70 Gb Free Space | 4,14% Space Free | Partition Type: NTFS
Drive D: | 185,90 Gb Total Space | 1,61 Gb Free Space | 0,87% Space Free | Partition Type: NTFS
Drive E: | 523,86 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: STEFANLAPTOP | User Name: Aupex | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Aupex\Desktop\trojanerboard\OTL.exe (OldTimer Tools)
PRC - D:\Program Files\suparaasyp\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - C:\Programme\Google\Drive\googledrivesync.exe (Google)
PRC - d:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - D:\Program Files\suparaasyp\SASCORE.EXE (SUPERAntiSpyware.com)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - D:\Program Files\Kaspersky Security Suite CBE 12\avp.exe (Kaspersky Lab ZAO)
PRC - D:\Program Files\kies\External\FirmwareUpdate\KiesPDLR.exe ()
PRC - d:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe (Deutsche Telekom AG)
PRC - C:\Programme\Bamboo Dock\BambooCore.exe ()
PRC - C:\Programme\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Programme\Tablet\Pen\Pen_TouchUser.exe (Wacom Technology, Corp.)
PRC - C:\Programme\Tablet\Pen\Pen_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:\Programme\Tablet\Pen\Pen_TouchService.exe (Wacom Technology, Corp.)
PRC - C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Programme\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - d:\Program Files\Secunia\PSI\sua.exe (Secunia)
PRC - C:\Programme\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
PRC - C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Programme\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
PRC - C:\Programme\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
PRC - C:\Programme\Saitek\SD6\Software\ProfilerU.exe (Saitek)
PRC - C:\Programme\Canon\IJPLM\ijplmsvc.exe ()
PRC - C:\Programme\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Programme\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Programme\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
PRC - C:\Programme\Common Files\microsoft shared\ink\TabTip.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
PRC - d:\Program Files\Sandboxie\SbieSvc.exe (tzuk)
PRC - C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\microsoft shared\ink\InputPersonalization.exe (Microsoft Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\pysqlite2._sqlite.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\win32api.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\_elementtree.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\_socket.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\win32ts.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\win32com.shell.shell.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\wx._gdi_.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\wx._html2.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\win32crypt.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\windows._cacheinvalidation.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\_ctypes.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\win32profile.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\wx._misc_.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\pythoncom26.dll ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\win32security.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\pywintypes26.dll ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\_ssl.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\wx._core_.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\win32process.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\win32pdh.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\wx._windows_.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\_hashlib.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\wx._wizard.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\win32file.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\win32inet.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\wx._controls_.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\win32event.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\pyexpat.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\unicodedata.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\_MEI57242\select.pyd ()
MOD - C:\Users\Aupex\AppData\Local\Temp\08f56ff6-864d-4a92-944a-57b870198cb2\CliSecureRT.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\7c8bffb6e42a248341d7821a8464ef0b\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\a74fade4c3e490c62af3d60742fb078a\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\dfe6e22159d3f5bf61b5bfe1da6f2758\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\ecbb113bbad9034fa8385c15f73fb4cf\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\14d2241be401f66cc1898dc5dc383b80\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\e10bbd79027aa4c1ca8950b78fd640d4\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\a8dfd1388afc0a50f39f9e1dc7ecd45c\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\379599837ade465016dd5d96798b2766\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\dbc34d53e1fbedabecd201fe4f264961\mscorlib.ni.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\qtgui4.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\qtscript4.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\qtsql4.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\qtcore4.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\qtnetwork4.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\qtdeclarative4.dll ()
MOD - D:\Program Files\kies\External\FirmwareUpdate\KiesPDLR.exe ()
MOD - d:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Programme\Bamboo Dock\BambooCore.exe ()
MOD - C:\Programme\Tablet\Pen\libxml2.dll ()
MOD - D:\Program Files\Kaspersky Security Suite CBE 12\imageformats\qgif4.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- d:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (!SASCORE) -- D:\Program Files\suparaasyp\SASCORE.EXE (SUPERAntiSpyware.com)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AVP) -- D:\Program Files\Kaspersky Security Suite CBE 12\avp.exe (Kaspersky Lab ZAO)
SRV - (MCSWASVR) -- d:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe (Deutsche Telekom AG)
SRV - (TabletServicePen) -- C:\Programme\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.)
SRV - (TouchServicePen) -- C:\Programme\Tablet\Pen\Pen_TouchService.exe (Wacom Technology, Corp.)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (Secunia PSI Agent) -- d:\Program Files\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) -- d:\Program Files\Secunia\PSI\sua.exe (Secunia)
SRV - (NAUpdate) -- C:\Programme\Nero\Update\NASvc.exe (Nero AG)
SRV - (wlidsvc) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (MSSQL$JTLWAWI) -- C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) -- C:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)
SRV - (IJPLMSVC) -- C:\Programme\Canon\IJPLM\ijplmsvc.exe ()
SRV - (afcdpsrv) -- C:\Programme\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
SRV - (getPlusHelper) -- C:\Programme\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (ACDaemon) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (FLEXnet Licensing Service) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (Fabs) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (MSSQLServerADHelper100) -- C:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe (Microsoft Corporation)
SRV - (LBTServ) -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (MSSQL$SQLEXPRESS) -- C:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLBrowser) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (SQLAgent$SQLEXPRESS) -- C:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE (Microsoft Corporation)
SRV - (TOSHIBA Bluetooth Service) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (SbieSvc) -- d:\Program Files\Sandboxie\SbieSvc.exe (tzuk)
SRV - (FirebirdServerMAGIXInstance) -- C:\Programme\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
SRV - (SQLWriter) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (USBModem) -- system32\DRIVERS\lgusbmodem.sys File not found
DRV - (UsbDiag) -- system32\DRIVERS\lgusbdiag.sys File not found
DRV - (usbbus) -- system32\DRIVERS\lgusbbus.sys File not found
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (LGVMODEM) -- system32\DRIVERS\lgvmodem.sys File not found
DRV - (lgbusenum) -- system32\DRIVERS\lgbtbus.sys File not found
DRV - (LgBttPort) -- system32\DRIVERS\lgbtport.sys File not found
DRV - (Lavasoft Kernexplorer) -- C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (catchme) -- C:\ComboFix\catchme.sys File not found
DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (KLIF) -- C:\Windows\System32\drivers\klif.sys (Kaspersky Lab)
DRV - (pwdrvio) -- C:\Windows\System32\pwdrvio.sys ()
DRV - (pwdspio) -- C:\Windows\System32\pwdspio.sys ()
DRV - (Ser2pl) -- C:\Windows\System32\drivers\ser2pl.sys (Prolific Technology Inc.)
DRV - (wacommousefilter) -- C:\Windows\System32\drivers\wacommousefilter.sys (Wacom Technology)
DRV - (wacomvhid) -- C:\Windows\System32\drivers\wacomvhid.sys (Wacom Technology)
DRV - (SASKUTIL) -- D:\Program Files\suparaasyp\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) -- D:\Program Files\suparaasyp\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (sscdmdm) -- C:\Windows\System32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdbus) -- C:\Windows\System32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (sscdmdfl) -- C:\Windows\System32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (ssadmdm) -- C:\Windows\System32\drivers\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) -- C:\Windows\System32\drivers\ssadbus.sys (MCCI Corporation)
DRV - (ssadserd) -- C:\Windows\System32\drivers\ssadserd.sys (MCCI Corporation)
DRV - (androidusb) -- C:\Windows\System32\drivers\ssadadb.sys (Google Inc)
DRV - (ssadmdfl) -- C:\Windows\System32\drivers\ssadmdfl.sys (MCCI Corporation)
DRV - (speedfan) -- C:\Windows\System32\speedfan.sys (Almico Software)
DRV - (FTDIBUS) -- C:\Windows\System32\drivers\ftdibus.sys (FTDI Ltd.)
DRV - (FTSER2K) -- C:\Windows\System32\drivers\ftser2k.sys (FTDI Ltd.)
DRV - (KLIM6) -- C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab ZAO)
DRV - (kl2) -- C:\Windows\System32\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV - (KL1) -- C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV - (PSI) -- C:\Windows\System32\drivers\psi_mf.sys (Secunia)
DRV - (SaiNtBus) -- C:\Windows\System32\drivers\SaiBus.sys (Saitek)
DRV - (SaiMini) -- C:\Windows\System32\drivers\SaiMini.sys (Saitek)
DRV - (Lbd) -- C:\Windows\System32\drivers\Lbd.sys (Lavasoft AB)
DRV - (afcdp) -- C:\Windows\System32\drivers\afcdp.sys (Acronis)
DRV - (tdrpman251) -- C:\Windows\System32\drivers\tdrpm251.sys (Acronis)
DRV - (timounter) -- C:\Windows\System32\drivers\timntr.sys (Acronis)
DRV - (snapman) -- C:\Windows\System32\drivers\snapman.sys (Acronis)
DRV - (cbfs3) -- C:\Windows\System32\drivers\cbfs3.sys (EldoS Corporation)
DRV - (ggsemc) -- C:\Windows\System32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV - (ggflt) -- C:\Windows\System32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV - (USB28xxBGA) -- C:\Windows\System32\drivers\emBDA.sys (eMPIA Technology, Inc.)
DRV - (USB28xxOEM) -- C:\Windows\System32\drivers\emOEM.sys (eMPIA Technology, Inc.)
DRV - (klmouflt) -- C:\Windows\System32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (tap0901) -- C:\Windows\System32\drivers\tap0901.sys (The OpenVPN Project)
DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (TosRfSnd) -- C:\Windows\System32\drivers\TosRfSnd.sys (TOSHIBA Corporation)
DRV - (tosrfbnp) -- C:\Windows\System32\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV - (RsFx0103) -- C:\Windows\System32\drivers\RsFx0103.sys (Microsoft Corporation)
DRV - (Tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (tosrfnds) -- C:\Windows\System32\drivers\tosrfnds.sys (TOSHIBA Corporation.)
DRV - (Tosrfhid) -- C:\Windows\System32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV - (Tosrfcom) -- C:\Windows\System32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (SbieDrv) -- d:\Program Files\Sandboxie\SbieDrv.sys (tzuk)
DRV - (hotcore3) -- C:\Windows\System32\drivers\hotcore3.sys (Paragon Software Group)
DRV - (tosrfbd) -- C:\Windows\System32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (s0016unic) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (tosporte) -- C:\Windows\System32\drivers\tosporte.sys (TOSHIBA Corporation)
DRV - (seehcri) -- C:\Windows\System32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (NETw4v32) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (enecir) -- C:\Windows\System32\drivers\enecir.sys (ENE TECHNOLOGY INC.)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (MGHwCtrl) -- C:\Windows\System32\drivers\MGHwCtrl.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (Si3531) -- C:\Windows\System32\drivers\Si3531.sys (Silicon Image, Inc)
DRV - (SiRemFil) -- C:\Windows\System32\drivers\SiRemFil.sys (Silicon Image, Inc.)
DRV - (SiFilter) -- C:\Windows\System32\drivers\SiWinAcc.sys (Silicon Image, Inc.)
DRV - (giveio) -- C:\Windows\System32\giveio.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 42 B7 60 24 4D 07 CB 01  [binary data]
IE - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000\..\SearchScopes\{7CA392FF-03B9-4588-9225-404B3C3B6E4B}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=971163&p={searchTerms}
IE - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledAddons: battlefieldplay4free@ea.com:1.0.66.2
FF - prefs.js..extensions.enabledAddons: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:4.2.1.7
FF - prefs.js..extensions.enabledItems: fdm_ffext@freedownloadmanager.org:1.3.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: KPSA-home-Priess@EasternGraphics.com:1.0.2
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: D:\Program Files\canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: d:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.10: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.0.0.1: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
FF - HKCU\Software\MozillaPlugins\wacom.com/WacomTabletPlugin: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.06.13 10:31:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.06.13 10:31:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: D:\Program Files\Kaspersky Security Suite CBE 12\FFExt\virtualKeyboard@kaspersky.ru [2012.06.13 18:50:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: D:\Program Files\Kaspersky Security Suite CBE 12\FFExt\linkfilter@kaspersky.ru [2012.06.13 18:50:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: D:\Program Files\Kaspersky Security Suite CBE 12\FFExt\KavAntiBanner@Kaspersky.ru [2012.06.13 18:49:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2012.10.29 07:44:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2012.10.29 07:44:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: D:\Program Files\Mozilla Thunderbird\components [2012.10.29 21:35:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: D:\Program Files\Mozilla Thunderbird\plugins [2012.10.29 21:35:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{8C17574E-F5C5-41b8-8B36-333FC7E67980}: D:\Program Files\Kaspersky Security Suite CBE 12\THBExt_2_x [2012.06.13 17:37:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{FD9B3EC6-8265-41fb-8A2F-4C5A22A95A7B}: D:\Program Files\Kaspersky Security Suite CBE 12\THBExt_3_1_x [2012.06.13 17:37:08 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\Aupex\AppData\Roaming\5015
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2012.10.29 07:44:46 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2012.10.29 07:44:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: D:\Program Files\Mozilla Thunderbird\components [2012.10.29 21:35:26 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: D:\Program Files\Mozilla Thunderbird\plugins [2012.10.29 21:35:31 | 000,000,000 | ---D | M]
 
[2010.09.20 18:23:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aupex\AppData\Roaming\mozilla\Extensions
[2010.09.20 18:23:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aupex\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.11.22 20:35:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aupex\AppData\Roaming\mozilla\Firefox\Profiles\z8fjhgyp.default\extensions
[2010.04.28 10:30:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Aupex\AppData\Roaming\mozilla\Firefox\Profiles\z8fjhgyp.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.10.04 19:47:00 | 000,000,000 | ---D | M] (Battlefield Play4Free) -- C:\Users\Aupex\AppData\Roaming\mozilla\Firefox\Profiles\z8fjhgyp.default\extensions\battlefieldplay4free@ea.com
[2012.09.07 14:22:16 | 000,000,000 | ---D | M] (Free Download Manager plugin) -- C:\Users\Aupex\AppData\Roaming\mozilla\Firefox\Profiles\z8fjhgyp.default\extensions\fdm_ffext@freedownloadmanager.org
[2011.02.26 21:42:26 | 000,000,000 | ---D | M] (KPSA-Home (Priess)) -- C:\Users\Aupex\AppData\Roaming\mozilla\Firefox\Profiles\z8fjhgyp.default\extensions\KPSA-home-Priess@EasternGraphics.com
[2009.09.10 20:06:59 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\Aupex\AppData\Roaming\mozilla\Firefox\Profiles\z8fjhgyp.default\extensions\moveplayer@movenetworks.com
[2012.11.22 20:35:25 | 000,035,614 | ---- | M] () (No name found) -- C:\Users\Aupex\AppData\Roaming\mozilla\firefox\profiles\z8fjhgyp.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
 
O1 HOSTS File: ([2012.11.22 15:11:51 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Programme\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Security Suite CBE 12\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Virtual Storage Mount Notification) - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\System32\CbFsMntNtf3.dll (EldoS Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - d:\Program Files\Free Download Manager\iefdm2.dll ()
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - D:\Program Files\Kaspersky Security Suite CBE 12\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [AVP] D:\Program Files\Kaspersky Security Suite CBE 12\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [BambooCore] C:\Programme\Bamboo Dock\BambooCore.exe ()
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [IJNetworkScannerSelectorEX] C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [ProfilerU] C:\Programme\Saitek\SD6\Software\ProfilerU.exe (Saitek)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [TrayServer] D:\Program Files\MAGIX\Video_deluxe_17_Plus_Sonderedition\Trayserver.exe (MAGIX AG)
O4 - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000..\Run: [GoogleDriveSync] C:\Program Files\Google\Drive\googledrivesync.exe (Google)
O4 - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000..\Run: [KiesHelper] D:\Program Files\Kies\KiesHelper.exe (Samsung)
O4 - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000..\Run: [KiesPDLR] D:\Program Files\kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000..\Run: [SUPERAntiSpyware] D:\Program Files\suparaasyp\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3814163011-2074231880-4065175572-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Alles mit FDM herunterladen - d:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Auswahl mit FDM herunterladen - d:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Datei mit FDM herunterladen - d:\Program Files\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Download with Xilisoft Download YouTube Video - d:\Program Files\Xilisoft\Download YouTube Video\upod_link.HTM ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Aupex\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - D:\Program Files\Kaspersky Security Suite CBE 12\ie_banner_deny.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Videos mit FDM herunterladen - d:\Program Files\Free Download Manager\dlfvideo.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - D:\Program Files\Kaspersky Security Suite CBE 12\ievkbd.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - D:\Program Files\Kaspersky Security Suite CBE 12\klwtbbho.dll (Kaspersky Lab ZAO)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.7.0_05)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{14436A7B-9E23-494B-A111-E37191A2C976}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7E4D3FD4-2868-44D7-9825-067520FD8405}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\system32\mshtml.dll File not found
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\system32\mshtml.dll File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\system32\mshtml.dll File not found
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\system32\mshtml.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\system32\mshtml.dll File not found
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (D:\Program Files\suparaasyp\SASWINLO.DLL) - D:\Program Files\suparaasyp\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\klogon: DllName - (C:\Windows\system32\klogon.dll) - C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O21 - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\System32\CbFsMntNtf3.dll (EldoS Corporation)
O22 - SharedTaskScheduler: {5FF49FE8-B332-4CB9-B102-FB6951629E55} - Virtual Storage Mount Notification - C:\Windows\System32\CbFsMntNtf3.dll (EldoS Corporation)
O24 - Desktop WallPaper: C:\Users\Aupex\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Aupex\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - D:\Program Files\suparaasyp\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2000.01.18 01:28:36 | 000,028,672 | R--- | M] (Dipl.-Ing. Stefan Krueger <skrueger@installsite.org>) - E:\AUTORUN.EXE -- [ CDFS ]
O32 - AutoRun File - [2002.01.12 03:28:28 | 000,001,042 | R--- | M] () - E:\AUTORUN.INI -- [ CDFS ]
O32 - AutoRun File - [2002.04.22 21:47:10 | 000,000,138 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.22 20:34:56 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.11.22 20:34:56 | 000,000,000 | ---D | C] -- C:\Users\Aupex\AppData\Local\temp
[2012.11.22 20:33:17 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.11.22 20:20:26 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012.11.20 08:51:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.11.19 20:45:22 | 000,000,000 | ---D | C] -- C:\Users\Aupex\Desktop\trojanerboard
[2012.11.14 22:40:50 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.11.14 22:40:49 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.11.14 22:40:49 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.11.14 22:40:49 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.11.14 22:40:49 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.11.14 22:40:48 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.11.14 22:40:48 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.11.14 22:40:47 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.11.14 16:14:53 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\synceng.dll
[2012.11.14 16:14:41 | 002,047,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.11.10 17:32:52 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Canon_Inc_IC
[2012.11.10 17:31:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Canon_Inc_IC
[2012.11.06 20:42:54 | 000,000,000 | ---D | C] -- C:\Users\Aupex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CombineZP
[2012.11.06 20:42:45 | 000,000,000 | ---D | C] -- C:\Program Files\Alan Hadley
[2012.11.02 18:26:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ErgoFAKT V4.0
[2012.11.02 18:26:38 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Borland Shared
[2012.11.02 18:26:35 | 000,000,000 | ---D | C] -- C:\Program Files\ERGO SOFT
[2012.11.02 18:19:09 | 000,000,000 | ---D | C] -- C:\Users\Aupex\AppData\Local\ErgoFAKT
[2012.11.02 18:17:53 | 000,000,000 | ---D | C] -- C:\ProgramData\ErgoFAKT
[2012.10.25 19:49:15 | 000,000,000 | ---D | C] -- C:\Users\Aupex\AppData\Roaming\inkscape
[2012.10.25 10:45:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RasterVect 17.3 Trial
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.23 14:57:58 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.11.23 14:57:19 | 000,003,296 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.23 14:57:19 | 000,003,296 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.23 14:57:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.23 14:54:03 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.11.23 14:54:03 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.22 15:11:51 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.11.19 20:51:47 | 000,000,020 | ---- | M] () -- C:\Users\Aupex\defogger_reenable
[2012.11.19 20:23:38 | 000,389,128 | ---- | M] () -- C:\Users\Aupex\Desktop\bookmarks-2012-11-19.json
[2012.11.19 10:27:17 | 000,136,704 | ---- | M] () -- C:\Users\Aupex\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.11.17 21:08:35 | 000,000,851 | ---- | M] () -- C:\Users\Aupex\Desktop\SOF II Einzelspieler.lnk
[2012.11.15 06:04:02 | 000,566,872 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.11.14 22:53:02 | 000,810,226 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.14 22:53:02 | 000,749,954 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.14 22:53:02 | 000,198,294 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.14 22:53:02 | 000,166,232 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.10 17:33:01 | 000,000,947 | ---- | M] () -- C:\Users\Public\Desktop\Digital Photo Professional.lnk
[2012.11.06 21:02:40 | 000,002,511 | ---- | M] () -- C:\Users\Aupex\Desktop\CombineZP.lnk
[2012.11.06 20:42:54 | 000,001,944 | ---- | M] () -- C:\Users\Aupex\Desktop\CZPBatch.lnk
[2012.11.02 18:26:47 | 000,001,980 | ---- | M] () -- C:\Users\Public\Desktop\ErgoFAKT V4.0.lnk
[2012.10.30 11:55:17 | 000,005,038 | ---- | M] () -- C:\Users\Aupex\.recently-used.xbel
[2012.10.30 11:52:46 | 000,008,799 | ---- | M] () -- C:\Users\Aupex\AppData\Local\recently-used.xbel
[2012.10.30 11:29:31 | 000,009,020 | ---- | M] () -- C:\Users\Aupex\Desktop\testlogo.svg
[2012.10.25 19:49:09 | 000,025,424 | ---- | M] () -- C:\Users\Aupex\Desktop\Vorschlag Logo.svg
[2012.10.25 19:47:27 | 000,000,634 | ---- | M] () -- C:\Users\Public\Desktop\Inkscape.lnk
[2012.10.25 10:45:39 | 000,000,695 | ---- | M] () -- C:\Users\Aupex\Desktop\RasterVect 17.3 Trial.lnk
[2012.10.25 07:46:38 | 000,666,704 | ---- | M] () -- C:\Users\Aupex\Desktop\Vorschlag Logo.png
[2012.10.25 07:45:51 | 000,085,977 | ---- | M] () -- C:\Users\Aupex\Desktop\logoss2.jpg
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.19 20:51:27 | 000,000,020 | ---- | C] () -- C:\Users\Aupex\defogger_reenable
[2012.11.19 20:23:37 | 000,389,128 | ---- | C] () -- C:\Users\Aupex\Desktop\bookmarks-2012-11-19.json
[2012.11.06 20:42:54 | 000,002,511 | ---- | C] () -- C:\Users\Aupex\Desktop\CombineZP.lnk
[2012.11.06 20:42:54 | 000,001,944 | ---- | C] () -- C:\Users\Aupex\Desktop\CZPBatch.lnk
[2012.11.02 18:26:47 | 000,001,980 | ---- | C] () -- C:\Users\Public\Desktop\ErgoFAKT V4.0.lnk
[2012.10.30 11:55:17 | 000,005,038 | ---- | C] () -- C:\Users\Aupex\.recently-used.xbel
[2012.10.30 11:52:46 | 000,008,799 | ---- | C] () -- C:\Users\Aupex\AppData\Local\recently-used.xbel
[2012.10.25 20:04:50 | 000,009,020 | ---- | C] () -- C:\Users\Aupex\Desktop\testlogo.svg
[2012.10.25 19:49:07 | 000,025,424 | ---- | C] () -- C:\Users\Aupex\Desktop\Vorschlag Logo.svg
[2012.10.25 19:47:59 | 000,000,666 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inkscape.lnk
[2012.10.25 19:47:27 | 000,000,634 | ---- | C] () -- C:\Users\Public\Desktop\Inkscape.lnk
[2012.10.25 10:45:39 | 000,000,695 | ---- | C] () -- C:\Users\Aupex\Desktop\RasterVect 17.3 Trial.lnk
[2012.10.25 07:46:34 | 000,666,704 | ---- | C] () -- C:\Users\Aupex\Desktop\Vorschlag Logo.png
[2012.10.25 07:45:47 | 000,085,977 | ---- | C] () -- C:\Users\Aupex\Desktop\logoss2.jpg
[2012.10.21 20:02:24 | 000,000,762 | ---- | C] () -- C:\Windows\Sof2.INI
[2012.10.13 20:16:50 | 000,000,087 | ---- | C] () -- C:\Windows\winDecrypt.INI
[2012.09.22 10:24:29 | 000,107,520 | RHS- | C] () -- C:\Windows\System32\TAKDSDecoder.dll
[2012.09.11 14:28:00 | 000,025,600 | ---- | C] () -- C:\Users\Aupex\Salon Seemann.dot
[2012.09.03 06:02:43 | 000,000,800 | ---- | C] () -- C:\Windows\Rtcw.INI
[2012.09.01 13:26:36 | 000,000,104 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\.ptbt1
[2012.07.31 10:37:59 | 000,000,317 | ---- | C] () -- C:\Windows\CODUO.ini
[2012.07.27 19:53:10 | 000,000,721 | ---- | C] () -- C:\Windows\COD.INI
[2012.06.27 20:34:31 | 018,506,240 | ---- | C] () -- C:\Users\Aupex\jtlwawi260612.bak
[2012.06.27 15:06:14 | 014,967,296 | ---- | C] () -- C:\Users\Aupex\sicherung270612.bak
[2012.06.13 18:39:35 | 000,017,408 | ---- | C] () -- C:\Users\Aupex\AppData\Local\WebpageIcons.db
[2012.06.13 17:39:13 | 000,116,189 | ---- | C] () -- C:\Windows\System32\drivers\klin.dat
[2012.06.13 17:39:13 | 000,098,168 | ---- | C] () -- C:\Windows\System32\drivers\klick.dat
[2012.05.19 12:26:47 | 000,016,472 | ---- | C] () -- C:\Windows\System32\pwdrvio.sys
[2012.05.18 20:39:46 | 000,922,184 | ---- | C] () -- C:\Windows\System32\pwNative.exe
[2012.05.18 20:39:08 | 000,011,104 | ---- | C] () -- C:\Windows\System32\pwdspio.sys
[2012.04.02 08:03:10 | 000,000,021 | ---- | C] () -- C:\Windows\preview.ini
[2012.03.21 15:14:49 | 000,084,480 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011.12.23 20:58:28 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.12.23 18:06:49 | 000,000,021 | ---- | C] () -- C:\Users\Aupex\AppData\Local\mc.pixel.data
[2011.07.26 16:26:46 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011.07.26 16:26:46 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011.07.26 16:26:46 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011.07.26 16:26:46 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2011.06.08 11:00:20 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011.06.08 11:00:20 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011.06.08 11:00:20 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011.06.08 11:00:20 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011.06.08 11:00:20 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011.06.06 09:41:31 | 000,523,061 | ---- | C] () -- C:\Users\Aupex\mricrocosft.cab
[2011.05.29 08:31:24 | 000,000,558 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\AutoGK.ini
[2011.05.16 16:39:33 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat
[2011.05.16 16:39:33 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat
[2011.05.14 20:36:58 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2011.03.11 11:43:54 | 000,029,763 | ---- | C] () -- C:\Windows\System32\drivers\klopp.dat
[2011.01.25 15:02:14 | 000,032,768 | ---- | C] () -- C:\Windows\System32\MGFPCtrl.dll
[2010.11.28 12:29:00 | 000,045,056 | ---- | C] () -- C:\Windows\System32\ss35pp.dll
[2010.10.12 19:54:54 | 007,424,512 | ---- | C] () -- C:\Users\Aupex\tab.bak
[2010.08.26 21:34:46 | 000,360,723 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\mdbu.bin
[2010.06.29 17:17:29 | 000,345,434 | ---- | C] () -- C:\Users\Aupex\bild 00000.jpg
[2010.04.21 18:43:25 | 000,725,294 | ---- | C] () -- C:\Users\Aupex\.fonts.cache-1
[2010.04.21 18:42:04 | 000,000,000 | ---- | C] () -- C:\Users\Aupex\.gtk-bookmarks
[2010.03.11 21:48:19 | 000,000,093 | ---- | C] () -- C:\Users\Aupex\AppData\Local\fusioncache.dat
[2009.11.03 12:46:01 | 000,001,024 | ---- | C] () -- C:\Users\Aupex\.lmmsrc.xml
[2009.06.02 19:38:33 | 000,001,356 | ---- | C] () -- C:\Users\Aupex\AppData\Local\d3d9caps.dat
[2009.03.26 11:14:56 | 000,007,680 | ---- | C] () -- C:\Users\Aupex\20F112907.lbl
[2009.03.22 19:49:16 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.02.18 10:04:11 | 000,007,680 | ---- | C] () -- C:\Users\Aupex\99L099908.lbl
[2009.01.20 11:23:13 | 000,007,168 | ---- | C] () -- C:\Users\Aupex\bnn.lbl
[2009.01.13 07:11:04 | 000,000,000 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\wklnhst.dat
[2009.01.12 12:16:32 | 000,138,056 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\PnkBstrK.sys
[2009.01.09 20:43:44 | 000,136,704 | ---- | C] () -- C:\Users\Aupex\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.01.06 15:31:21 | 000,005,525 | ---- | C] () -- C:\Users\Aupex\b
[2008.12.28 23:05:28 | 000,027,335 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\nvModes.001
[2008.12.28 23:02:44 | 000,027,335 | ---- | C] () -- C:\Users\Aupex\AppData\Roaming\nvModes.dat
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >
Extras.txt
Code:
OTL Extras logfile created on: 23.11.2012 15:18:14 - Run 3
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Aupex\Desktop\trojanerboard
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,82 Gb Available Physical Memory | 60,61% Memory free
10,72 Gb Paging File | 9,23 Gb Available in Paging File | 86,04% Paging File free
Paging file location(s): d:\pagefile.sys 8000 8000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 41,12 Gb Total Space | 1,70 Gb Free Space | 4,14% Space Free | Partition Type: NTFS
Drive D: | 185,90 Gb Total Space | 1,61 Gb Free Space | 0,87% Space Free | Partition Type: NTFS
Drive E: | 523,86 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: STEFANLAPTOP | User Name: Aupex | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-3814163011-2074231880-4065175572-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- D:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "d:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Betrachten mit XnView] -- "D:\Program Files\XnView\xnview.exe" "%1" (XnView, hxxp://www.xnview.com)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "d:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3814163011-2074231880-4065175572-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 2
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"d:\Program Files\BitTorrent\bittorrent.exe" = d:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D2E0168-A091-438E-A7FA-4897DA0F0DA8}" = lport=137 | protocol=17 | dir=in | app=system |
"{15514728-41F3-48FF-AB66-6CCEFD6FAAA7}" = rport=445 | protocol=6 | dir=out | app=system |
"{16CC534F-D6C6-4BBD-8382-69628BA12263}" = rport=137 | protocol=17 | dir=out | app=system |
"{25FC251C-0C26-41AB-8424-BC383BA73F05}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{342DC21F-8295-4342-909D-A7F279578E63}" = lport=139 | protocol=6 | dir=in | app=system |
"{48883D63-6C84-4CB2-9507-8AF14136E169}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{52F6B97D-D65F-4C2F-9504-13FEAB266629}" = rport=138 | protocol=17 | dir=out | app=system |
"{5FA8909D-B37A-4B82-A038-9BC54D200681}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{65926B19-B9ED-44C3-9A57-4428EC2460E0}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{7705E8D2-3BEF-4495-A65D-A8C8F2D7C117}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{887C0506-54AC-4623-840A-D20902F3AB0E}" = rport=139 | protocol=6 | dir=out | app=system |
"{D40E8E4E-B31C-4D42-BE9A-A503C4AA5243}" = lport=2869 | protocol=6 | dir=in | app=system |
"{EEE08896-C538-44C4-A160-B1410D0CEA56}" = lport=138 | protocol=17 | dir=in | app=system |
"{F2B30D6D-C14D-4B2B-A635-DA319F3F910D}" = lport=445 | protocol=6 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00C4640D-2935-4995-BE9F-4B2C1DA91BB7}" = protocol=6 | dir=in | app=d:\spiele\bf2demo\bf2.exe |
"{013BD9BC-540B-4FC1-9BD7-27A95CFBAA1A}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{07AD8CBF-E94E-437A-A957-0CEB935C3740}" = protocol=6 | dir=in | app=d:\spiele\bf2\bf2.exe |
"{1472F810-7117-4D9A-8B35-DE71E132A0CC}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe |
"{4450E831-A691-4A40-83DD-EA4602401AAE}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{4503EFED-59B8-420A-8A66-7EADBDAFD1E9}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{4AF8D247-2BB2-42B0-8ED6-38643DAD412D}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{4B8DDB3E-D95C-4203-9F64-FAE650133E2C}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe |
"{5AE29E96-1F28-40E1-81EB-ECC181B98D60}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{6D71C4A4-8C55-4051-9CAF-52C2775A4A49}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{7E486AC8-B408-4B5E-AB47-DA73AAAE3851}" = protocol=17 | dir=in | app=d:\spiele\bf2demo\bf2.exe |
"{8EDEB86E-61A8-48A5-9D05-8D2D7DA305A4}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{B32A8D67-D6B3-4B82-AA52-CF4E5170086D}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{B34D8511-DBB8-49C9-B66E-39B4FE65BAC5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C4302411-D9D1-4298-9068-01F52024EB81}" = protocol=17 | dir=in | app=d:\spiele\bf2\bf2.exe |
"{CC94E627-5B38-4F08-AB62-114E4D1DFC3C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{D90F3206-FD62-4239-8891-BF06C088F99B}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{E1E749EA-C830-4C97-A757-351DF17A1A3D}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{EC08F273-D3ED-4C12-A5A6-EF62378C0496}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{EC6CEA8F-7ECF-4685-BCB8-4EDAC6123F64}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{F752E18F-439E-4C66-882B-7F6344B3439A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{00277C92-28A4-4A4F-828C-3C7C15732E9E}" = Banking
"{003447F5-0058-4B77-9C1E-50488F77C4A7}" = Brother P-touch Editor 4.2
"{010C0B4A-DC93-4BB4-893B-BDDE95355A3E}" = Freeware PDF Unlocker
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (JTLWAWI)
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{065D5505-3821-4C2E-BB6C-FE66A7E7CB4F}" = USB Flash Port Driver
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{089EBD9B-DFC0-4416-8DE3-796F8CDA1158}" = ErgoFAKT V4.0
"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{0DEA94ED-915A-4834-A87E-388D012C8E02}" = Medal of Honor Allied Assault
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX420_series" = Canon MX420 series MP Drivers
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{14DC0059-00F1-4F62-BD1A-AB23CD51A95E}" = Adobe AIR
"{14E5D149-FD0F-4595-A84E-68D821167591}" = NetObjects Fusion 11.0
"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)
"{17DFE37C-064E-4834-AD8F-A4B2B4DF68F8}" = Adobe Photoshop Elements 8.0
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1C2B3CEA-482E-4453-B3E2-C9731337828A}" = Microsoft SQL Server 2008 Native Client
"{1D328E11-3B0C-388C-835D-C9C20E8C7734}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}" = Nero MediaHub 10
"{20071984-5EB1-4881-8EDB-082532ACEC6D}" = Heroes of Might and Magic V
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback 10
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{24aab420-4e30-4496-9739-3e216f3de6ae}" = Python 2.6.2
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5
"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{33AE9E89-47C9-4A0D-9E9D-BDD6966A3804}" = Microsoft SQL Server 2008 RsFx Driver
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{34A153FE-6926-4C14-B48A-B71E68C672A8}_is1" = MiniTool Partition Wizard Home Edition 7.1
"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition
"{3717C4F2-7412-4793-9BB8-D73D2817B3D6}" = USB Video/Audio Device Driver
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3AF8C37F-696E-871C-0851-CDE980FD665E}" = Bamboo Dock
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D69628B-4DE8-43C7-9A22-F90F5B870C08}" = ArcSoft TotalMedia Backup
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Security Suite CBE 12
"{477415F5-93DA-46AA-85C5-640047825995}" = Microsoft SQL Server 2008 Database Engine Shared
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A5D4604-EA08-4EDC-8EE7-A004946FB016}" = Terragen 2 Free Edition (Beta)
"{4A6F34E2-09E5-4616-B227-4A26A488A6F9}" = Microsoft SQL Server 2008 Common Files
"{4AF2248C-B3DF-46FB-9596-87F5DB193689}" = Microsoft SQL Server 2008 Browser
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{4EC8B911-98AB-4819-B5EE-D32E8A0A8AAA}_is1" = DVDx 2
"{4EFD0178-748B-4AEF-BF64-51BEF3048F8B}" = Terragen 2 Free Edition
"{519C4DB6-B53B-4F5C-8297-89B2BE949FA5}_is1" = Data Lifeguard Diagnostic for Windows 1.24
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F548A02-80BC-404D-BAE6-F05F9BF6B449}" = Nero DiscCopyGadget 10 Help (CHM)
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{62B7C52C-CAB6-48B1-8245-52356C141C92}" = RENESIS® Player Browser Plugins
"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6B976ADF-8AE8-434E-B282-A06C7F624D2F}" = Python 2.5.2
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{6E0C3C3D-CF8A-4AEC-AD6C-B4486A96BE8E}" = Bamboo Tablets Tutorial
"{6E9CFEF5-0245-411F-8587-CF83DF9D4B05}" = Microsoft SQL Server 2008 Database Engine Services
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{7B4A5C13-069F-4AFE-AE57-C497B4E33C7E}" = Call of Duty(R) 2 Patch 1.3
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87686C21-8A15-4b4d-A3F1-11141D9BE094}" = Battlefield Play4Free
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{8944ED10-DBF2-4FA9-8B5D-D7E1B046C761}_is1" = ColdCut
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8BECF123-B0EF-4E51-B7F3-923EFE15CC4A}" = Battlefield 2(TM) Demo
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E41D2A5-C0DD-4139-8C7A-2F0E1F20ED24}" = CombineZP
"{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10
"{8F311E72-C27F-4DF0-8254-B739A1831668}_is1" = SUPER © v2012.build.53 (Sep 13, 2012) Version v2012.build.53
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{92EC1A84-7FFC-42DF-A8F6-79C21C4765A5}" = Nero DiscCopy Gadget 10
"{93ABEBEB-EEE0-4AB9-A925-2F2EC791A4CE}" = Smart Technology Programming Software 7.0.2.7
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{985F828E-0E98-429F-9C05-EF3BDE7568F7}" = Paragon Drive Backup™ 9.0 Free Edition
"{98E9B724-0E62-4812-B6CC-C6A228BBC562}" = Brother P-touch Address Book 1.0
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10
"{9AA2D735-3375-42D4-9A61-3FFEF82599D6}" = Unterstützungsdateien für Microsoft SQL Server 2008-Setup
"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A662E280-64A8-4CF5-8407-13D0808602B3}" = Call of Duty - United Offensive
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A95E668D-5B58-43E4-9E10-BFF43E943AEB}" = MAGIX Screenshare
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 280.26
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 280.26
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B8E9F8A1-9F4D-43D5-ABD6-1DF067FAA469}" = Microsoft SQL Server 2008 Database Engine Services
"{BBAAAD82-6242-420F-86D4-BD72BB5E6C86}" = Tools für Microsoft SQL Server 2005 Express Edition
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C2F1F96A-057E-5819-B52E-FEA1D1D2933B}" = Acronis*True*Image*Home
"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)
"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C615B4A6-DDE8-4325-BCF8-E53E913D95E9}_is1" = AMR to MP3 Converter 1.4
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{C89AF1D9-A501-4AA5-9E44-9753D0F92347}" = Kidizoom® Pro & Plus
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{C965F01C-76EA-4BD7-973E-46236AE312D7}" = Sql Server Customer Experience Improvement Program
"{CBBC89D4-84CB-48A5-AC5A-88452D3C44D3}" = JTL-Wawi - FastReport - Deployment
"{CCAC7E52-ECCE-3C4D-B1BE-BC2ACF1C1C0E}" = Microsoft Visual Basic 2010 Express - DEU
"{CCEB53A5-A252-4CF3-8602-429AB06BF0AE}" = Terragen
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE52F670-9E10-4C0A-B0CB-D78BAB0A7923}" = NimoFilm
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D074DC76-F6C9-440E-A1D0-1DE958417FDB}" = Microsoft SQL Server VSS Writer
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}" = System Control Manager
"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EF67AE1A-6B31-4C98-91A9-F195D8702150}" = Google Drive
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1D6862B-7112-45CC-B008-2F9D4D409285}" = MAGIX Video deluxe 17 Plus Sonderedition
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F3494AB6-6900-41C6-AF57-823626827ED8}" = Microsoft SQL Server 2008 Database Engine Shared
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F5CA1223-2B80-4901-AB52-1595A7DE13D1}" = MAGIX Speed burnR (MSI)
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F7E1CA14-B39D-452A-960B-39423DDDD933}" = DriveImage XML (Private Edition)
"{F850707C-B6A0-4B56-8709-F89CF8F9AC6D}" = Eraser
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1" = StreamTransport version: 1.0.2.2171
"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FF6F95A4-E59B-45C8-BEA8-0BDC8D9CAB51}" = Microsoft SQL Server 2008 Common Files
"7D6D030B3D73FCCA3D4E45319380F315DFBE7A54" = Windows-Treiberpaket - Infineon Technologies (FlashUSB) USB  (04/16/2009 1.0.0.6)
"7-Zip" = 7-Zip 9.20
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 8.0" = Adobe Photoshop Elements 8.0
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Anti-Twin 2010-09-22 17.58.58" = Anti-Twin (Installation 22.09.2010)
"ASIO4ALL" = ASIO4ALL
"Audacity_is1" = Audacity 1.2.6
"AutoGK" = Auto Gordian Knot 2.55
"AviSynth" = AviSynth 2.5
"Bamboo Dock" = Bamboo Dock
"bgbennyboyEMIReplacementSetup_is1" = Escape From Monkey Island
"Biet-O-Matic v2.10.1" = Biet-O-Matic v2.10.1
"Blender" = Blender
"Bryce 7.1 7.1.0.109" = Bryce 7.1
"Caligari trueSpace7.61 Beta 8 Standalone_is1" = Uninstall trueSpace7.61 Beta 8 Standalone
"Call of Duty" = Call of Duty
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"Canon MX420 series Benutzerregistrierung" = Canon MX420 series Benutzerregistrierung
"Canon RAW Codec" = Canon RAW Codec
"Canon_IJ_Network_Scanner_Selector_EX" = Canon IJ Network Scanner Selector EX
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"CCleaner" = CCleaner
"CGLsilent" = CGLsilent 1.0.4.1
"Color Efex Pro 3.0 Stand-Alone Standard" = Color Efex Pro 3.0 Standard
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"Defraggler" = Defraggler
"Die Hochzeitsdrucker_is1" = Die Hochzeitsdrucker 1.5
"Digital Photo Professional" = Canon Utilities Digital Photo Professional 3.11
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"DLDIrc" = DLDIrc
"DupDetector_is1" = DupDetector 3.302
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Flick_is1" = DVD Flick 1.3.0.7
"DVD Shrink_is1" = DVD Shrink 3.2
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"Elements+_is1" = Elements+ for PSE 8 (demo)
"EOS Utility" = Canon Utilities EOS Utility
"Eraser" = Eraser
"Everest Poker" = Everest Poker (Remove Only)
"ffdshow_is1" = ffdshow [rev 2946] [2009-05-15]
"FileZilla Client" = FileZilla Client 3.5.3
"Free Download Manager_is1" = Free Download Manager 3.0
"Free DVD Decrypter_is1" = Free DVD Decrypter version 1.5.6.908
"Free DVD Video Converter_is1" = Free DVD Video Converter version 1.5.12
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.18.403
"GIMP-2_is1" = GIMP 2.8.2
"HaaliMkx" = Haali Media Splitter
"HandBrake" = HandBrake 0.9.6
"HD Tune_is1" = HD Tune 2.55
"HDD Health_is1" = HDD Health v3.3 Beta
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Hugin" = Hugin 2011.4.0
"Hybrid" = Hybrid (remove only)
"Infineon USB driver_is1" = Infineon USB driver 1.0.0.6
"Inkscape" = Inkscape 0.48.2
"InstallShield_{003447F5-0058-4B77-9C1E-50488F77C4A7}" = Brother P-touch Editor 4.2
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{98E9B724-0E62-4812-B6CC-C6A228BBC562}" = Brother P-touch Address Book 1.0
"InstallShield_{A662E280-64A8-4CF5-8407-13D0808602B3}" = Call of Duty - United Offensive
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"InstallWIX_{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Security Suite CBE 12
"InvelosDVDProfiler_is1" = DVD Profiler Version 3.5.1
"IrfanView" = IrfanView (remove only)
"JTL-Wawi_is1" = JTL-Wawi
"Lair of the Leviathan" = Tales of Monkey Island - Lair of the Leviathan
"Launch of the Screaming Narwhal" = Tales of Monkey Island - Launch of the Screaming Narwhal
"Lidl-Fotos_is1" = Lidl-Fotos
"Live 8.2.6" = Live 8.2.6
"MAGIX_MSI_Videodeluxe17_plus" = MAGIX Video deluxe 17 Plus Sonderedition
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Maniac Mansion Deluxe" = Maniac Mansion Deluxe
"Mediencenter Software" = Mediencenter Assistent
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft SQL Server 10" = Microsoft SQL Server 2008
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Visual Basic 2010 Express - DEU" = Microsoft Visual Basic 2010 Express - DEU
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MozBackup" = MozBackup 1.4.10
"Mozilla Firefox (3.5)" = Mozilla Firefox (3.5)
"Mozilla Thunderbird (3.1.4)" = Mozilla Thunderbird (3.1.4)
"MP Navigator EX 4.1" = Canon MP Navigator EX 4.1
"Mp3tag" = Mp3tag v2.44
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"NAVIGON Fresh" = NAVIGON Fresh 3.3.2
"NewBlue Light Rays for Magix" = NewBlue Light Rays for Magix
"NewBlue Lightning for Magix" = NewBlue Lightning for Magix
"Nmap" = Nmap 4.85BETA9
"OpenAL" = OpenAL
"Passbild-Generator_is1" = Bewerbungsfoto-/Passbild-Generator v3.5a
"Pen Tablet Driver" = Bamboo
"PhotomatixPro3x32_is1" = Photomatix Pro version 3.2.9
"PhotoStitch" = Canon Utilities PhotoStitch
"Picture Style Editor" = Canon Utilities Picture Style Editor
"PokerStars" = PokerStars
"proDAD-Heroglyph-2.5" = proDAD Heroglyph 2.5
"PunkBusterSvc" = PunkBuster Services
"RasterVect 17.3 Trial_is1" = RasterVect 17.3 Trial
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"ReBirth RB-338 2.0" = ReBirth RB-338 2.0
"Recuva" = Recuva
"RemoteCaptureDC" = Canon Utilities RemoteCapture DC
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"Return to Castle Wolfenstein" = Return to Castle Wolfenstein
"Rise of the Pirate God" = Tales of Monkey Island - Rise of the Pirate God
"Sandboxie" = Sandboxie 3.34
"Secunia PSI" = Secunia PSI (2.0.0.3003)
"ShrinkTo5Basic" = ShrinkTo5Basic
"Soldier of Fortune II - Double Helix" = Soldier of Fortune II - Double Helix
"Speed Dial Utility" = Canon Kurzwahlprogramm
"SpeedFan" = SpeedFan (remove only)
"SUPER ©" = SUPER © Version 2010.bld.37 (Jan 2, 2010)
"SystemRequirementsLab" = System Requirements Lab
"Tales of Monkey Island" = Tales of Monkey Island
"The Siege of Spinner Cay" = Tales of Monkey Island - The Siege of Spinner Cay
"The Trial and Execution of Guybrush Threepwood" = Tales of Monkey Island - The Trial and Execution of Guybrush Threepwood
"Uninstall_is1" = Uninstall 1.0.0.1
"VidCoder_is1" = VidCoder 0.8.0 (x86)
"virtualPhotographer_is1" = virtualPhotographer 1.5.6
"VLC media player" = VLC media player 1.1.10
"VobSub" = VobSub v2.23 (Remove Only)
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Internet Explorer and Netscape" = WebTablet FB Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1" = Bamboo Dock
"WaveSurgeon (Evaluation)_is1" = WaveSurgeon (Evaluation) 2.8.1
"WinLiveSuite" = Windows Live Essentials
"winpcap-nmap" = winpcap-nmap 4.02
"WinRAR archiver" = WinRAR archiver
"x264vfw" = x264vfw - H.264/MPEG-4 AVC codec (remove only)
"Xilisoft Download YouTube Video" = Xilisoft Download YouTube Video
"XMedia Recode" = XMedia Recode 2.1.8.0
"XnView_is1" = XnView 1.95.4
"XviD MPEG4 Video Codec" = XviD MPEG4 Video Codec (remove only)
"Xvid_is1" = Xvid 1.1.3 final uninstall
"Zak McKracken - Between Time and Space" = Zak McKracken - Between Time and Space
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3814163011-2074231880-4065175572-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
"Mozilla Thunderbird 16.0.2 (x86 de)" = Mozilla Thunderbird 16.0.2 (x86 de)
"pycrypto-py2.6" = Python 2.6 pycrypto-2.0.1
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 20.11.2012 10:11:13 | Computer Name = Stefanlaptop | Source = Windows Search Service | ID = 3013
Description =
 
Error - 22.11.2012 07:19:00 | Computer Name = Stefanlaptop | Source = Windows Search Service | ID = 3013
Description =
 
Error - 22.11.2012 07:19:00 | Computer Name = Stefanlaptop | Source = Windows Search Service | ID = 3013
Description =
 
Error - 23.11.2012 01:05:32 | Computer Name = Stefanlaptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 23.11.2012 01:05:32 | Computer Name = Stefanlaptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2343
 
Error - 23.11.2012 01:05:32 | Computer Name = Stefanlaptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2343
 
Error - 23.11.2012 01:05:34 | Computer Name = Stefanlaptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 23.11.2012 01:05:34 | Computer Name = Stefanlaptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4359
 
Error - 23.11.2012 01:05:34 | Computer Name = Stefanlaptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4359
 
Error - 23.11.2012 10:00:35 | Computer Name = Stefanlaptop | Source = Windows Search Service | ID = 3013
Description =
 
[ System Events ]
Error - 22.11.2012 10:05:53 | Computer Name = Stefanlaptop | Source = Service Control Manager | ID = 7030
Description =
 
Error - 22.11.2012 10:11:54 | Computer Name = Stefanlaptop | Source = Service Control Manager | ID = 7030
Description =
 
Error - 22.11.2012 10:22:56 | Computer Name = Stefanlaptop | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 22.11.2012 10:23:30 | Computer Name = Stefanlaptop | Source = Service Control Manager | ID = 7001
Description =
 
Error - 22.11.2012 15:21:37 | Computer Name = Stefanlaptop | Source = Service Control Manager | ID = 7030
Description =
 
Error - 22.11.2012 15:27:22 | Computer Name = Stefanlaptop | Source = Service Control Manager | ID = 7030
Description =
 
Error - 22.11.2012 15:32:21 | Computer Name = Stefanlaptop | Source = Service Control Manager | ID = 7030
Description =
 
Error - 23.11.2012 00:54:43 | Computer Name = Stefanlaptop | Source = Service Control Manager | ID = 7001
Description =
 
Error - 23.11.2012 09:57:14 | Computer Name = Stefanlaptop | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 23.11.2012 09:59:03 | Computer Name = Stefanlaptop | Source = Service Control Manager | ID = 7001
Description =
 
 
< End of report >

cosinus 23.11.2012 20:07
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes - denk bitte vorher daran, Malwarebytes über den Updatebutton zu aktualisieren

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


aupex 24.11.2012 05:57
Eset
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=ef0e72d12eb71341aa2c1d944058147d
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-11-24 01:43:45
# local_time=2012-11-24 02:43:45 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 98251261 98251261 0 0
# compatibility_mode=1280 16777215 100 0 0 0 0 0
# compatibility_mode=4352 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776573 100 100 23646 191233913 0 0
# compatibility_mode=8192 67108863 100 0 4124 4124 0 0
# scanned=486707
# found=1
# cleaned=0
# scan_time=20239
C:\Program Files\Trend Micro\HijackThis\backups\backup-20091217-212620-476.dll        probably a variant of Win32/Toolbar.Widgi application (unable to clean)        00000000000000000000000000000000        I
Mbam-Log
Code:
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.23.08

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Aupex :: STEFANLAPTOP [Administrator]

23.11.2012 20:47:44
mbam-log-2012-11-23 (20-47-44).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 265932
Laufzeit: 5 Minute(n), 58 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

cosinus 26.11.2012 14:20
Sieht soweit ok aus, nur ein Fund in einem Hijackthis-Backup

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

aupex 26.11.2012 21:08
Danke für Deine Hilfe.
Rechner läuft. Der Internetexplorer meckert zwar noch, dass die inetcpl.cpl fehlt, aber ich denke das ist ein Folgeschaden.
Firefox funktioniert jetzt wieder ohne Hänger, nachdem Ich Flash deaktiviert habe.
Neueste Flashversion habe ich noch nicht installiert.

Vielen Dank nochmal.

Gruß

Aupex

cosinus 26.11.2012 21:18
Zitat:
Der Internetexplorer meckert zwar noch, dass die inetcpl.cpl fehlt, aber ich denke das ist ein Folgeschaden.
Neuinstallation bzw. Reparatur von Internet Explorer in Windows 7, Windows Vista und Windows XP

aupex 27.11.2012 18:09
Funktioniert nicht.
Neuinstallation funktioniert nicht und die anderen Tips auf der Seite auch nicht. Fixit setzt nur die Sicherheitseinstellungen zurück und den ersten Tip kann ich gar nicht nutzen, da der IE nicht startet (geht nur ein Fenster auf "Downloads anzeigen".) Das eigentlich Browserfenster geht sofort wieder zu.
Neuinstallation funktioniert nicht, da ich scheinbar eine Neuere Version als die angebotene (IE9) auf dem Rechner habe...
Ist aber eigentlich nicht tragisch, da ich den IE sowieso nicht nutze.

Gruß

cosinus 27.11.2012 19:41
Ähm naja, der IE ist eine Windows-Kernkomponente, deswegen würde ich dieses Problem nicht gerade auf die leichte Schulter nehmen :(

Richte dir bitte mal über die Systemsteuerung/Benutzerkonten ein 2. Windows-Benutzerkonto ein, username testuser oder so. Ruhig Adminrechte. Log dich als, als testuser ein und teste damit mal den IE.

Ich will nämlich mal wissen wie der IE sich bei dir bei einem Benutzer mit komplett frischem Benutzerprofil verhält.

aupex 27.11.2012 20:34
Liste der Anhänge anzeigen (Anzahl: 1)
Kommt wieder das gleiche Fenster.
Habe mal einen Screenshot angehängt. Allerdings kommt beim Testuser keine Fehlermeldung wg. inetcpl.cpl sondern eben nur dieses Fenster.
Erst geht der IE auf, wenn ich allerdings eine Adresse eingebe (hier z.b. google.com) schliesst sich das Fenster und das DL Fenster öffnet sich.
Ich habe bisher nur versucht den IE erneut zu installieren (also so wie auf der MS Seite vorgeschlagen.) Ich wollte jetzt den IE noch nicht deinstallieren und komplett neu installieren. Soll ich das mal versuchen? (Wie du gesagt hast -> Kernkomponente... da tu ich mir mit dem Deinstallieren etwas schwer; d.h. muss ich irgendetwas beachten?)

Gruß

cosinus 27.11.2012 20:55
Versuch es mit diesem frischen Konto einfach nochmal mit dem MS-Artikel...

aupex 28.11.2012 12:41
Klappt auch nicht.
Tip 1 (Auf Extra->Internetoptionen) passiert gar nichts (Internetoptionen öffnen sich nicht).
Tip 2 (Fix It) läuft durch, bringt aber nichts.

Habe mal gegooglet, und was gefunden wie "eine neue inetcpl.cpl extrahieren" (MS-Knowledge Base-Artikel). Allerdings fehlt mir dazu die Win-CD (Habe nur eine Recovery)...
Soll ich versuchen IE zu deinstallieren und erneut zu installieren?

cosinus 28.11.2012 12:57
Zitat:
Soll ich versuchen IE zu deinstallieren und erneut zu installieren?
Probier mal, anosnten müsste ich mal auf meinem anderen PC die Vista-VM anschmeißen und dir die inetcpl.cpl zukommen lassen :wtf:

aupex 28.11.2012 17:58
Super. Scheint zu funktionieren.
Danke

cosinus 29.11.2012 10:37
Dann wären wir durch wenn du keine offenen Themen mehr hast! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

aupex 30.11.2012 20:08
Bin gerade beim "alles aktualisieren". Wenn ich die neueste Java installieren möchte (alte mit JavaRA deinstalliert) kommt:
"....Java_sp.dll is corrupt" hmmm

cosinus 30.11.2012 21:39
Lass Java erstmal weg. Nicht immer braucht man das zwingend.
Hört sich aber danach an, als wenn du einen korrupten Download hättest. Einfach mal die 32-Bit-JRE Variante als offline-version nochmal neu runterladen und installieren wenn du das JRE denn wirklich brauchst


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:48 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130