Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   TR/Drop.Agent.TF.2 Trojaner gefunden (https://www.trojaner-board.de/130267-tr-drop-agent-tf-2-trojaner-gefunden.html)

Kaffeevampy 29.01.2013 11:32
TR/Drop.Agent.TF.2 Trojaner gefunden
 
Grüßt euch!

Mein Echtzeitscanner von Antivir hat mir gestern einen Trojaner angezeigt.
Dabei handelt es sich um den TR/drop.Agent.TF.2
Zu diesem Trojaner gibt es aber weder Foreneinträge noch gibt es in den Infos zu den Viren einen Eintrag.
Nachdem dieser in die Quarantäne flog, hatte ich gute hoffnungen das er damit beseitigt ist. Nun habe ich schon 3x den Suchlauf gestarten und beim ersten Mal hat er ihn nocheinmal gefunden. Bei Versuch 2 und 3 waren keine Funde mehr zu sehen. Virenscan läuft erneut und ich bin guter Dinge das dieser damit endgültig beseitigt ist. Jedoch kann man sich da ja nicht so sicher sein.
Könntet ihr mir eventuell Informationen darüber geben, was genau es mit dem Trojaner auf sich hat?

Log folgt im Anschluss

Code:
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Montag, 28. Januar 2013  22:30


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira Free Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows Vista (TM) Home Premium
Windowsversion : (Service Pack 2)  [6.0.6002]
Boot Modus    : Normal gebootet
Benutzername  : Sophia
Computername  : SOPHIA-PC

Versionsinformationen:
BUILD.DAT      : 13.0.0.2890    48567 Bytes  05.12.2012 17:11:00
AVSCAN.EXE    : 13.6.0.402    639264 Bytes  04.12.2012 14:37:47
AVSCANRC.DLL  : 13.4.0.360    64800 Bytes  28.11.2012 14:09:15
LUKE.DLL      : 13.6.0.400    67360 Bytes  04.12.2012 11:13:05
AVSCPLR.DLL    : 13.6.0.402    93984 Bytes  04.12.2012 14:37:55
AVREG.DLL      : 13.6.0.406    248096 Bytes  04.12.2012 17:40:31
avlode.dll    : 13.6.1.402    428832 Bytes  04.12.2012 14:36:57
avlode.rdf    : 13.0.0.26      7958 Bytes  22.11.2012 10:59:16
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 13:50:29
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 13:50:31
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 13:50:34
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 13:50:36
VBASE004.VDF  : 7.11.26.44  4329472 Bytes  28.03.2012 13:50:37
VBASE005.VDF  : 7.11.34.116  4034048 Bytes  29.06.2012 13:42:40
VBASE006.VDF  : 7.11.41.250  4902400 Bytes  06.09.2012 13:42:40
VBASE007.VDF  : 7.11.50.230  3904512 Bytes  22.11.2012 12:43:11
VBASE008.VDF  : 7.11.55.142  2214912 Bytes  03.01.2013 14:01:44
VBASE009.VDF  : 7.11.55.143    2048 Bytes  03.01.2013 14:01:44
VBASE010.VDF  : 7.11.55.144    2048 Bytes  03.01.2013 14:01:44
VBASE011.VDF  : 7.11.55.145    2048 Bytes  03.01.2013 14:01:44
VBASE012.VDF  : 7.11.55.146    2048 Bytes  03.01.2013 14:01:44
VBASE013.VDF  : 7.11.55.196  260096 Bytes  04.01.2013 11:12:00
VBASE014.VDF  : 7.11.56.23    206848 Bytes  07.01.2013 16:21:58
VBASE015.VDF  : 7.11.56.83    186880 Bytes  08.01.2013 21:58:54
VBASE016.VDF  : 7.11.56.145  135168 Bytes  09.01.2013 17:52:52
VBASE017.VDF  : 7.11.56.211  139776 Bytes  11.01.2013 16:40:30
VBASE018.VDF  : 7.11.57.11    153088 Bytes  13.01.2013 21:55:16
VBASE019.VDF  : 7.11.57.75    165888 Bytes  15.01.2013 18:00:40
VBASE020.VDF  : 7.11.57.163  190976 Bytes  17.01.2013 17:34:27
VBASE021.VDF  : 7.11.57.219  119808 Bytes  18.01.2013 09:13:59
VBASE022.VDF  : 7.11.58.7    167936 Bytes  21.01.2013 16:24:19
VBASE023.VDF  : 7.11.58.49    140288 Bytes  22.01.2013 16:55:55
VBASE024.VDF  : 7.11.58.119  137728 Bytes  24.01.2013 18:43:01
VBASE025.VDF  : 7.11.58.175  132608 Bytes  25.01.2013 06:38:36
VBASE026.VDF  : 7.11.58.213  116736 Bytes  27.01.2013 14:41:48
VBASE027.VDF  : 7.11.58.236  1738752 Bytes  28.01.2013 17:06:24
VBASE028.VDF  : 7.11.58.237    2048 Bytes  28.01.2013 17:06:24
VBASE029.VDF  : 7.11.58.238    2048 Bytes  28.01.2013 17:06:24
VBASE030.VDF  : 7.11.58.239    2048 Bytes  28.01.2013 17:06:24
VBASE031.VDF  : 7.11.58.242    31744 Bytes  28.01.2013 21:27:37
Engineversion  : 8.2.10.238
AEVDF.DLL      : 8.1.2.10      102772 Bytes  19.09.2012 13:42:55
AESCRIPT.DLL  : 8.1.4.84      467322 Bytes  24.01.2013 18:43:06
AESCN.DLL      : 8.1.10.0      131445 Bytes  17.12.2012 09:38:24
AESBX.DLL      : 8.2.5.12      606578 Bytes  28.08.2012 15:58:06
AERDL.DLL      : 8.2.0.88      643444 Bytes  10.01.2013 17:53:03
AEPACK.DLL    : 8.3.1.2      819574 Bytes  20.12.2012 17:49:33
AEOFFICE.DLL  : 8.1.2.50      201084 Bytes  05.11.2012 14:00:38
AEHEUR.DLL    : 8.1.4.182    5706104 Bytes  24.01.2013 18:43:05
AEHELP.DLL    : 8.1.25.2      258423 Bytes  12.10.2012 14:52:32
AEGEN.DLL      : 8.1.6.16      434549 Bytes  24.01.2013 18:43:02
AEEXP.DLL      : 8.3.0.14      188788 Bytes  24.01.2013 18:43:06
AEEMU.DLL      : 8.1.3.2      393587 Bytes  19.09.2012 13:42:55
AECORE.DLL    : 8.1.30.0      201079 Bytes  17.12.2012 09:38:21
AEBB.DLL      : 8.1.1.4        53619 Bytes  05.11.2012 14:00:38
AVWINLL.DLL    : 13.4.0.163    25888 Bytes  19.09.2012 17:09:30
AVPREF.DLL    : 13.4.0.360    50464 Bytes  28.11.2012 14:05:52
AVREP.DLL      : 13.4.0.360    177952 Bytes  28.11.2012 14:06:10
AVARKT.DLL    : 13.6.0.402    260384 Bytes  04.12.2012 14:36:03
AVEVTLOG.DLL  : 13.6.0.400    167200 Bytes  04.12.2012 11:04:02
SQLITE3.DLL    : 3.7.0.1      397088 Bytes  19.09.2012 17:17:40
AVSMTP.DLL    : 13.4.0.163    62240 Bytes  19.09.2012 17:08:54
NETNT.DLL      : 13.4.0.360    15648 Bytes  28.11.2012 14:07:51
RCIMAGE.DLL    : 13.4.0.360  4780832 Bytes  28.11.2012 14:09:40
RCTEXT.DLL    : 13.4.0.360    68384 Bytes  28.11.2012 14:09:40

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Festplatten
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\alldiscs.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Montag, 28. Januar 2013  22:30

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD1
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'D:\'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'firefox.exe' - '109' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '92' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '129' Modul(e) wurden durchsucht
Durchsuche Prozess 'mobsync.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '7' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'SeaPort.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'PnkBstrA.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvtray.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'SSScheduler.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehmsas.exe' - '19' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnscfg.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehtray.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtHDVCpl.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '145' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvxdsync.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '147' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '115' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '1912' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\Users\Sophia\AppData\Local\Temp\contentDATs.exe
  [FUND]      Ist das Trojanische Pferd TR/Drop.Agent.TF.2
Beginne mit der Suche in 'D:\'

Beginne mit der Desinfektion:
C:\Users\Sophia\AppData\Local\Temp\contentDATs.exe
  [FUND]      Ist das Trojanische Pferd TR/Drop.Agent.TF.2
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '55c7f570.qua' verschoben!


Ende des Suchlaufs: Dienstag, 29. Januar 2013  06:00
Benötigte Zeit:  6:56:16 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  30985 Verzeichnisse wurden überprüft
 541869 Dateien wurden geprüft
      1 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      1 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 541868 Dateien ohne Befall
  6451 Archive wurden durchsucht
      0 Warnungen
      1 Hinweise

markusg 29.01.2013 12:10
hi
öffne Avira, Verwaltung, Quarantäne, und poste die Fundmeldungen sammt Pfadangaben.

Kaffeevampy 29.01.2013 12:21
Typ : Datei
Meldung: TR/Drop.Agent.TF.2
Quelle: C:\Users\Sophia\Appdata\local\Temp\ContentDATs.exe

Meinst Du so?

weiß wirklich niemand eine Antwort auf mein Problem? :heulen:

markusg 29.01.2013 15:02
hi
wir haben noch mehr leute, außer dich... also geduld, oder geh in ein PC geschäft, die sehen sich dein Gerät dann gegen bezahlung an
gibts weitere Meldungen, dann posten

Kaffeevampy 29.01.2013 15:22
Das war nicht böse gemeint -.-
Kein Grund gleich so sauer zu reagieren.

markusg 29.01.2013 16:18
gab es weitere Funde, oder nicht, wenn ja, poste sie, danke.

Kaffeevampy 29.01.2013 16:24
Bislang gab es keine weiteren Funde nein...Habe den Suchlauf nocheinmal gestartet.

markusg 29.01.2013 16:26
Hi
suchlauf kannst du abbrechen, wir schaun mal weiter:
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Kaffeevampy 29.01.2013 16:40
Kann den Scan leider nicht mehr abbrechen...
Führe den OTL scan durch sobald er fertig ist mit scannen.

markusg 29.01.2013 19:04
dann poste außerdem das log vom aktuellen avira scan

Kaffeevampy 29.01.2013 20:53
Da wartet man ü3 Stunden auf den Report und es wird keiner angezeigt O.o
Als hätte ich dieses Suchlauf nie gemacht...
naja gut dann weiter zum nächsten Schritt

So hier das Log vom OTL:

Code:
OTL logfile created on: 29.01.2013 20:54:18 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Sophia\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19393)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,05 Gb Available Physical Memory | 68,41% Memory free
8,77 Gb Paging File | 7,65 Gb Available in Paging File | 87,26% Paging File free
Paging file location(s): c:\pagefile.sys 6000 6000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 457,75 Gb Total Space | 291,98 Gb Free Space | 63,78% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 379,10 Gb Free Space | 81,39% Space Free | Partition Type: NTFS
 
Computer Name: SOPHIA-PC | User Name: **** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.01.29 16:33:46 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sophia\Downloads\OTL.exe
PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.12.04 15:36:48 | 000,384,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.12.04 12:13:51 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.12.04 12:04:24 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.11.21 19:00:02 | 000,079,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.10.26 19:16:12 | 000,271,808 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\3.0.313\SSScheduler.exe
PRC - [2012.10.02 20:29:14 | 000,864,616 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\NvXDSync.exe
PRC - [2012.10.02 20:28:55 | 001,820,520 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe
PRC - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2010.09.22 11:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2010.09.21 13:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2010.09.21 13:03:14 | 000,193,408 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2009.04.10 22:28:04 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.19 08:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV - [2013.01.19 10:17:16 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.12.04 12:13:51 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.12.04 12:04:24 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.10.26 19:15:26 | 000,234,776 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\3.0.313\McCHSvc.exe -- (McComponentHostService)
SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.08.30 20:13:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2010.09.22 23:21:24 | 001,493,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2010.09.22 15:33:04 | 000,051,040 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.09.22 11:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2010.09.21 13:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\usbaapl.sys -- (USBAAPL)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\athur.sys -- (athur)
DRV - File not found [Kernel | Auto | Stopped] --  -- (Aspi32)
DRV - [2012.11.27 10:01:26 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.11.22 15:51:13 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012.11.22 15:50:51 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.10.10 21:14:28 | 010,837,352 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012.08.27 14:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2012.01.22 00:29:46 | 000,278,728 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2012.01.22 00:29:45 | 000,025,416 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2011.11.17 10:38:32 | 000,039,016 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tbhsd.sys -- (tbhsd)
DRV - [2011.11.17 10:38:28 | 000,031,848 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rrnetcap.sys -- (RRNetCapMP)
DRV - [2011.11.17 10:38:28 | 000,031,848 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rrnetcap.sys -- (RRNetCap)
DRV - [2007.11.18 02:39:50 | 001,040,544 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2007.08.09 17:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007.06.28 06:18:10 | 001,310,720 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CM108.sys -- (USBPNPA)
DRV - [2006.11.02 08:30:56 | 000,047,104 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.live.com/1rewlive4startup/home
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q={searchTerms}&src=IE-SearchBox
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: %7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:4.2.1.9
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@gamersfirst.com/LiveLauncher: C:\Program Files\GamersFirst\LIVE!\nplivelauncher.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files\McAfee Security Scan\3.0.313\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.19 10:17:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.19 10:17:17 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011.09.20 13:55:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sophia\AppData\Roaming\mozilla\Extensions
[2012.12.11 21:42:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sophia\AppData\Roaming\mozilla\Firefox\Profiles\hv9dnq3i.default\extensions
[2012.12.11 21:42:17 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Sophia\AppData\Roaming\mozilla\firefox\profiles\hv9dnq3i.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.01.19 10:17:05 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.01.19 10:17:17 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.07.19 18:04:56 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.10 23:16:21 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.07.19 18:04:56 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.19 18:04:56 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.19 18:04:56 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.19 18:04:56 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Programme\McAfee Security Scan\3.0.313\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Conime] C:\Windows\System32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Akamai NetSession Interface] "C:\Users\Sophia\AppData\Local\Akamai\netsession_win.exe" File not found
O4 - HKCU..\Run: [EPSON SX130 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIHJE.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sophia\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{37B4C0C8-BAA0-45FA-B35B-30FA65F99D95}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9FB498F4-60CC-4500-84FB-A7B95E554BA7}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CBE7A64F-863F-41C6-B7A2-A2F1E6FD2151}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\livecall - No CLSID value found
O18 - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Sophia\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Sophia\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.01.28 22:03:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2013.01.27 19:41:08 | 000,000,000 | ---D | C] -- C:\Users\Sophia\AppData\Roaming\TS3Client
[2013.01.27 19:40:50 | 000,000,000 | ---D | C] -- C:\Users\Sophia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2013.01.27 19:40:45 | 000,000,000 | ---D | C] -- C:\Users\Sophia\AppData\Local\TeamSpeak 3 Client
[2013.01.23 22:19:12 | 000,000,000 | ---D | C] -- C:\Users\Sophia\AppData\Local\Macromedia
[2013.01.19 10:17:03 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2011.09.09 13:33:09 | 086,402,648 | ---- | C] (K2 Network, Inc.) -- C:\Program Files\APB_Reloaded_Installer.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.01.29 18:58:57 | 000,004,048 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.29 18:58:57 | 000,004,048 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.29 14:58:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.29 14:58:46 | 3219,709,952 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.29 10:04:59 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{B5B1BA2B-59A9-44F7-B7ED-39CD2E077EE4}.job
[2013.01.28 22:03:17 | 000,001,911 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013.01.28 22:03:17 | 000,001,911 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013.01.28 20:05:51 | 000,639,356 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.01.28 20:05:51 | 000,604,950 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.01.28 20:05:51 | 000,131,202 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.01.28 20:05:51 | 000,108,282 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.01.27 19:40:51 | 000,001,017 | ---- | M] () -- C:\Users\Sophia\Desktop\TeamSpeak 3 Client.lnk
[2013.01.27 13:31:11 | 000,077,824 | ---- | M] () -- C:\Users\Sophia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.01.11 15:14:38 | 000,000,104 | ---- | M] () -- C:\Users\Sophia\Desktop\Papierkorb.lnk
[2013.01.10 19:23:35 | 000,231,016 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.01.28 22:03:17 | 000,001,911 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013.01.27 19:40:51 | 000,001,017 | ---- | C] () -- C:\Users\Sophia\Desktop\TeamSpeak 3 Client.lnk
[2013.01.11 15:14:38 | 000,000,104 | ---- | C] () -- C:\Users\Sophia\Desktop\Papierkorb.lnk
[2012.12.27 09:26:15 | 000,508,189 | ---- | C] () -- C:\Users\Sophia\Weiterbewilligungsantrag-Arbeitslosengeld-II.pdf
[2012.10.03 22:19:06 | 000,000,094 | ---- | C] () -- C:\Users\Sophia\AppData\Local\fusioncache.dat
[2012.05.25 17:43:22 | 000,003,636 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012.04.01 02:32:10 | 000,001,012 | ---- | C] () -- C:\Users\Sophia\Jule Brief.rtf
[2012.01.22 00:29:46 | 000,278,728 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2012.01.22 00:29:45 | 000,025,416 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2012.01.04 12:43:02 | 000,000,000 | ---- | C] () -- C:\Windows\PROTOCOL.INI
[2011.10.27 21:39:11 | 000,043,126 | ---- | C] () -- C:\Users\Sophia\Jonas.jpg
[2011.09.22 15:34:26 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011.09.21 20:17:52 | 000,001,892 | ---- | C] () -- C:\Users\Sophia\Adobe Reader X.lnk
[2011.09.09 14:48:33 | 000,140,232 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2011.09.09 14:48:33 | 000,138,904 | ---- | C] () -- C:\Users\Sophia\AppData\Roaming\PnkBstrK.sys
[2011.09.09 14:48:15 | 000,283,416 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2011.09.09 14:48:13 | 000,076,888 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2011.09.09 13:33:09 | 3816,745,337 | ---- | C] () -- C:\Program Files\Client1.5.1.565640.7z
[2011.09.08 10:06:41 | 000,077,824 | ---- | C] () -- C:\Users\Sophia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.06.11 21:08:00 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.06.11 21:06:48 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.06.11 21:06:48 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011.05.14 14:48:16 | 000,000,680 | ---- | C] () -- C:\Users\Sophia\AppData\Local\d3d9caps.dat
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.10 22:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.10 22:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.07.17 20:24:08 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Artogon
[2012.07.17 21:37:37 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Boomzap
[2012.10.05 22:32:02 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\DVDVideoSoft
[2011.06.19 20:24:05 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.08.09 22:50:54 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Elephant Games
[2012.07.13 23:37:20 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\ERS Game Studios
[2012.07.18 23:05:59 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Fenomen Games
[2012.08.10 23:21:08 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Frogwares
[2012.01.03 23:13:39 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\runic games
[2011.09.21 21:07:13 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Temp
[2013.01.28 23:30:55 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\TS3Client
[2012.06.14 15:47:50 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\TuneUp Software
[2011.12.29 00:58:20 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Wildlife Park 2
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:D987CB43
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:9FD757A9
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:762408BA
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:363E775E
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:2E636DD9
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:206470A5
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:927EC486

< End of report >
Ist das so richtig? Oder muss ich deinen Code Post bei mir einfügen und dann scannen, damit es Dir leichter fällt die Fehler zu finden?

Kaffeevampy 30.01.2013 23:17
hier das Log mit den aus deinem "Code" post kopierten Text.


Code:
OTL logfile created on: 30.01.2013 22:56:46 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Sophia\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19393)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,02 Gb Available Physical Memory | 67,48% Memory free
8,77 Gb Paging File | 7,71 Gb Available in Paging File | 87,91% Paging File free
Paging file location(s): c:\pagefile.sys 6000 6000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 457,75 Gb Total Space | 291,68 Gb Free Space | 63,72% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 379,10 Gb Free Space | 81,39% Space Free | Partition Type: NTFS
 
Computer Name: **** | User Name: **** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.01.29 16:33:46 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sophia\Downloads\OTL.exe
PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.12.04 15:36:48 | 000,384,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.12.04 12:13:51 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.12.04 12:04:24 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.11.21 19:00:02 | 000,079,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.10.26 19:16:12 | 000,271,808 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\3.0.313\SSScheduler.exe
PRC - [2012.10.02 20:29:14 | 000,864,616 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\NvXDSync.exe
PRC - [2012.10.02 20:28:55 | 001,820,520 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe
PRC - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2010.09.22 11:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2010.09.21 13:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2010.09.21 13:03:14 | 000,193,408 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2009.04.10 22:28:04 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.19 08:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV - [2013.01.19 10:17:16 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.12.04 12:13:51 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.12.04 12:04:24 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.10.26 19:15:26 | 000,234,776 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\3.0.313\McCHSvc.exe -- (McComponentHostService)
SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.08.30 20:13:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2010.09.22 23:21:24 | 001,493,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2010.09.22 15:33:04 | 000,051,040 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.09.22 11:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2010.09.21 13:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\usbaapl.sys -- (USBAAPL)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\athur.sys -- (athur)
DRV - File not found [Kernel | Auto | Stopped] --  -- (Aspi32)
DRV - [2012.11.27 10:01:26 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.11.22 15:51:13 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012.11.22 15:50:51 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.10.10 21:14:28 | 010,837,352 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012.08.27 14:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2012.01.22 00:29:46 | 000,278,728 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2012.01.22 00:29:45 | 000,025,416 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2011.11.17 10:38:32 | 000,039,016 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tbhsd.sys -- (tbhsd)
DRV - [2011.11.17 10:38:28 | 000,031,848 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rrnetcap.sys -- (RRNetCapMP)
DRV - [2011.11.17 10:38:28 | 000,031,848 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rrnetcap.sys -- (RRNetCap)
DRV - [2007.11.18 02:39:50 | 001,040,544 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2007.08.09 17:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007.06.28 06:18:10 | 001,310,720 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CM108.sys -- (USBPNPA)
DRV - [2006.11.02 08:30:56 | 000,047,104 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.live.com/1rewlive4startup/home
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q={searchTerms}&src=IE-SearchBox
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: %7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:4.2.1.9
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@gamersfirst.com/LiveLauncher: C:\Program Files\GamersFirst\LIVE!\nplivelauncher.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files\McAfee Security Scan\3.0.313\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.19 10:17:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.01.19 10:17:17 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011.09.20 13:55:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sophia\AppData\Roaming\mozilla\Extensions
[2012.12.11 21:42:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sophia\AppData\Roaming\mozilla\Firefox\Profiles\hv9dnq3i.default\extensions
[2012.12.11 21:42:17 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Sophia\AppData\Roaming\mozilla\firefox\profiles\hv9dnq3i.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.01.19 10:17:05 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.01.19 10:17:17 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.07.19 18:04:56 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.10 23:16:21 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.07.19 18:04:56 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.19 18:04:56 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.19 18:04:56 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.19 18:04:56 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Programme\McAfee Security Scan\3.0.313\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Conime] C:\Windows\System32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Akamai NetSession Interface] "C:\Users\Sophia\AppData\Local\Akamai\netsession_win.exe" File not found
O4 - HKCU..\Run: [EPSON SX130 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIHJE.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sophia\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{37B4C0C8-BAA0-45FA-B35B-30FA65F99D95}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9FB498F4-60CC-4500-84FB-A7B95E554BA7}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CBE7A64F-863F-41C6-B7A2-A2F1E6FD2151}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\livecall - No CLSID value found
O18 - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Sophia\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Sophia\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6C298884-91FD-408C-9D90-5A59D2C29FD1} - Microsoft .NET Framework 1.1 Security Update (KB2742597)
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {8F736E10-8E5C-4399-A532-D0C00A406227} - Microsoft .NET Framework 1.1 Security Update (KB2698023)
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.01.28 22:03:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2013.01.27 19:41:08 | 000,000,000 | ---D | C] -- C:\Users\Sophia\AppData\Roaming\TS3Client
[2013.01.27 19:40:50 | 000,000,000 | ---D | C] -- C:\Users\Sophia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2013.01.27 19:40:45 | 000,000,000 | ---D | C] -- C:\Users\Sophia\AppData\Local\TeamSpeak 3 Client
[2013.01.23 22:19:12 | 000,000,000 | ---D | C] -- C:\Users\Sophia\AppData\Local\Macromedia
[2013.01.19 10:17:03 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2011.09.09 13:33:09 | 086,402,648 | ---- | C] (K2 Network, Inc.) -- C:\Program Files\APB_Reloaded_Installer.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.01.30 22:49:36 | 000,004,048 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.30 22:49:36 | 000,004,048 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.30 22:49:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.30 22:49:26 | 3219,709,952 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.30 10:45:32 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{B5B1BA2B-59A9-44F7-B7ED-39CD2E077EE4}.job
[2013.01.28 22:03:17 | 000,001,911 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013.01.28 22:03:17 | 000,001,911 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013.01.28 20:05:51 | 000,639,356 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.01.28 20:05:51 | 000,604,950 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.01.28 20:05:51 | 000,131,202 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.01.28 20:05:51 | 000,108,282 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.01.27 19:40:51 | 000,001,017 | ---- | M] () -- C:\Users\Sophia\Desktop\TeamSpeak 3 Client.lnk
[2013.01.27 13:31:11 | 000,077,824 | ---- | M] () -- C:\Users\Sophia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.01.11 15:14:38 | 000,000,104 | ---- | M] () -- C:\Users\Sophia\Desktop\Papierkorb.lnk
[2013.01.10 19:23:35 | 000,231,016 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.01.28 22:03:17 | 000,001,911 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013.01.27 19:40:51 | 000,001,017 | ---- | C] () -- C:\Users\Sophia\Desktop\TeamSpeak 3 Client.lnk
[2013.01.11 15:14:38 | 000,000,104 | ---- | C] () -- C:\Users\Sophia\Desktop\Papierkorb.lnk
[2012.12.27 09:26:15 | 000,508,189 | ---- | C] () -- C:\Users\Sophia\Weiterbewilligungsantrag-Arbeitslosengeld-II.pdf
[2012.10.03 22:19:06 | 000,000,094 | ---- | C] () -- C:\Users\Sophia\AppData\Local\fusioncache.dat
[2012.05.25 17:43:22 | 000,003,636 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012.04.01 02:32:10 | 000,001,012 | ---- | C] () -- C:\Users\Sophia\Jule Brief.rtf
[2012.01.22 00:29:46 | 000,278,728 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2012.01.22 00:29:45 | 000,025,416 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2012.01.04 12:43:02 | 000,000,000 | ---- | C] () -- C:\Windows\PROTOCOL.INI
[2011.10.27 21:39:11 | 000,043,126 | ---- | C] () -- C:\Users\Sophia\Jonas.jpg
[2011.09.22 15:34:26 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011.09.21 20:17:52 | 000,001,892 | ---- | C] () -- C:\Users\Sophia\Adobe Reader X.lnk
[2011.09.09 14:48:33 | 000,140,232 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2011.09.09 14:48:33 | 000,138,904 | ---- | C] () -- C:\Users\Sophia\AppData\Roaming\PnkBstrK.sys
[2011.09.09 14:48:15 | 000,283,416 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2011.09.09 14:48:13 | 000,076,888 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2011.09.09 13:33:09 | 3816,745,337 | ---- | C] () -- C:\Program Files\Client1.5.1.565640.7z
[2011.09.08 10:06:41 | 000,077,824 | ---- | C] () -- C:\Users\Sophia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.06.11 21:08:00 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.06.11 21:06:48 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.06.11 21:06:48 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011.05.14 14:48:16 | 000,000,680 | ---- | C] () -- C:\Users\Sophia\AppData\Local\d3d9caps.dat
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.10 22:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.10 22:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.07.17 20:24:08 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Artogon
[2012.07.17 21:37:37 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Boomzap
[2012.10.05 22:32:02 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\DVDVideoSoft
[2011.06.19 20:24:05 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.08.09 22:50:54 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Elephant Games
[2012.07.13 23:37:20 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\ERS Game Studios
[2012.07.18 23:05:59 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Fenomen Games
[2012.08.10 23:21:08 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Frogwares
[2012.01.03 23:13:39 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\runic games
[2011.09.21 21:07:13 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Temp
[2013.01.30 00:02:44 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\TS3Client
[2012.06.14 15:47:50 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\TuneUp Software
[2011.12.29 00:58:20 | 000,000,000 | ---D | M] -- C:\Users\Sophia\AppData\Roaming\Wildlife Park 2
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2011.12.26 13:05:08 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2012.08.14 23:05:14 | 000,000,000 | ---D | M] -- C:\BigFishGamesCache
[2011.06.11 21:27:40 | 000,000,000 | -HSD | M] -- C:\Boot
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.05.14 14:45:42 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.05.14 15:01:56 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2011.06.11 20:41:17 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2013.01.19 10:39:17 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.12.17 10:37:32 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.05.14 14:45:42 | 000,000,000 | -HSD | M] -- C:\Programme
[2013.01.30 22:59:06 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.09.13 21:43:50 | 000,000,000 | ---D | M] -- C:\temp
[2011.12.26 13:10:19 | 000,000,000 | R--D | M] -- C:\Users
[2012.02.18 13:26:39 | 000,000,000 | ---D | M] -- C:\Vimeo
[2013.01.10 18:58:01 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
[2011.09.09 14:35:10 | 086,402,648 | ---- | M] (K2 Network, Inc.) -- C:\Program Files\APB_Reloaded_Installer.exe
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< C:\Windows\system32\*.tsp >
[2006.11.02 10:44:49 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp
[2006.11.02 10:44:49 | 000,038,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp
[2006.11.02 10:44:49 | 000,049,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp
[2006.11.02 10:44:49 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp
[2009.04.10 22:27:18 | 000,280,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp
[2006.11.02 14:01:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2006.11.02 14:01:49 | 000,032,530 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.01.31 16:31:40 | 000,000,424 | -H-- | C] () -- C:\Windows\Tasks\User_Feed_Synchronization-{B5B1BA2B-59A9-44F7-B7ED-39CD2E077EE4}.job
 
< MD5 for: AGP440.SYS  >
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.10 22:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.10 22:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.10 22:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2011.05.14 17:02:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2011.05.14 17:02:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2011.05.14 17:02:37 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.05.14 17:01:12 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2011.05.14 17:01:11 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2011.05.14 17:01:11 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2011.05.14 17:35:50 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2011.05.14 17:35:49 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2011.05.14 17:01:12 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 10:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 08:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.10 22:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.10 22:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2007.01.05 20:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\drivers\nvstor.sys
[2007.01.05 20:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_45f67928\nvstor.sys
[2007.01.05 20:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvstor.inf_f48b8337\nvstor.sys
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.08.09 17:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 -- C:\Windows\System32\drivers\nvstor32.sys
[2007.08.09 17:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_99d8b088\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.10 22:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.10 22:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2011.05.14 16:04:30 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2011.05.14 16:04:30 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2008.01.19 08:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 10:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2009.04.10 22:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.10 22:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.10 22:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.10 22:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 09:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 11:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.03.08 12:31:42 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll
[2009.03.08 12:31:37 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll
 
< %USERPROFILE%\*.* >
[2011.09.21 20:17:52 | 000,001,892 | ---- | M] () -- C:\Users\Sophia\Adobe Reader X.lnk
[2012.08.22 21:25:59 | 000,000,565 | ---- | M] () -- C:\Users\Sophia\DS.txt
[2011.10.27 21:40:24 | 000,043,126 | ---- | M] () -- C:\Users\Sophia\Jonas.jpg
[2012.04.02 02:50:22 | 000,001,012 | ---- | M] () -- C:\Users\Sophia\Jule Brief.rtf
[2013.01.30 22:56:35 | 002,097,152 | -HS- | M] () -- C:\Users\Sophia\ntuser.dat
[2013.01.30 22:56:35 | 000,262,144 | -H-- | M] () -- C:\Users\Sophia\ntuser.dat.LOG1
[2011.05.14 14:48:11 | 000,000,000 | -H-- | M] () -- C:\Users\Sophia\ntuser.dat.LOG2
[2013.01.30 22:48:36 | 000,065,536 | -HS- | M] () -- C:\Users\Sophia\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2012.12.17 08:58:00 | 000,524,288 | -HS- | M] () -- C:\Users\Sophia\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2013.01.30 22:48:36 | 000,524,288 | -HS- | M] () -- C:\Users\Sophia\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2011.05.14 14:48:13 | 000,000,020 | -HS- | M] () -- C:\Users\Sophia\ntuser.ini
[2012.10.24 08:54:46 | 000,000,580 | ---- | M] () -- C:\Users\Sophia\Scheinwerfer.txt
[2012.12.27 09:26:15 | 000,508,189 | ---- | M] () -- C:\Users\Sophia\Weiterbewilligungsantrag-Arbeitslosengeld-II.pdf
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:D987CB43
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:9FD757A9
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:762408BA
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:363E775E
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:2E636DD9
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:206470A5
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:927EC486

< End of report >

markusg 31.01.2013 13:00
hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
:OTL
O4 - HKCU..\Run: [Akamai NetSession Interface] "C:\Users\Sophia\AppData\Local\Akamai\netsession_win.exe" File not found
 :Files
:Commands
[EMPTYFLASH]
[emptytemp]


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.

Kaffeevampy 31.01.2013 13:38
Code:
All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Akamai NetSession Interface deleted successfully.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
User: Sophia
->Flash cache emptied: 26842283 bytes
 
User: UpdatusUser
 
Total Flash Files Cleaned = 26,00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: Sophia
->Temp folder emptied: 464683002 bytes
->Temporary Internet Files folder emptied: 264457280 bytes
->Java cache emptied: 24747379 bytes
->FireFox cache emptied: 431899670 bytes
->Flash cache emptied: 0 bytes
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 155648 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 489198928 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 1.598,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 01312013_132648

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
hier der Fix-Report

markusg 31.01.2013 15:53
download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten
c: öffnen, tdsskiller-datum-version.txt öffnen, Inhalt posten

Kaffeevampy 31.01.2013 18:33
Kein Fund soweit!


Code:
18:29:41.0770 5480  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
18:29:41.0978 5480  ============================================================
18:29:41.0978 5480  Current date / time: 2013/01/31 18:29:41.0978
18:29:41.0978 5480  SystemInfo:
18:29:41.0978 5480 
18:29:41.0978 5480  OS Version: 6.0.6002 ServicePack: 2.0
18:29:41.0978 5480  Product type: Workstation
18:29:41.0978 5480  ComputerName: ****
18:29:41.0979 5480  UserName: ****
18:29:41.0979 5480  Windows directory: C:\Windows
18:29:41.0979 5480  System windows directory: C:\Windows
18:29:41.0979 5480  Processor architecture: Intel x86
18:29:41.0979 5480  Number of processors: 4
18:29:41.0979 5480  Page size: 0x1000
18:29:41.0979 5480  Boot type: Normal boot
18:29:41.0979 5480  ============================================================
18:29:42.0694 5480  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
18:29:42.0705 5480  Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
18:29:42.0763 5480  ============================================================
18:29:42.0763 5480  \Device\Harddisk0\DR0:
18:29:42.0783 5480  MBR partitions:
18:29:42.0783 5480  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1003000, BlocksNum 0x39382800
18:29:42.0783 5480  \Device\Harddisk1\DR1:
18:29:42.0788 5480  MBR partitions:
18:29:42.0788 5480  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x3A385000
18:29:42.0788 5480  ============================================================
18:29:43.0020 5480  C: <-> \Device\Harddisk0\DR0\Partition1
18:29:43.0046 5480  D: <-> \Device\Harddisk1\DR1\Partition1
18:29:43.0046 5480  ============================================================
18:29:43.0046 5480  Initialize success
18:29:43.0046 5480  ============================================================
18:30:22.0198 6048  ============================================================
18:30:22.0198 6048  Scan started
18:30:22.0198 6048  Mode: Manual; SigCheck; TDLFS;
18:30:22.0198 6048  ============================================================
18:30:22.0574 6048  ================ Scan system memory ========================
18:30:22.0574 6048  System memory - ok
18:30:22.0574 6048  ================ Scan services =============================
18:30:22.0967 6048  [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI            C:\Windows\system32\drivers\acpi.sys
18:30:23.0114 6048  ACPI - ok
18:30:23.0341 6048  [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
18:30:23.0399 6048  AdobeARMservice - ok
18:30:23.0455 6048  [ 2EDC5BBAC6C651ECE337BDE8ED97C9FB ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
18:30:23.0508 6048  adp94xx - ok
18:30:23.0560 6048  [ B84088CA3CDCA97DA44A984C6CE1CCAD ] adpahci        C:\Windows\system32\drivers\adpahci.sys
18:30:23.0581 6048  adpahci - ok
18:30:23.0611 6048  [ 7880C67BCCC27C86FD05AA2AFB5EA469 ] adpu160m        C:\Windows\system32\drivers\adpu160m.sys
18:30:23.0627 6048  adpu160m - ok
18:30:23.0706 6048  [ 9AE713F8E30EFC2ABCCD84904333DF4D ] adpu320        C:\Windows\system32\drivers\adpu320.sys
18:30:23.0723 6048  adpu320 - ok
18:30:23.0749 6048  [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
18:30:23.0828 6048  AeLookupSvc - ok
18:30:23.0926 6048  [ 3911B972B55FEA0478476B2E777B29FA ] AFD            C:\Windows\system32\drivers\afd.sys
18:30:24.0023 6048  AFD - ok
18:30:24.0063 6048  [ EF23439CDD587F64C2C1B8825CEAD7D8 ] agp440          C:\Windows\system32\drivers\agp440.sys
18:30:24.0125 6048  agp440 - ok
18:30:24.0175 6048  [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx        C:\Windows\system32\drivers\djsvs.sys
18:30:24.0241 6048  aic78xx - ok
18:30:24.0273 6048  [ A1545B731579895D8CC44FC0481C1192 ] ALG            C:\Windows\System32\alg.exe
18:30:24.0339 6048  ALG - ok
18:30:24.0354 6048  [ 90395B64600EBB4552E26E178C94B2E4 ] aliide          C:\Windows\system32\drivers\aliide.sys
18:30:24.0392 6048  aliide - ok
18:30:24.0439 6048  [ 2B13E304C9DFDFA5EB582F6A149FA2C7 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
18:30:24.0463 6048  amdagp - ok
18:30:24.0478 6048  [ 0577DF1D323FE75A739C787893D300EA ] amdide          C:\Windows\system32\drivers\amdide.sys
18:30:24.0513 6048  amdide - ok
18:30:24.0532 6048  [ DC487885BCEF9F28EECE6FAC0E5DDFC5 ] AmdK7          C:\Windows\system32\drivers\amdk7.sys
18:30:24.0630 6048  AmdK7 - ok
18:30:24.0642 6048  [ 0CA0071DA4315B00FC1328CA86B425DA ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
18:30:24.0738 6048  AmdK8 - ok
18:30:24.0841 6048  [ 0FA2D8304ECA29CA0AB7E3EE50FD585A ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
18:30:24.0907 6048  AntiVirSchedulerService - ok
18:30:24.0956 6048  [ 5C69AAC8A59207DA9710FF2E42D6F80F ] AntiVirService  C:\Program Files\Avira\AntiVir Desktop\avguard.exe
18:30:24.0970 6048  AntiVirService - ok
18:30:25.0007 6048  [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo        C:\Windows\System32\appinfo.dll
18:30:25.0055 6048  Appinfo - ok
18:30:25.0089 6048  [ 5F673180268BB1FDB69C99B6619FE379 ] arc            C:\Windows\system32\drivers\arc.sys
18:30:25.0131 6048  arc - ok
18:30:25.0151 6048  [ 957F7540B5E7F602E44648C7DE5A1C05 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
18:30:25.0201 6048  arcsas - ok
18:30:25.0208 6048  Aspi32 - ok
18:30:25.0544 6048  [ 40C145F12FF461A0220303BDA134F598 ] aspnet_state    C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
18:30:25.0558 6048  aspnet_state - ok
18:30:25.0592 6048  [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
18:30:25.0667 6048  AsyncMac - ok
18:30:25.0745 6048  [ 1F05B78AB91C9075565A9D8A4B880BC4 ] atapi          C:\Windows\system32\drivers\atapi.sys
18:30:25.0784 6048  atapi - ok
18:30:25.0802 6048  athur - ok
18:30:25.0846 6048  [ 72BC628AF75C4C3250F2A3BAC260265A ] atksgt          C:\Windows\system32\DRIVERS\atksgt.sys
18:30:26.0196 6048  atksgt - ok
18:30:26.0324 6048  [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
18:30:26.0377 6048  AudioEndpointBuilder - ok
18:30:26.0398 6048  [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv        C:\Windows\System32\Audiosrv.dll
18:30:26.0426 6048  Audiosrv - ok
18:30:26.0454 6048  [ A5C175039B1D6D85D0E79F5855828E4D ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
18:30:26.0472 6048  avgntflt - ok
18:30:26.0549 6048  [ 37B854C7D1F477E66C5B49C7700C47CC ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
18:30:26.0565 6048  avipbb - ok
18:30:26.0610 6048  [ CC4EBA25D80DE42BBC2BF3E553219388 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
18:30:26.0650 6048  avkmgr - ok
18:30:26.0697 6048  [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep            C:\Windows\system32\drivers\Beep.sys
18:30:26.0781 6048  Beep - ok
18:30:26.0842 6048  [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE            C:\Windows\System32\bfe.dll
18:30:26.0890 6048  BFE - ok
18:30:27.0158 6048  [ 93952506C6D67330367F7E7934B6A02F ] BITS            C:\Windows\System32\qmgr.dll
18:30:27.0295 6048  BITS - ok
18:30:27.0302 6048  blbdrive - ok
18:30:27.0350 6048  [ 35F376253F687BDE63976CCB3F2108CA ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
18:30:27.0382 6048  bowser - ok
18:30:27.0449 6048  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\Windows\system32\drivers\brfiltlo.sys
18:30:27.0521 6048  BrFiltLo - ok
18:30:27.0546 6048  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\Windows\system32\drivers\brfiltup.sys
18:30:27.0615 6048  BrFiltUp - ok
18:30:27.0691 6048  [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser        C:\Windows\System32\browser.dll
18:30:27.0755 6048  Browser - ok
18:30:27.0797 6048  [ B304E75CFF293029EDDF094246747113 ] Brserid        C:\Windows\system32\drivers\brserid.sys
18:30:27.0897 6048  Brserid - ok
18:30:27.0919 6048  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\Windows\system32\drivers\brserwdm.sys
18:30:27.0993 6048  BrSerWdm - ok
18:30:28.0019 6048  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\Windows\system32\drivers\brusbmdm.sys
18:30:28.0120 6048  BrUsbMdm - ok
18:30:28.0165 6048  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\Windows\system32\drivers\brusbser.sys
18:30:28.0252 6048  BrUsbSer - ok
18:30:28.0270 6048  [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
18:30:28.0339 6048  BTHMODEM - ok
18:30:28.0385 6048  [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
18:30:28.0441 6048  cdfs - ok
18:30:28.0500 6048  [ 6B4BFFB9BECD728097024276430DB314 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
18:30:28.0558 6048  cdrom - ok
18:30:28.0607 6048  [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc    C:\Windows\System32\certprop.dll
18:30:28.0666 6048  CertPropSvc - ok
18:30:28.0712 6048  [ DA8E0AFC7BAA226C538EF53AC2F90897 ] circlass        C:\Windows\system32\drivers\circlass.sys
18:30:28.0799 6048  circlass - ok
18:30:28.0835 6048  [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS            C:\Windows\system32\CLFS.sys
18:30:28.0887 6048  CLFS - ok
18:30:28.0914 6048  [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:30:28.0938 6048  clr_optimization_v2.0.50727_32 - ok
18:30:29.0063 6048  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:30:29.0081 6048  clr_optimization_v4.0.30319_32 - ok
18:30:29.0156 6048  [ 45201046C776FFDAF3FC8A0029C581C8 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
18:30:29.0201 6048  cmdide - ok
18:30:29.0239 6048  [ 82B8C91D327CFECF76CB58716F7D4997 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
18:30:29.0254 6048  Compbatt - ok
18:30:29.0264 6048  COMSysApp - ok
18:30:29.0291 6048  [ 2A213AE086BBEC5E937553C7D9A2B22C ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
18:30:29.0319 6048  crcdisk - ok
18:30:29.0338 6048  [ 22A7F883508176489F559EE745B5BF5D ] Crusoe          C:\Windows\system32\drivers\crusoe.sys
18:30:29.0412 6048  Crusoe - ok
18:30:29.0477 6048  [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
18:30:29.0521 6048  CryptSvc - ok
18:30:29.0572 6048  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch      C:\Windows\system32\rpcss.dll
18:30:29.0661 6048  DcomLaunch - ok
18:30:29.0709 6048  [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
18:30:29.0769 6048  DfsC - ok
18:30:30.0073 6048  [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR            C:\Windows\system32\DFSR.exe
18:30:30.0236 6048  DFSR - ok
18:30:30.0297 6048  [ 9028559C132146FB75EB7ACF384B086A ] Dhcp            C:\Windows\System32\dhcpcsvc.dll
18:30:30.0343 6048  Dhcp - ok
18:30:30.0374 6048  [ 5D4AEFC3386920236A548271F8F1AF6A ] disk            C:\Windows\system32\drivers\disk.sys
18:30:30.0392 6048  disk - ok
18:30:30.0444 6048  [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache        C:\Windows\System32\dnsrslvr.dll
18:30:30.0486 6048  Dnscache - ok
18:30:30.0538 6048  [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc        C:\Windows\System32\dot3svc.dll
18:30:30.0565 6048  dot3svc - ok
18:30:30.0603 6048  [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS            C:\Windows\system32\dps.dll
18:30:30.0662 6048  DPS - ok
18:30:30.0687 6048  [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
18:30:30.0749 6048  drmkaud - ok
18:30:30.0813 6048  [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
18:30:30.0843 6048  DXGKrnl - ok
18:30:30.0908 6048  [ F88FB26547FD2CE6D0A5AF2985892C48 ] E1G60          C:\Windows\system32\DRIVERS\E1G60I32.sys
18:30:30.0991 6048  E1G60 - ok
18:30:31.0029 6048  [ C0B95E40D85CD807D614E264248A45B9 ] EapHost        C:\Windows\System32\eapsvc.dll
18:30:31.0076 6048  EapHost - ok
18:30:31.0130 6048  [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache          C:\Windows\system32\drivers\ecache.sys
18:30:31.0157 6048  Ecache - ok
18:30:31.0336 6048  [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
18:30:31.0405 6048  ehRecvr - ok
18:30:31.0433 6048  [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched        C:\Windows\ehome\ehsched.exe
18:30:31.0486 6048  ehSched - ok
18:30:31.0501 6048  [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart        C:\Windows\ehome\ehstart.dll
18:30:31.0531 6048  ehstart - ok
18:30:31.0582 6048  [ E8F3F21A71720C84BCF423B80028359F ] elxstor        C:\Windows\system32\drivers\elxstor.sys
18:30:31.0643 6048  elxstor - ok
18:30:31.0751 6048  [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt        C:\Windows\system32\emdmgmt.dll
18:30:31.0800 6048  EMDMgmt - ok
18:30:31.0851 6048  [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem    C:\Windows\system32\es.dll
18:30:31.0907 6048  EventSystem - ok
18:30:31.0958 6048  [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat          C:\Windows\system32\drivers\exfat.sys
18:30:32.0021 6048  exfat - ok
18:30:32.0049 6048  [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
18:30:32.0110 6048  fastfat - ok
18:30:32.0176 6048  [ 63BDADA84951B9C03E641800E176898A ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
18:30:32.0270 6048  fdc - ok
18:30:32.0304 6048  [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost        C:\Windows\system32\fdPHost.dll
18:30:32.0352 6048  fdPHost - ok
18:30:32.0421 6048  [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub        C:\Windows\system32\fdrespub.dll
18:30:32.0500 6048  FDResPub - ok
18:30:32.0576 6048  [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
18:30:32.0608 6048  FileInfo - ok
18:30:32.0646 6048  [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
18:30:32.0719 6048  Filetrace - ok
18:30:32.0780 6048  [ 6603957EFF5EC62D25075EA8AC27DE68 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
18:30:32.0851 6048  flpydisk - ok
18:30:32.0970 6048  [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
18:30:32.0985 6048  FltMgr - ok
18:30:33.0302 6048  [ 8CE364388C8ECA59B14B539179276D44 ] FontCache      C:\Windows\system32\FntCache.dll
18:30:33.0404 6048  FontCache - ok
18:30:33.0483 6048  [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
18:30:33.0517 6048  FontCache3.0.0.0 - ok
18:30:33.0544 6048  [ D909075FA72C090F27AA926C32CB4612 ] fssfltr        C:\Windows\system32\DRIVERS\fssfltr.sys
18:30:33.0581 6048  fssfltr - ok
18:30:34.0047 6048  [ 4CE9DAC1518FF7E77BD213E6394B9D77 ] fsssvc          C:\Program Files\Windows Live\Family Safety\fsssvc.exe
18:30:34.0188 6048  fsssvc - ok
18:30:34.0278 6048  [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
18:30:34.0348 6048  Fs_Rec - ok
18:30:34.0389 6048  [ 4E1CD0A45C50A8882616CAE5BF82F3C5 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
18:30:34.0439 6048  gagp30kx - ok
18:30:34.0589 6048  [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc          C:\Windows\System32\gpsvc.dll
18:30:34.0663 6048  gpsvc - ok
18:30:34.0794 6048  [ CB04C744BE0A61B1D648FAED182C3B59 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
18:30:34.0944 6048  HdAudAddService - ok
18:30:35.0208 6048  [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
18:30:35.0348 6048  HDAudBus - ok
18:30:35.0411 6048  [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth          C:\Windows\system32\drivers\hidbth.sys
18:30:35.0518 6048  HidBth - ok
18:30:35.0533 6048  [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr          C:\Windows\system32\drivers\hidir.sys
18:30:35.0623 6048  HidIr - ok
18:30:35.0674 6048  [ 84067081F3318162797385E11A8F0582 ] hidserv        C:\Windows\system32\hidserv.dll
18:30:35.0714 6048  hidserv - ok
18:30:35.0742 6048  [ CCA4B519B17E23A00B826C55716809CC ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
18:30:35.0788 6048  HidUsb - ok
18:30:35.0821 6048  [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc          C:\Windows\system32\kmsvc.dll
18:30:35.0866 6048  hkmsvc - ok
18:30:35.0900 6048  [ DF353B401001246853763C4B7AAA6F50 ] HpCISSs        C:\Windows\system32\drivers\hpcisss.sys
18:30:35.0943 6048  HpCISSs - ok
18:30:36.0095 6048  [ F870AA3E254628EBEAFE754108D664DE ] HTTP            C:\Windows\system32\drivers\HTTP.sys
18:30:36.0160 6048  HTTP - ok
18:30:36.0171 6048  [ 324C2152FF2C61ABAE92D09F3CCA4D63 ] i2omp          C:\Windows\system32\drivers\i2omp.sys
18:30:36.0207 6048  i2omp - ok
18:30:36.0277 6048  [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
18:30:36.0348 6048  i8042prt - ok
18:30:36.0400 6048  [ C957BF4B5D80B46C5017BF0101E6C906 ] iaStorV        C:\Windows\system32\drivers\iastorv.sys
18:30:36.0437 6048  iaStorV - ok
18:30:36.0595 6048  [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc          C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
18:30:36.0770 6048  idsvc - ok
18:30:36.0805 6048  [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
18:30:36.0868 6048  iirsp - ok
18:30:36.0921 6048  [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT          C:\Windows\System32\ikeext.dll
18:30:36.0975 6048  IKEEXT - ok
18:30:37.0272 6048  [ 873ADFDDE3D096E734625A3199FF70FC ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
18:30:37.0533 6048  IntcAzAudAddService - ok
18:30:37.0572 6048  [ 97469037714070E45194ED318D636401 ] intelide        C:\Windows\system32\drivers\intelide.sys
18:30:37.0636 6048  intelide - ok
18:30:37.0669 6048  [ 224191001E78C89DFA78924C3EA595FF ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
18:30:37.0711 6048  intelppm - ok
18:30:37.0752 6048  [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
18:30:37.0793 6048  IPBusEnum - ok
18:30:37.0832 6048  [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
18:30:37.0908 6048  IpFilterDriver - ok
18:30:37.0957 6048  [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
18:30:37.0993 6048  iphlpsvc - ok
18:30:37.0999 6048  IpInIp - ok
18:30:38.0042 6048  [ 40F34F8ABA2A015D780E4B09138B6C17 ] IPMIDRV        C:\Windows\system32\drivers\ipmidrv.sys
18:30:38.0124 6048  IPMIDRV - ok
18:30:38.0185 6048  [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT          C:\Windows\system32\DRIVERS\ipnat.sys
18:30:38.0274 6048  IPNAT - ok
18:30:38.0303 6048  [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
18:30:38.0390 6048  IRENUM - ok
18:30:38.0452 6048  [ 350FCA7E73CF65BCEF43FAE1E4E91293 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
18:30:38.0492 6048  isapnp - ok
18:30:38.0523 6048  [ 232FA340531D940AAC623B121A595034 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
18:30:38.0537 6048  iScsiPrt - ok
18:30:38.0560 6048  [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi        C:\Windows\system32\drivers\iteatapi.sys
18:30:38.0578 6048  iteatapi - ok
18:30:38.0594 6048  [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid        C:\Windows\system32\drivers\iteraid.sys
18:30:38.0633 6048  iteraid - ok
18:30:38.0683 6048  [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
18:30:38.0695 6048  kbdclass - ok
18:30:38.0775 6048  [ EDE59EC70E25C24581ADD1FBEC7325F7 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
18:30:38.0816 6048  kbdhid - ok
18:30:38.0846 6048  [ A3E186B4B935905B829219502557314E ] KeyIso          C:\Windows\system32\lsass.exe
18:30:38.0913 6048  KeyIso - ok
18:30:39.0084 6048  [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
18:30:39.0159 6048  KSecDD - ok
18:30:39.0283 6048  [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm          C:\Windows\system32\msdtckrm.dll
18:30:39.0403 6048  KtmRm - ok
18:30:39.0466 6048  [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer    C:\Windows\system32\srvsvc.dll
18:30:39.0516 6048  LanmanServer - ok
18:30:39.0551 6048  [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
18:30:39.0612 6048  LanmanWorkstation - ok
18:30:39.0699 6048  [ 4127E8B6DDB4090E815C1F8852C277D3 ] lirsgt          C:\Windows\system32\DRIVERS\lirsgt.sys
18:30:39.0758 6048  lirsgt - ok
18:30:39.0819 6048  [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
18:30:39.0890 6048  lltdio - ok
18:30:39.0955 6048  [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc        C:\Windows\System32\lltdsvc.dll
18:30:40.0034 6048  lltdsvc - ok
18:30:40.0103 6048  [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts        C:\Windows\System32\lmhsvc.dll
18:30:40.0143 6048  lmhosts - ok
18:30:40.0214 6048  [ A2262FB9F28935E862B4DB46438C80D2 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
18:30:40.0268 6048  LSI_FC - ok
18:30:40.0300 6048  [ 30D73327D390F72A62F32C103DAF1D6D ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
18:30:40.0334 6048  LSI_SAS - ok
18:30:40.0368 6048  [ E1E36FEFD45849A95F1AB81DE0159FE3 ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
18:30:40.0424 6048  LSI_SCSI - ok
18:30:40.0474 6048  [ 8F5C7426567798E62A3B3614965D62CC ] luafv          C:\Windows\system32\drivers\luafv.sys
18:30:40.0499 6048  luafv - ok
18:30:40.0594 6048  [ C58F15CD4EF79210455512CF0C449F39 ] McComponentHostService C:\Program Files\McAfee Security Scan\3.0.313\McCHSvc.exe
18:30:40.0608 6048  McComponentHostService - ok
18:30:40.0651 6048  [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
18:30:40.0692 6048  Mcx2Svc - ok
18:30:40.0760 6048  [ D153B14FC6598EAE8422A2037553ADCE ] megasas        C:\Windows\system32\drivers\megasas.sys
18:30:40.0816 6048  megasas - ok
18:30:40.0874 6048  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS          C:\Windows\system32\mmcss.dll
18:30:40.0924 6048  MMCSS - ok
18:30:40.0954 6048  [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem          C:\Windows\system32\drivers\modem.sys
18:30:41.0014 6048  Modem - ok
18:30:41.0056 6048  [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
18:30:41.0102 6048  monitor - ok
18:30:41.0144 6048  [ 5BF6A1326A335C5298477754A506D263 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
18:30:41.0156 6048  mouclass - ok
18:30:41.0190 6048  [ 93B8D4869E12CFBE663915502900876F ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
18:30:41.0261 6048  mouhid - ok
18:30:41.0309 6048  [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr        C:\Windows\system32\drivers\mountmgr.sys
18:30:41.0322 6048  MountMgr - ok
18:30:41.0410 6048  [ 9C3758018DED02F4AE53CCA1C5F084A2 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
18:30:41.0463 6048  MozillaMaintenance - ok
18:30:41.0523 6048  [ 583A41F26278D9E0EA548163D6139397 ] mpio            C:\Windows\system32\drivers\mpio.sys
18:30:41.0580 6048  mpio - ok
18:30:41.0616 6048  [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
18:30:41.0668 6048  mpsdrv - ok
18:30:41.0706 6048  [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc          C:\Windows\system32\mpssvc.dll
18:30:41.0772 6048  MpsSvc - ok
18:30:41.0842 6048  [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x        C:\Windows\system32\drivers\mraid35x.sys
18:30:41.0879 6048  Mraid35x - ok
18:30:41.0941 6048  [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
18:30:42.0010 6048  MRxDAV - ok
18:30:42.0054 6048  [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
18:30:42.0091 6048  mrxsmb - ok
18:30:42.0115 6048  [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
18:30:42.0132 6048  mrxsmb10 - ok
18:30:42.0140 6048  [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
18:30:42.0177 6048  mrxsmb20 - ok
18:30:42.0215 6048  [ 742AED7939E734C36B7E8D6228CE26B7 ] msahci          C:\Windows\system32\drivers\msahci.sys
18:30:42.0250 6048  msahci - ok
18:30:42.0281 6048  [ 3FC82A2AE4CC149165A94699183D3028 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
18:30:42.0343 6048  msdsm - ok
18:30:42.0387 6048  [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC          C:\Windows\System32\msdtc.exe
18:30:42.0444 6048  MSDTC - ok
18:30:42.0517 6048  [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
18:30:42.0574 6048  Msfs - ok
18:30:42.0611 6048  [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
18:30:42.0626 6048  msisadrv - ok
18:30:42.0666 6048  [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
18:30:42.0726 6048  MSiSCSI - ok
18:30:42.0731 6048  msiserver - ok
18:30:42.0771 6048  [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
18:30:42.0824 6048  MSKSSRV - ok
18:30:42.0860 6048  [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
18:30:42.0886 6048  MSPCLOCK - ok
18:30:42.0907 6048  [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
18:30:42.0951 6048  MSPQM - ok
18:30:43.0003 6048  [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
18:30:43.0021 6048  MsRPC - ok
18:30:43.0072 6048  [ E384487CB84BE41D09711C30CA79646C ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
18:30:43.0084 6048  mssmbios - ok
18:30:43.0114 6048  [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
18:30:43.0173 6048  MSTEE - ok
18:30:43.0213 6048  [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup            C:\Windows\system32\Drivers\mup.sys
18:30:43.0246 6048  Mup - ok
18:30:43.0394 6048  [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent        C:\Windows\system32\qagentRT.dll
18:30:43.0439 6048  napagent - ok
18:30:43.0515 6048  [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
18:30:43.0553 6048  NativeWifiP - ok
18:30:43.0632 6048  [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS            C:\Windows\system32\drivers\ndis.sys
18:30:43.0671 6048  NDIS - ok
18:30:43.0714 6048  [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
18:30:43.0780 6048  NdisTapi - ok
18:30:43.0839 6048  [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
18:30:43.0861 6048  Ndisuio - ok
18:30:43.0924 6048  [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
18:30:44.0006 6048  NdisWan - ok
18:30:44.0042 6048  [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
18:30:44.0106 6048  NDProxy - ok
18:30:44.0132 6048  [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
18:30:44.0173 6048  NetBIOS - ok
18:30:44.0273 6048  [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt          C:\Windows\system32\DRIVERS\netbt.sys
18:30:44.0333 6048  netbt - ok
18:30:44.0360 6048  [ A3E186B4B935905B829219502557314E ] Netlogon        C:\Windows\system32\lsass.exe
18:30:44.0374 6048  Netlogon - ok
18:30:44.0437 6048  [ C8052711DAECC48B982434C5116CA401 ] Netman          C:\Windows\System32\netman.dll
18:30:44.0480 6048  Netman - ok
18:30:44.0589 6048  [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm        C:\Windows\System32\netprofm.dll
18:30:44.0629 6048  netprofm - ok
18:30:44.0675 6048  [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
18:30:44.0736 6048  NetTcpPortSharing - ok
18:30:44.0787 6048  [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
18:30:44.0840 6048  nfrd960 - ok
18:30:44.0926 6048  [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc          C:\Windows\System32\nlasvc.dll
18:30:44.0976 6048  NlaSvc - ok
18:30:45.0035 6048  [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
18:30:45.0091 6048  Npfs - ok
18:30:45.0128 6048  [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi            C:\Windows\system32\nsisvc.dll
18:30:45.0180 6048  nsi - ok
18:30:45.0237 6048  [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
18:30:45.0307 6048  nsiproxy - ok
18:30:45.0419 6048  [ 6A4A98CEE84CF9E99564510DDA4BAA47 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
18:30:45.0512 6048  Ntfs - ok
18:30:45.0595 6048  [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi      C:\Windows\system32\drivers\ntrigdigi.sys
18:30:45.0670 6048  ntrigdigi - ok
18:30:45.0705 6048  [ CF7E041663119E09D2E118521ADA9300 ] NuidFltr        C:\Windows\system32\DRIVERS\NuidFltr.sys
18:30:45.0744 6048  NuidFltr - ok
18:30:45.0797 6048  [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null            C:\Windows\system32\drivers\Null.sys
18:30:45.0865 6048  Null - ok
18:30:46.0011 6048  [ D668632606D1CEBF0B6EC64C1DF7ED6F ] NVENETFD        C:\Windows\system32\DRIVERS\nvmfdx32.sys
18:30:46.0215 6048  NVENETFD - ok
18:30:46.0728 6048  [ 0A1B502CBC8230DA74BEFBAADDB58916 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
18:30:47.0704 6048  nvlddmkm - ok
18:30:47.0762 6048  [ E69E946F80C1C31C53003BFBF50CBB7C ] nvraid          C:\Windows\system32\drivers\nvraid.sys
18:30:47.0806 6048  nvraid - ok
18:30:47.0884 6048  [ 4A5FCAB82D9BF6AF8A023A66802FE9E9 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
18:30:47.0929 6048  nvstor - ok
18:30:47.0983 6048  [ DC5F166422BEEBF195E3E4BB8AB4EE22 ] nvstor32        C:\Windows\system32\DRIVERS\nvstor32.sys
18:30:47.0992 6048  nvstor32 - ok
18:30:48.0047 6048  [ EB5A13F9139F20AD71ADF4BF79C3AA29 ] nvsvc          C:\Windows\system32\nvvsvc.exe
18:30:48.0083 6048  nvsvc - ok
18:30:48.0223 6048  [ 61FF84F865B4414EFDC11856BF5757AD ] nvUpdatusService C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
18:30:48.0356 6048  nvUpdatusService - ok
18:30:48.0430 6048  [ 07C186427EB8FCC3D8D7927187F260F7 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
18:30:48.0483 6048  nv_agp - ok
18:30:48.0489 6048  NwlnkFlt - ok
18:30:48.0494 6048  NwlnkFwd - ok
18:30:48.0573 6048  [ 6F310E890D46E246E0E261A63D9B36B4 ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
18:30:48.0613 6048  ohci1394 - ok
18:30:48.0654 6048  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc        C:\Windows\system32\p2psvc.dll
18:30:48.0780 6048  p2pimsvc - ok
18:30:48.0812 6048  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc          C:\Windows\system32\p2psvc.dll
18:30:48.0836 6048  p2psvc - ok
18:30:48.0869 6048  [ 0FA9B5055484649D63C303FE404E5F4D ] Parport        C:\Windows\system32\drivers\parport.sys
18:30:48.0961 6048  Parport - ok
18:30:49.0013 6048  [ B9C2B89F08670E159F7181891E449CD9 ] partmgr        C:\Windows\system32\drivers\partmgr.sys
18:30:49.0026 6048  partmgr - ok
18:30:49.0058 6048  [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm          C:\Windows\system32\drivers\parvdm.sys
18:30:49.0152 6048  Parvdm - ok
18:30:49.0187 6048  [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc          C:\Windows\System32\pcasvc.dll
18:30:49.0253 6048  PcaSvc - ok
18:30:49.0339 6048  [ 941DC1D19E7E8620F40BBC206981EFDB ] pci            C:\Windows\system32\drivers\pci.sys
18:30:49.0378 6048  pci - ok
18:30:49.0416 6048  [ 1636D43F10416AEB483BC6001097B26C ] pciide          C:\Windows\system32\drivers\pciide.sys
18:30:49.0431 6048  pciide - ok
18:30:49.0466 6048  [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
18:30:49.0521 6048  pcmcia - ok
18:30:49.0595 6048  [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
18:30:49.0778 6048  PEAUTH - ok
18:30:49.0894 6048  [ B1689DF169143F57053F795390C99DB3 ] pla            C:\Windows\system32\pla.dll
18:30:50.0060 6048  pla - ok
18:30:50.0104 6048  [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
18:30:50.0154 6048  PlugPlay - ok
18:30:50.0206 6048  [ 3A2E85F7D90D15460C337CE80C2E3B29 ] PnkBstrA        C:\Windows\system32\PnkBstrA.exe
18:30:50.0256 6048  PnkBstrA - ok
18:30:50.0402 6048  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg    C:\Windows\system32\p2psvc.dll
18:30:50.0443 6048  PNRPAutoReg - ok
18:30:50.0519 6048  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc        C:\Windows\system32\p2psvc.dll
18:30:50.0557 6048  PNRPsvc - ok
18:30:50.0591 6048  [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
18:30:50.0651 6048  PolicyAgent - ok
18:30:50.0694 6048  [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
18:30:50.0726 6048  PptpMiniport - ok
18:30:50.0785 6048  [ 0E3CEF5D28B40CF273281D620C50700A ] Processor      C:\Windows\system32\drivers\processr.sys
18:30:50.0874 6048  Processor - ok
18:30:50.0939 6048  [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc        C:\Windows\system32\profsvc.dll
18:30:50.0985 6048  ProfSvc - ok
18:30:51.0007 6048  [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
18:30:51.0025 6048  ProtectedStorage - ok
18:30:51.0070 6048  [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched          C:\Windows\system32\DRIVERS\pacer.sys
18:30:51.0096 6048  PSched - ok
18:30:51.0207 6048  [ CCDAC889326317792480C0A67156A1EC ] ql2300          C:\Windows\system32\drivers\ql2300.sys
18:30:51.0294 6048  ql2300 - ok
18:30:51.0386 6048  [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
18:30:51.0434 6048  ql40xx - ok
18:30:51.0486 6048  [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE          C:\Windows\system32\qwave.dll
18:30:51.0501 6048  QWAVE - ok
18:30:51.0555 6048  [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
18:30:51.0639 6048  QWAVEdrv - ok
18:30:51.0671 6048  [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
18:30:51.0707 6048  RasAcd - ok
18:30:51.0775 6048  [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto        C:\Windows\System32\rasauto.dll
18:30:51.0830 6048  RasAuto - ok
18:30:51.0885 6048  [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
18:30:51.0983 6048  Rasl2tp - ok
18:30:52.0025 6048  [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan          C:\Windows\System32\rasmans.dll
18:30:52.0056 6048  RasMan - ok
18:30:52.0102 6048  [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
18:30:52.0173 6048  RasPppoe - ok
18:30:52.0245 6048  [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
18:30:52.0304 6048  RasSstp - ok
18:30:52.0346 6048  [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
18:30:52.0444 6048  rdbss - ok
18:30:52.0500 6048  [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
18:30:52.0586 6048  RDPCDD - ok
18:30:52.0644 6048  [ E8BD98D46F2ED77132BA927FCCB47D8B ] rdpdr          C:\Windows\system32\drivers\rdpdr.sys
18:30:52.0724 6048  rdpdr - ok
18:30:52.0742 6048  [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
18:30:52.0791 6048  RDPENCDD - ok
18:30:52.0871 6048  [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
18:30:52.0980 6048  RDPWD - ok
18:30:53.0017 6048  [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess    C:\Windows\System32\mprdim.dll
18:30:53.0066 6048  RemoteAccess - ok
18:30:53.0108 6048  [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry  C:\Windows\system32\regsvc.dll
18:30:53.0145 6048  RemoteRegistry - ok
18:30:53.0173 6048  [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator      C:\Windows\system32\locator.exe
18:30:53.0236 6048  RpcLocator - ok
18:30:53.0253 6048  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs          C:\Windows\system32\rpcss.dll
18:30:53.0279 6048  RpcSs - ok
18:30:53.0322 6048  [ 43110C2A2C5ED32EAD96C440718E4452 ] RRNetCap        C:\Windows\system32\DRIVERS\rrnetcap.sys
18:30:53.0341 6048  RRNetCap - ok
18:30:53.0345 6048  [ 43110C2A2C5ED32EAD96C440718E4452 ] RRNetCapMP      C:\Windows\system32\DRIVERS\rrnetcap.sys
18:30:53.0357 6048  RRNetCapMP - ok
18:30:53.0400 6048  [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
18:30:53.0458 6048  rspndr - ok
18:30:53.0512 6048  [ 959EF612D2CCFDB6D9E443F8E3655013 ] RTL8023xp      C:\Windows\system32\DRIVERS\Rtnicxp.sys
18:30:53.0586 6048  RTL8023xp - ok
18:30:53.0623 6048  [ A3E186B4B935905B829219502557314E ] SamSs          C:\Windows\system32\lsass.exe
18:30:53.0641 6048  SamSs - ok
18:30:53.0700 6048  [ 3CE8F073A557E172B330109436984E30 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
18:30:53.0735 6048  sbp2port - ok
18:30:53.0796 6048  [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
18:30:53.0824 6048  SCardSvr - ok
18:30:54.0079 6048  [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule        C:\Windows\system32\schedsvc.dll
18:30:54.0187 6048  Schedule - ok
18:30:54.0204 6048  [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc    C:\Windows\System32\certprop.dll
18:30:54.0230 6048  SCPolicySvc - ok
18:30:54.0294 6048  [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
18:30:54.0350 6048  SDRSVC - ok
18:30:54.0414 6048  [ 16A252022535B680046F6E34E136D378 ] SeaPort        C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
18:30:54.0469 6048  SeaPort - ok
18:30:54.0539 6048  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
18:30:54.0646 6048  secdrv - ok
18:30:54.0675 6048  [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon        C:\Windows\system32\seclogon.dll
18:30:54.0729 6048  seclogon - ok
18:30:54.0756 6048  [ A9BBAB5759771E523F55563D6CBE140F ] SENS            C:\Windows\System32\sens.dll
18:30:54.0802 6048  SENS - ok
18:30:54.0854 6048  [ CE9EC966638EF0B10B864DDEDF62A099 ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
18:30:54.0924 6048  Serenum - ok
18:30:54.0980 6048  [ 6D663022DB3E7058907784AE14B69898 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
18:30:55.0056 6048  Serial - ok
18:30:55.0085 6048  [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
18:30:55.0148 6048  sermouse - ok
18:30:55.0233 6048  [ D2193326F729B163125610DBF3E17D57 ] SessionEnv      C:\Windows\system32\sessenv.dll
18:30:55.0268 6048  SessionEnv - ok
18:30:55.0344 6048  [ 103B79418DA647736EE95645F305F68A ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
18:30:55.0446 6048  sffdisk - ok
18:30:55.0466 6048  [ 8FD08A310645FE872EEEC6E08C6BF3EE ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
18:30:55.0548 6048  sffp_mmc - ok
18:30:55.0564 6048  [ 9CFA05FCFCB7124E69CFC812B72F9614 ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
18:30:55.0656 6048  sffp_sd - ok
18:30:55.0684 6048  [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
18:30:55.0769 6048  sfloppy - ok
18:30:55.0821 6048  [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
18:30:55.0860 6048  SharedAccess - ok
18:30:55.0913 6048  [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
18:30:55.0974 6048  ShellHWDetection - ok
18:30:56.0004 6048  [ D2A595D6EEBEEAF4334F8E50EFBC9931 ] sisagp          C:\Windows\system32\drivers\sisagp.sys
18:30:56.0026 6048  sisagp - ok
18:30:56.0048 6048  [ CEDD6F4E7D84E9F98B34B3FE988373AA ] SiSRaid2        C:\Windows\system32\drivers\sisraid2.sys
18:30:56.0093 6048  SiSRaid2 - ok
18:30:56.0116 6048  [ DF843C528C4F69D12CE41CE462E973A7 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
18:30:56.0157 6048  SiSRaid4 - ok
18:30:56.0225 6048  [ A4FAB5F7818A69DA6E740943CB8F7CA9 ] SkypeUpdate    C:\Program Files\Skype\Updater\Updater.exe
18:30:56.0320 6048  SkypeUpdate - ok
18:30:56.0634 6048  [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc          C:\Windows\system32\SLsvc.exe
18:30:56.0896 6048  slsvc - ok
18:30:56.0942 6048  [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify      C:\Windows\system32\SLUINotify.dll
18:30:57.0003 6048  SLUINotify - ok
18:30:57.0072 6048  [ 7B75299A4D201D6A6533603D6914AB04 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
18:30:57.0143 6048  Smb - ok
18:30:57.0196 6048  [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
18:30:57.0213 6048  SNMPTRAP - ok
18:30:57.0270 6048  [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr          C:\Windows\system32\drivers\spldr.sys
18:30:57.0329 6048  spldr - ok
18:30:57.0389 6048  [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler        C:\Windows\System32\spoolsv.exe
18:30:57.0489 6048  Spooler - ok
18:30:57.0551 6048  [ 41987F9FC0E61ADF54F581E15029AD91 ] srv            C:\Windows\system32\DRIVERS\srv.sys
18:30:57.0594 6048  srv - ok
18:30:57.0643 6048  [ FF33AFF99564B1AA534F58868CBE41EF ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
18:30:57.0680 6048  srv2 - ok
18:30:57.0751 6048  [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
18:30:57.0801 6048  srvnet - ok
18:30:57.0896 6048  [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
18:30:57.0960 6048  SSDPSRV - ok
18:30:58.0013 6048  [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv          C:\Windows\system32\DRIVERS\ssmdrv.sys
18:30:58.0090 6048  ssmdrv - ok
18:30:58.0143 6048  [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
18:30:58.0187 6048  SstpSvc - ok
18:30:58.0334 6048  [ F0359F7CE712D69ACEF0886BDB4792ED ] Stereo Service  C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
18:30:58.0405 6048  Stereo Service - ok
18:30:58.0518 6048  [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc          C:\Windows\System32\wiaservc.dll
18:30:58.0573 6048  stisvc - ok
18:30:58.0608 6048  [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
18:30:58.0651 6048  swenum - ok
18:30:58.0714 6048  [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv          C:\Windows\System32\swprv.dll
18:30:58.0771 6048  swprv - ok
18:30:58.0822 6048  [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx        C:\Windows\system32\drivers\symc8xx.sys
18:30:58.0863 6048  Symc8xx - ok
18:30:58.0899 6048  [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi          C:\Windows\system32\drivers\sym_hi.sys
18:30:58.0935 6048  Sym_hi - ok
18:30:58.0981 6048  [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3          C:\Windows\system32\drivers\sym_u3.sys
18:30:59.0021 6048  Sym_u3 - ok
18:30:59.0085 6048  [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain        C:\Windows\system32\sysmain.dll
18:30:59.0114 6048  SysMain - ok
18:30:59.0143 6048  [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
18:30:59.0171 6048  TabletInputService - ok
18:30:59.0287 6048  [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv        C:\Windows\System32\tapisrv.dll
18:30:59.0339 6048  TapiSrv - ok
18:30:59.0397 6048  [ D7F411C5AF992BB44E86083A6AA7B045 ] tbhsd          C:\Windows\system32\drivers\tbhsd.sys
18:30:59.0455 6048  tbhsd - ok
18:30:59.0503 6048  [ CB05822CD9CC6C688168E113C603DBE7 ] TBS            C:\Windows\System32\tbssvc.dll
18:30:59.0553 6048  TBS - ok
18:30:59.0613 6048  [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
18:30:59.0695 6048  Tcpip - ok
18:31:00.0029 6048  [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip6          C:\Windows\system32\DRIVERS\tcpip.sys
18:31:00.0092 6048  Tcpip6 - ok
18:31:00.0148 6048  [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
18:31:00.0226 6048  tcpipreg - ok
18:31:00.0273 6048  [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
18:31:00.0317 6048  TDPIPE - ok
18:31:00.0361 6048  [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
18:31:00.0428 6048  TDTCP - ok
18:31:00.0469 6048  [ 76B06EB8A01FC8624D699E7045303E54 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
18:31:00.0547 6048  tdx - ok
18:31:00.0606 6048  [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
18:31:00.0650 6048  TermDD - ok
18:31:00.0751 6048  [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService    C:\Windows\System32\termsrv.dll
18:31:00.0789 6048  TermService - ok
18:31:00.0845 6048  [ C7230FBEE14437716701C15BE02C27B8 ] Themes          C:\Windows\system32\shsvcs.dll
18:31:00.0867 6048  Themes - ok
18:31:00.0891 6048  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER    C:\Windows\system32\mmcss.dll
18:31:00.0923 6048  THREADORDER - ok
18:31:00.0981 6048  [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks          C:\Windows\System32\trkwks.dll
18:31:01.0015 6048  TrkWks - ok
18:31:01.0128 6048  [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
18:31:01.0153 6048  TrustedInstaller - ok
18:31:01.0202 6048  [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
18:31:01.0278 6048  tssecsrv - ok
18:31:01.0307 6048  [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp          C:\Windows\system32\DRIVERS\tunmp.sys
18:31:01.0355 6048  tunmp - ok
18:31:01.0377 6048  [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
18:31:01.0445 6048  tunnel - ok
18:31:01.0482 6048  [ C3ADE15414120033A36C0F293D4A4121 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
18:31:01.0522 6048  uagp35 - ok
18:31:01.0584 6048  [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
18:31:01.0638 6048  udfs - ok
18:31:01.0683 6048  [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
18:31:01.0734 6048  UI0Detect - ok
18:31:01.0755 6048  [ 75E6890EBFCE0841D3291B02E7A8BDB0 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
18:31:01.0806 6048  uliagpkx - ok
18:31:01.0874 6048  [ 3CD4EA35A6221B85DCC25DAA46313F8D ] uliahci        C:\Windows\system32\drivers\uliahci.sys
18:31:01.0915 6048  uliahci - ok
18:31:01.0934 6048  [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata          C:\Windows\system32\drivers\ulsata.sys
18:31:01.0952 6048  UlSata - ok
18:31:01.0981 6048  [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2        C:\Windows\system32\drivers\ulsata2.sys
18:31:01.0998 6048  ulsata2 - ok
18:31:02.0055 6048  [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
18:31:02.0116 6048  umbus - ok
18:31:02.0245 6048  [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost        C:\Windows\System32\upnphost.dll
18:31:02.0314 6048  upnphost - ok
18:31:02.0322 6048  USBAAPL - ok
18:31:02.0368 6048  [ 32DB9517628FF0D070682AAB61E688F0 ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
18:31:02.0410 6048  usbaudio - ok
18:31:02.0463 6048  [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
18:31:02.0495 6048  usbccgp - ok
18:31:02.0543 6048  [ E9476E6C486E76BC4898074768FB7131 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
18:31:02.0618 6048  usbcir - ok
18:31:02.0645 6048  [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
18:31:02.0700 6048  usbehci - ok
18:31:02.0727 6048  [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
18:31:02.0763 6048  usbhub - ok
18:31:02.0780 6048  [ CE697FEE0D479290D89BEC80DFE793B7 ] usbohci        C:\Windows\system32\DRIVERS\usbohci.sys
18:31:02.0835 6048  usbohci - ok
18:31:02.0903 6048  [ 41B758CFF0A3C10A69E088F440677399 ] USBPNPA        C:\Windows\system32\drivers\CM108.sys
18:31:03.0080 6048  USBPNPA - ok
18:31:03.0118 6048  [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
18:31:03.0195 6048  usbprint - ok
18:31:03.0254 6048  [ A508C9BD8724980512136B039BBA65E9 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
18:31:03.0313 6048  usbscan - ok
18:31:03.0375 6048  [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
18:31:03.0400 6048  USBSTOR - ok
18:31:03.0460 6048  [ 325DBBACB8A36AF9988CCF40EAC228CC ] usbuhci        C:\Windows\system32\DRIVERS\usbuhci.sys
18:31:03.0565 6048  usbuhci - ok
18:31:03.0621 6048  [ 35C9095FA7076466AFBFC5B9EC4B779E ] usb_rndisx      C:\Windows\system32\DRIVERS\usb8023x.sys
18:31:03.0669 6048  usb_rndisx - ok
18:31:03.0736 6048  [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms          C:\Windows\System32\uxsms.dll
18:31:03.0804 6048  UxSms - ok
18:31:03.0960 6048  [ CD88D1B7776DC17A119049742EC07EB4 ] vds            C:\Windows\System32\vds.exe
18:31:04.0062 6048  vds - ok
18:31:04.0121 6048  [ 7D92BE0028ECDEDEC74617009084B5EF ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
18:31:04.0198 6048  vga - ok
18:31:04.0285 6048  [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave        C:\Windows\System32\drivers\vga.sys
18:31:04.0339 6048  VgaSave - ok
18:31:04.0383 6048  [ 045D9961E591CF0674A920B6BA3BA5CB ] viaagp          C:\Windows\system32\drivers\viaagp.sys
18:31:04.0418 6048  viaagp - ok
18:31:04.0477 6048  [ 56A4DE5F02F2E88182B0981119B4DD98 ] ViaC7          C:\Windows\system32\drivers\viac7.sys
18:31:04.0562 6048  ViaC7 - ok
18:31:04.0593 6048  [ FD2E3175FCADA350C7AB4521DCA187EC ] viaide          C:\Windows\system32\drivers\viaide.sys
18:31:04.0639 6048  viaide - ok
18:31:04.0693 6048  [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
18:31:04.0712 6048  volmgr - ok
18:31:04.0804 6048  [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
18:31:04.0850 6048  volmgrx - ok
18:31:04.0902 6048  [ 786DB5771F05EF300390399F626BF30A ] volsnap        C:\Windows\system32\drivers\volsnap.sys
18:31:04.0926 6048  volsnap - ok
18:31:04.0969 6048  [ D984439746D42B30FC65A4C3546C6829 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
18:31:05.0015 6048  vsmraid - ok
18:31:05.0228 6048  [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS            C:\Windows\system32\vssvc.exe
18:31:05.0303 6048  VSS - ok
18:31:05.0446 6048  [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time        C:\Windows\system32\w32time.dll
18:31:05.0513 6048  W32Time - ok
18:31:05.0536 6048  [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
18:31:05.0641 6048  WacomPen - ok
18:31:05.0697 6048  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp          C:\Windows\system32\DRIVERS\wanarp.sys
18:31:05.0775 6048  Wanarp - ok
18:31:05.0780 6048  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
18:31:05.0800 6048  Wanarpv6 - ok
18:31:05.0918 6048  [ A3CD60FD826381B49F03832590E069AF ] wcncsvc        C:\Windows\System32\wcncsvc.dll
18:31:06.0011 6048  wcncsvc - ok
18:31:06.0043 6048  [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
18:31:06.0090 6048  WcsPlugInService - ok
18:31:06.0151 6048  [ AFC5AD65B991C1E205CF25CFDBF7A6F4 ] Wd              C:\Windows\system32\drivers\wd.sys
18:31:06.0205 6048  Wd - ok
18:31:06.0354 6048  [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
18:31:06.0428 6048  Wdf01000 - ok
18:31:06.0488 6048  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost  C:\Windows\system32\wdi.dll
18:31:06.0535 6048  WdiServiceHost - ok
18:31:06.0539 6048  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost  C:\Windows\system32\wdi.dll
18:31:06.0573 6048  WdiSystemHost - ok
18:31:06.0612 6048  [ 04C37D8107320312FBAE09926103D5E2 ] WebClient      C:\Windows\System32\webclnt.dll
18:31:06.0634 6048  WebClient - ok
18:31:06.0736 6048  [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc          C:\Windows\system32\wecsvc.dll
18:31:06.0786 6048  Wecsvc - ok
18:31:06.0820 6048  [ 670FF720071ED741206D69BD995EA453 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
18:31:06.0881 6048  wercplsupport - ok
18:31:06.0933 6048  [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc          C:\Windows\System32\WerSvc.dll
18:31:06.0982 6048  WerSvc - ok
18:31:07.0139 6048  [ 4575AA12561C5648483403541D0D7F2B ] WinDefend      C:\Program Files\Windows Defender\mpsvc.dll
18:31:07.0215 6048  WinDefend - ok
18:31:07.0241 6048  WinHttpAutoProxySvc - ok
18:31:07.0516 6048  [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
18:31:07.0566 6048  Winmgmt - ok
18:31:07.0651 6048  [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM          C:\Windows\system32\WsmSvc.dll
18:31:07.0747 6048  WinRM - ok
18:31:07.0804 6048  [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc        C:\Windows\System32\wlansvc.dll
18:31:07.0864 6048  Wlansvc - ok
18:31:07.0915 6048  [ 6067ACEF367E79914AF628FA1E9B5330 ] wlcrasvc        C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
18:31:07.0966 6048  wlcrasvc - ok
18:31:08.0639 6048  [ 0A70F4022EC2E14C159EFC4F69AA2477 ] wlidsvc        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
18:31:08.0764 6048  wlidsvc - ok
18:31:08.0836 6048  [ 701A9F884A294327E9141D73746EE279 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
18:31:08.0924 6048  WmiAcpi - ok
18:31:08.0997 6048  [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
18:31:09.0029 6048  wmiApSrv - ok
18:31:09.0405 6048  [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc  C:\Program Files\Windows Media Player\wmpnetwk.exe
18:31:09.0504 6048  WMPNetworkSvc - ok
18:31:09.0564 6048  [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
18:31:09.0614 6048  WPCSvc - ok
18:31:09.0655 6048  [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
18:31:09.0715 6048  WPDBusEnum - ok
18:31:09.0763 6048  [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb          C:\Windows\system32\DRIVERS\wpdusb.sys
18:31:09.0776 6048  WpdUsb - ok
18:31:10.0159 6048  [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
18:31:10.0187 6048  WPFFontCache_v0400 - ok
18:31:10.0232 6048  [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
18:31:10.0274 6048  ws2ifsl - ok
18:31:10.0344 6048  [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc          C:\Windows\System32\wscsvc.dll
18:31:10.0359 6048  wscsvc - ok
18:31:10.0363 6048  WSearch - ok
18:31:10.0660 6048  [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv        C:\Windows\system32\wuaueng.dll
18:31:10.0804 6048  wuauserv - ok
18:31:10.0856 6048  [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
18:31:10.0916 6048  WudfPf - ok
18:31:10.0976 6048  [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
18:31:11.0044 6048  WUDFRd - ok
18:31:11.0098 6048  [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
18:31:11.0118 6048  wudfsvc - ok
18:31:11.0169 6048  ================ Scan global ===============================
18:31:11.0214 6048  [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
18:31:11.0266 6048  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
18:31:11.0283 6048  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
18:31:11.0437 6048  [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
18:31:11.0440 6048  [Global] - ok
18:31:11.0440 6048  ================ Scan MBR ==================================
18:31:11.0474 6048  [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
18:31:12.0339 6048  \Device\Harddisk0\DR0 - ok
18:31:12.0351 6048  [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk1\DR1
18:31:12.0668 6048  \Device\Harddisk1\DR1 - ok
18:31:12.0668 6048  ================ Scan VBR ==================================
18:31:12.0694 6048  [ BDBBAB6EA4E1C14F074929AA70EA8F22 ] \Device\Harddisk0\DR0\Partition1
18:31:12.0696 6048  \Device\Harddisk0\DR0\Partition1 - ok
18:31:12.0721 6048  [ 7D2EB849D5D64D16FB4380EA47BB419A ] \Device\Harddisk1\DR1\Partition1
18:31:12.0723 6048  \Device\Harddisk1\DR1\Partition1 - ok
18:31:12.0725 6048  ============================================================
18:31:12.0725 6048  Scan finished
18:31:12.0725 6048  ============================================================
18:31:12.0770 3848  Detected object count: 0
18:31:12.0770 3848  Actual detected object count: 0

markusg 31.01.2013 20:14
Hi
combofix:
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Kaffeevampy 31.01.2013 20:42
Code:
ComboFix 13-01-31.03 - **** 31.01.2013  20:30:12.1.4 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3070.1816 [GMT 1:00]
ausgeführt von:: c:\users\Sophia\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-12-28 bis 2013-01-31  ))))))))))))))))))))))))))))))
.
.
2013-01-31 12:26 . 2013-01-31 12:26        --------        d-----w-        C:\_OTL
2013-01-27 18:41 . 2013-01-31 19:14        --------        d-----w-        c:\users\Sophia\AppData\Roaming\TS3Client
2013-01-27 18:40 . 2013-01-27 18:40        --------        d-----w-        c:\users\Sophia\AppData\Local\TeamSpeak 3 Client
2013-01-23 21:19 . 2013-01-23 21:19        --------        d-----w-        c:\users\Sophia\AppData\Local\Macromedia
2013-01-23 21:18 . 2013-01-23 21:18        697864        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2013-01-15 09:37 . 2013-01-03 18:34        1638912        ----a-w-        c:\windows\system32\mshtml.tlb
2013-01-09 07:45 . 2012-11-23 01:35        2048000        ----a-w-        c:\windows\system32\win32k.sys
2013-01-09 07:44 . 2012-11-20 04:22        204288        ----a-w-        c:\windows\system32\ncrypt.dll
2013-01-09 07:44 . 2012-11-02 10:19        1400832        ----a-w-        c:\windows\system32\msxml6.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-23 21:18 . 2011-05-14 13:57        74248        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-16 13:12 . 2012-12-22 09:59        34304        ----a-w-        c:\windows\system32\atmlib.dll
2012-12-16 10:50 . 2012-12-22 09:59        293376        ----a-w-        c:\windows\system32\atmfd.dll
2012-11-27 09:01 . 2012-12-17 09:37        83944        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2012-11-22 14:51 . 2012-12-17 09:37        36552        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2012-11-22 14:50 . 2012-12-17 09:37        134336        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-11-13 01:29 . 2012-12-13 09:41        2048        ----a-w-        c:\windows\system32\tzres.dll
2012-11-09 10:42 . 2012-12-13 09:41        916992        ----a-w-        c:\windows\system32\wininet.dll
2012-11-09 10:37 . 2012-12-13 09:41        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2012-11-09 10:36 . 2012-12-13 09:41        1469440        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-11-09 10:36 . 2012-12-13 09:41        71680        ----a-w-        c:\windows\system32\iesetup.dll
2012-11-09 10:36 . 2012-12-13 09:41        109056        ----a-w-        c:\windows\system32\iesysprep.dll
2012-11-09 09:01 . 2012-12-13 09:41        385024        ----a-w-        c:\windows\system32\html.iec
2012-11-09 07:13 . 2012-12-13 09:41        133632        ----a-w-        c:\windows\system32\ieUnatt.exe
2012-11-08 18:00 . 2012-12-14 08:55        6812136        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{AFDF4FAE-F553-4DC6-B568-5765D4E2446C}\mpengine.dll
2011-09-09 13:35 . 2011-09-09 12:33        86402648        ----a-w-        c:\program files\APB_Reloaded_Installer.exe
2013-01-19 09:17 . 2013-01-19 09:17        262552        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-05-31 10082920]
"Conime"="c:\windows\system32\conime.exe" [2009-04-10 69120]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-12-04 384800]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.313\SSScheduler.exe [2012-10-26 271808]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 23666928
*NewlyCreated* - 32221059
*Deregistered* - 23666928
*Deregistered* - 32221059
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2013-01-31 c:\windows\Tasks\User_Feed_Synchronization-{B5B1BA2B-59A9-44F7-B7ED-39CD2E077EE4}.job
- c:\windows\system32\msfeedssync.exe [2012-12-13 07:12]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://g.live.com/1rewlive4startup/home
uInternet Settings,ProxyOverride = *.local;<local>
IE: Free YouTube to MP3 Converter - c:\users\Sophia\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Sophia\AppData\Roaming\Mozilla\Firefox\Profiles\hv9dnq3i.default\
FF - prefs.js: browser.startup.homepage - www.google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-01-31 20:36
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-01-31  20:38:28
ComboFix-quarantined-files.txt  2013-01-31 19:38
.
Vor Suchlauf: 10 Verzeichnis(se), 311.745.982.464 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 311.663.849.472 Bytes frei
.
- - End Of File - - 9DF70DB334A9CBEFE21D2CA9763F12B7
abgeschlossen, wollte aber keinen Neustart haben das Programm.
Nun sagte mir Firefox an, das er nicht mehr als Standardbrowser eingestellt ist O.o

markusg 31.01.2013 20:47
hi
bei der meldung kannst du doch auf standard festlegen klicken oder? combofix verstellt diese Einstellung immer.
malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Kaffeevampy 31.01.2013 22:16
Code:
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.01.31.09

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19393
**** :: ****[Administrator]

31.01.2013 21:08:11
mbam-log-2013-01-31 (21-08-11).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 363056
Laufzeit: 1 Stunde(n), 7 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

markusg 02.02.2013 20:34
hi
lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Kaffeevampy 02.02.2013 21:04
Adobe Digital Editions 11.06.2012 13,4MB unnötig
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 14.05.2011 10.3.181.14 notwendig
Adobe Flash Player 11 Plugin Adobe Systems Incorporated 23.01.2013 11.5.502.146 notwendig
Adobe Reader X (10.1.5) - Deutsch Adobe Systems Incorporated 28.01.2013 118MB 10.1.5 notwendig
APB Reloaded 09.09.2011 5,00GB 1.4.0.567573 unnötig
Audials RapidSolution Software AG 16.12.2011 274MB 9.0.52611.1100 unnötig
Avira Free Antivirus Avira 17.12.2012 113MB 13.0.0.2890 notwendig
Big Fish Games: Game Manager 13.07.2012 23,5MB 3.0.1.60 unnötig
Bing Bar Microsoft Corporation 16.06.2011 1,08MB 6.3.2322.0 unbekannt
BPM-Studio 4 Profi 04.01.2012 17,4MB notwendig
CCleaner Piriform 23.01.2013 5,12MB 3.27 notwendig
Curse Client Curse 22.06.2012 4.0.1.286 notwendig
Diablo III Blizzard Entertainment 09.09.2012 8,03GB 1.0.4.11327 notwendig
EPSON SX130 Series Printer Uninstall SEIKO EPSON Corporation 07.11.2011 notwendig
GamersFirst LIVE! GamersFirst 09.09.2011 34,9MB unnötig
Java 7 Update 6 Oracle 20.08.2012 128MB 7.0.60 notwendig
Malwarebytes Anti-Malware Version 1.70.0.1100 Malwarebytes Corporation 31.01.2013 12,2MB 1.70.0.1100 notwendig
McAfee Security Scan Plus McAfee, Inc. 28.01.2013 9,34MB 3.0.313.1 unnötig
Microsoft .NET Framework 1.1 03.10.2012 unbekannt
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU Microsoft Corporation 07.06.2011 37,1MB unbekannt
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 14.05.2011 27,8MB unbekannt
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 13.06.2011 120MB 4.0.30319 unbekannt
Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 13.06.2011 24,5MB 4.0.30319 unbekannt
Microsoft Silverlight Microsoft Corporation 11.05.2012 40,2MB 4.1.10329.0 unbekannt
Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 16.06.2011 1,74MB 3.1.0000 unbekannt
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 03.10.2012 2,37MB 8.0.59193 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 16.06.2011 234KB 9.0.30729 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 14.05.2011 590KB 9.0.30729.4148 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 16.06.2011 594KB 9.0.30729.6161 unbekannt
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 14.10.2011 15,0MB 10.0.40219 unbekannt
Mozilla Firefox 18.0.1 (x86 de) Mozilla 19.01.2013 43,3MB 18.0.1 notwendig
Mozilla Maintenance Service Mozilla 19.01.2013 204KB 18.0.1 unbekannt
MSXML 4.0 SP2 (KB927978) Microsoft Corporation 22.09.2011 34,0KB 4.20.9841.0 unbekannt
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 22.09.2011 34,0KB 4.20.9870.0 unbekannt
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 22.09.2011 1,33MB 4.20.9876.0 unbekannt
NVIDIA 3D Vision Controller-Treiber 306.23 NVIDIA Corporation 13.09.2012 416KB 306.23 notwendig
NVIDIA 3D Vision Treiber 306.97 NVIDIA Corporation 18.11.2012 21,3MB 306.97 notwendig
NVIDIA Drivers 25.05.2012 notwendig
NVIDIA Grafiktreiber 306.97 NVIDIA Corporation 18.11.2012 90,8MB 306.97 notwendig
NVIDIA PhysX-Systemsoftware 9.12.0604 NVIDIA Corporation 13.09.2012 73,2MB 9.12.0604 notwendig
NVIDIA Update 1.10.8 NVIDIA Corporation 13.09.2012 6,36MB 1.10.8 notwendig
Pando Media Booster Pando Networks Inc. 09.09.2011 7,16MB 2.3.5.6 unnötig
PunkBuster Services Even Balance, Inc. 16.04.2012 0.993 unbekannt
QuickTime Apple Inc. 19.06.2011 73,7MB 7.69.80.9 unnötig
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 11.06.2011 29,1MB 6.0.1.6383 notwendig
Skype™ 6.0 Skype Technologies S.A. 11.12.2012 20,3MB 6.0.126 unnötig
System Requirements Lab 14.05.2011 752KB unbekannt
TeamSpeak 3 Client TeamSpeak Systems GmbH 27.01.2013 57,9MB 3.0.6 notwendig
Wildlife Park 2 Deep Silver 29.12.2011 657MB 1.25 unnötig
Windows Live Essentials Microsoft Corporation 16.06.2011 15.4.3508.1109 unbekannt
Windows Live Mesh ActiveX control for remote connections Microsoft Corporation 16.06.2011 5,58MB 15.4.5722.2 unbekannt
Wizard101(DE) Gameforge 4D GmbH 08.10.2011 1,68GB unnötig


Toll und ich habe die so schön bearbeitet -.-

markusg 04.02.2013 11:47
Die bearbeitung ist ok.
deinstaliere:
Adobe Digital
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden, instalieren.
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok



deinstaliere:
APB Reloaded
Audials
Big
Bing
GamersFirst
Java
downloade Java jre:
Java-Downloads für alle Betriebssysteme
klicke:
Download der Java-Software für Windows Offline
laden, und instalieren
deinstaliere:
McAfee
Microsoft Silverlight
Wildlife
Windows Live : alle für dich unnötigen
Wizard101

Öffne CCleaner, analysieren, starten, PC neustarten.


Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste
    mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.


Alle Zeitangaben in WEZ +1. Es ist jetzt 22:56 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131