Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojaner eingefangen? (https://www.trojaner-board.de/166941-trojaner-eingefangen.html)

Erlu 15.05.2015 11:17
Trojaner eingefangen?
 
Da in den letzten Tagen mein Rechner mehrfach plötzlich abgestürzt ist und im Task Manager zwischendurch hohe CPU Auslastung auftrat, die ich mir nicht erklären konnte bin ich mir nicht sicher, ob ich einen Trojaner o.ä. eingefangen habe!

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-05-2015 02
Ran by Ernst (administrator) on ELINEU on 15-05-2015 11:09:57
Running from C:\Users\Ernst\Desktop
Loaded Profiles: Ernst & UpdatusUser (Available profiles: Ernst & UpdatusUser & Administrator & Gast)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(G Data Software AG) C:\Program Files\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Acronis) C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe
(Aladdin Knowledge Systems, Ltd.) C:\Program Files\Aladdin\eToken\PKIClient\x32\eTSrv.exe
(Foxit Software Inc.) C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
() C:\Users\Ernst\AppData\LocalLow\WOT\IE\WOTUpdater.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\tv_w32.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(TomTom) C:\Program Files\MyDrive Connect\TomTom MyDrive Connect.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(Panasonic Corporation) C:\Program Files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.27.5\GoogleCrashHandler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\GUI\GDSC.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [GDFirewallTray] => C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKLM\...\Run: [G Data ASM] => C:\Program Files\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe [54072 2014-11-21] (Malwarebytes Corporation)
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\...\Run: [MyDriveConnect.exe] => C:\Program Files\MyDrive Connect\TomTom MyDrive Connect.exe [1905032 2015-04-28] (TomTom)
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-3539214255-4280287789-3925056074-1003\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-18\...\Run: [InfoCockpit] => C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE [268800 2009-11-16] (Deutsche Telekom AG, T-Com)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk [2015-03-26]
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 6.3 HD Lite Edition.lnk [2015-03-26]
ShortcutTarget: PHOTOfunSTUDIO 6.3 HD Lite Edition.lnk -> C:\Program Files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe (Panasonic Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1431531089&z=bd607f37b871b2474648360g8zbc1gew9c5g6e7bfm&from=wpc&uid=395049983_1052451_74975161&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1431531089&z=bd607f37b871b2474648360g8zbc1gew9c5g6e7bfm&from=wpc&uid=395049983_1052451_74975161&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1431531089&z=bd607f37b871b2474648360g8zbc1gew9c5g6e7bfm&from=wpc&uid=395049983_1052451_74975161&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000 -> {55A9FE75-E6CD-439D-8012-65202831D22F} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=402027&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3539214255-4280287789-3925056074-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2012-06-14] (CANON INC.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-02] (Oracle Corporation)
BHO: WOT -> {9E571C81-21E7-496B-9E6B-127E60263022} -> C:\Users\Ernst\AppData\LocalLow\WOT\IE\WOT.dll [2012-01-12] (WOT Services Oy)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-02] (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2012-06-14] (CANON INC.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2007-11-07] (Skype Technologies)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.33.2

FireFox:
========
FF ProfilePath: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default
FF DefaultSearchEngine: mystartsearch
FF SearchEngineOrder.2:
FF SelectedSearchEngine: mystartsearch
FF Homepage: https://www.google.de/?gws_rd=ssl
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @innoplus.de/ino3DViewer -> C:\Program Files\innoplus\3D-Viewer-innoPlus\npIno3DViewer.dll [2012-04-25] (INNOVA-engineering GmbH Dresden)
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-02] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-02] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Plugin: @Sibelius.com/Scorch Plugin,version=6.2.0.88 -> C:\Program Files\Sibelius Software\Scorch\npsibelius.dll [2013-03-11] ()
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> E:\Program Files\VideoLAN\VLC\npvlc.dll [2013-11-11] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPSibelius.dll [2010-04-08] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\PDFNetC.dll [2010-03-31] (PDFTron Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ScorchAxPlugin.dll [2010-04-08] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ScorchPDFWrapper.dll [2010-04-08] ()
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\englische-ergebnisse.xml [2012-08-12]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\gmx-suche.xml [2012-08-12]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\google-images.xml [2014-09-21]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\google-maps.xml [2014-09-21]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\lastminute.xml [2012-08-12]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\webde-suche.xml [2012-08-12]
FF HKLM\...\Firefox\Extensions: [{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}] - C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox
FF Extension: Internet Video Downloader - C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2011-01-18]
FF HKLM\...\Firefox\Extensions: [searchffv2@gmail.com] - C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\extensions\searchffv2@gmail.com
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-04-23]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [nphjeokkkbngjpiofnfpnafjeofjomfb] - C:\Users\Ernst\AppData\LocalLow\WOT\CHROME\WOT.crx [2012-01-12]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [764552 2010-12-11] (Acronis)
R2 afcdpsrv; C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe [3246040 2011-02-01] (Acronis)
R2 AVKProxy; C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG)
R2 AVKService; C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe [2159472 2014-03-25] (G Data Software AG)
S3 becldr3Service; C:\Program Files\BCL Technologies\easyConverter SDK 3\Common\becldr.exe [176128 2011-04-19] () [File not signed]
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [851456 2015-04-27] (Microsoft Corporation)
R2 eTSrv; C:\Program Files\Aladdin\eToken\PKIClient\x32\eTSrv.exe [7168 2008-11-03] (Aladdin Knowledge Systems, Ltd.) [File not signed]
R2 FoxitCloudUpdateService; C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [243880 2015-01-16] (Foxit Software Inc.)
R3 GDFwSvc; C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe [2409280 2014-01-30] (G Data Software AG)
R3 GDScan; C:\Program Files\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG)
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-01-24] (Hewlett-Packard Company) [File not signed]
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 PCLEPCI; C:\Windows\system32\drivers\pclepci.sys [14165 2005-02-09] (Pinnacle Systems GmbH) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
R2 WOTUpdater; C:\Users\Ernst\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [46976 2009-07-14] (Microsoft Corporation)
R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R3 AKSIFDH; C:\Windows\System32\DRIVERS\aksifdh.sys [48296 2008-07-29] (Aladdin Knowledge Systems, Ltd.)
S3 AKSUP; C:\Windows\System32\drivers\aksup.sys [34472 2008-07-29] (Aladdin Knowledge Systems, Ltd.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [26032 2013-06-02] (Wondershare)
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [27496 2012-09-04] (AVG Technologies)
S3 DCamUSBTP10; C:\Windows\System32\Drivers\iP293x.sys [246272 2008-10-30] (iPassion Technology Inc.) [File not signed]
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [14920 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9160 2013-03-07] () [File not signed]
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [60104 2010-07-12] (FTDI Ltd.)
U0 gcvgj; C:\Windows\System32\drivers\xgpnfb.sys [52440 2015-05-15] (Malwarebytes Corporation)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [44544 2015-03-16] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [101504 2015-03-16] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [56832 2015-03-16] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd32.sys [53248 2015-03-16] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [29528 2015-03-16] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [50176 2015-03-16] (G Data Software AG)
R3 MarvinBus; C:\Windows\System32\DRIVERS\MarvinBus.sys [171520 2005-09-23] (Pinnacle Systems GmbH)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-05-15] (Malwarebytes Corporation)
R1 RrNetCapFilterDriver; C:\Windows\System32\DRIVERS\RrNetCapFilterDriver.sys [22184 2014-08-25] (Audials AG)
R3 tbhsd; C:\Windows\System32\drivers\tbhsd.sys [39048 2013-11-27] (RapidSolution Software AG)
R2 tifsfilter; C:\Windows\System32\DRIVERS\tifsfilt.sys [27648 2010-04-29] (Acronis) [File not signed]
S3 ZMHHPAudioSrv; C:\Windows\System32\drivers\zmhhpau.sys [32000 2010-04-16] (ZOOM)
S3 ZTEusbnet; C:\Windows\System32\DRIVERS\ZTEusbnet.sys [110592 2009-04-09] (ZTE Corporation)
S3 ZTEusbvoice; C:\Windows\System32\DRIVERS\ZTEusbvoice.sys [105344 2009-04-09] (ZTE Incorporated)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Ernst\AppData\Local\Temp\catchme.sys [X]
S3 DCamUSBSTK02N; system32\DRIVERS\STK02NW2.sys [X]
S3 StarOpen; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-15 11:09 - 2015-05-15 11:10 - 00020056 _____ () C:\Users\Ernst\Desktop\FRST.txt
2015-05-15 11:09 - 2015-05-15 11:10 - 00000000 ____D () C:\FRST
2015-05-15 11:09 - 2015-05-15 11:09 - 00000446 _____ () C:\Users\Ernst\Desktop\defogger_disable.log
2015-05-15 11:09 - 2015-05-15 11:09 - 00000000 _____ () C:\Users\Ernst\defogger_reenable
2015-05-15 08:55 - 2015-05-15 08:55 - 00052440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\xgpnfb.sys
2015-05-15 07:58 - 2015-05-15 07:58 - 00380416 _____ () C:\Users\Ernst\Desktop\Gmer-19357.exe
2015-05-15 07:56 - 2015-05-15 07:56 - 01145856 _____ (Farbar) C:\Users\Ernst\Desktop\FRST.exe
2015-05-15 07:55 - 2015-05-15 07:55 - 00050477 _____ () C:\Users\Ernst\Desktop\Defogger.exe
2015-05-14 14:45 - 2015-05-15 10:44 - 00091082 _____ () C:\Windows\WindowsUpdate.log
2015-05-14 14:43 - 2015-05-14 19:28 - 00000112 _____ () C:\Windows\setupact.log
2015-05-14 14:43 - 2015-05-14 14:43 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-14 14:42 - 2015-05-14 14:42 - 00567896 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 14:42 - 2015-05-14 14:42 - 00002700 _____ () C:\Windows\PFRO.log
2015-05-14 14:03 - 2015-05-14 14:03 - 00182064 _____ () C:\Users\Ernst\AppData\Local\GDIPFONTCACHEV1.DAT
2015-05-14 10:24 - 2015-05-14 10:24 - 00000000 ____D () C:\Program Files\Doblon
2015-05-14 03:36 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 17:30 - 2015-05-15 07:41 - 00000000 ____D () C:\Program Files\Quick Login for Google Accounts
2015-05-13 17:30 - 2015-05-15 07:41 - 00000000 ____D () C:\Program Files\PriceMinus
2015-05-13 17:30 - 2015-05-15 07:40 - 00000000 ____D () C:\Program Files\PriicEEMiNus
2015-05-13 17:30 - 2015-05-15 07:40 - 00000000 ____D () C:\Program Files\bestadblocker
2015-05-13 17:30 - 2015-05-13 17:30 - 00000000 ____D () C:\ProgramData\6739778865081373131
2015-05-13 17:28 - 2015-05-15 05:28 - 00000324 ____N () C:\Windows\Tasks\Bidaily Synchronize Task.job
2015-05-13 17:28 - 2015-05-14 19:22 - 00000000 ____D () C:\ProgramData\{f3467395-93d6-35df-f346-6739593dce56}
2015-05-13 13:30 - 2015-05-13 17:12 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\MediaMonkey
2015-05-13 13:30 - 2015-05-13 13:30 - 00000000 ____D () C:\Users\Ernst\AppData\Local\MediaMonkey
2015-05-13 08:15 - 2015-05-14 10:15 - 00000000 ____D () C:\Program Files\Karaoke5
2015-05-13 07:43 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 07:43 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 07:43 - 2015-04-21 18:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 07:43 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 07:43 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 07:43 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 07:43 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 07:43 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 07:43 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 07:43 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 07:43 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 07:43 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 07:43 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 07:43 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 07:43 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 07:43 - 2015-04-21 17:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 07:43 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 07:43 - 2015-04-21 17:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 07:43 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 07:43 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 07:43 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 07:43 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 07:43 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 07:43 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 07:43 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 07:43 - 2015-04-21 17:26 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 07:43 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 07:43 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 07:43 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 07:43 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 07:43 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 07:43 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 07:42 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-05-13 07:42 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 07:42 - 2015-04-27 21:11 - 00137664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 07:42 - 2015-04-27 21:11 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 07:42 - 2015-04-27 21:08 - 01307648 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00851456 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 07:42 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 07:42 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 07:42 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 07:42 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 07:42 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 07:42 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 07:42 - 2015-04-27 20:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 07:42 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 07:42 - 2015-04-20 04:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 07:42 - 2015-04-20 04:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 07:42 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 07:41 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 07:41 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 07:41 - 2015-04-13 05:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 07:36 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 07:36 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 07:36 - 2015-03-04 06:10 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 07:36 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 07:32 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 07:32 - 2015-04-08 05:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 07:32 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-12 14:41 - 2015-05-12 14:45 - 00000000 ____D () C:\Users\Ernst\Desktop\2015-05-12
2015-05-10 18:11 - 2015-05-10 18:11 - 00003549 _____ () C:\Users\Ernst\Documents\chrofreizeitfulda2015.nra
2015-05-10 08:46 - 2015-05-10 08:51 - 00000000 ____D () C:\Users\Ernst\Desktop\2015-05-10
2015-05-07 14:31 - 2015-05-07 14:31 - 00000000 ____D () C:\Users\Ernst\.chili
2015-05-03 10:27 - 2015-05-03 10:29 - 218207212 _____ () C:\Users\Ernst\Downloads\Med7v801(2).exe
2015-05-02 20:26 - 2015-05-02 20:26 - 23308160 _____ (TomTom International B.V.) C:\Users\Ernst\Downloads\InstallMyDriveConnect.exe
2015-04-30 20:40 - 2015-04-30 20:40 - 00000000 ____D () C:\med7BDT
2015-04-30 13:31 - 2015-04-30 13:31 - 28995288 _____ (DVDVideoSoft Ltd. ) C:\Users\Ernst\Downloads\FreeAudioCDToMP3Converter.exe
2015-04-25 09:33 - 2015-04-25 09:35 - 219637741 _____ () C:\Users\Ernst\Downloads\Med7v801(1).exe
2015-04-23 14:45 - 2015-05-14 11:48 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-22 07:45 - 2015-04-22 07:46 - 39074536 _____ (Microsoft Corporation) C:\Users\Ernst\Downloads\FileFormatConverters.exe
2015-04-18 07:20 - 2015-04-18 07:23 - 219637741 _____ () C:\Users\Ernst\Downloads\Med7v801.exe
2015-04-18 07:01 - 2015-04-18 07:10 - 816849717 _____ () C:\Users\Ernst\Downloads\MMI_PHARMINDEX_2015_Q2_20150315_17.1.0.exe
2015-04-16 16:43 - 2015-04-16 16:43 - 00001016 _____ () C:\Users\Ernst\Desktop\MMI PHARMINDEX.lnk
2015-04-16 03:09 - 2015-05-14 03:34 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-15 17:54 - 2015-03-23 05:06 - 00860160 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-15 17:54 - 2015-03-23 05:06 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-15 17:54 - 2015-03-23 05:06 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-15 17:54 - 2015-03-23 05:06 - 00331264 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-15 17:54 - 2015-03-23 05:06 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-15 17:54 - 2015-03-23 05:06 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-04-15 17:54 - 2015-03-23 05:06 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-15 17:54 - 2015-03-23 04:59 - 00896000 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-15 17:54 - 2015-03-04 06:16 - 00249784 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-15 17:54 - 2015-03-04 06:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-15 17:53 - 2015-03-05 06:06 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-15 17:51 - 2015-03-25 05:00 - 03088384 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-15 17:51 - 2015-03-25 05:00 - 02020864 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-15 17:51 - 2015-03-25 05:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-15 17:51 - 2015-03-25 05:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-15 17:51 - 2015-03-25 05:00 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-15 17:51 - 2015-03-25 05:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-15 17:51 - 2015-03-25 05:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-15 17:51 - 2015-03-25 05:00 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-15 17:51 - 2015-03-25 05:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-15 17:51 - 2015-03-25 05:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-15 17:51 - 2015-03-25 05:00 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-15 17:51 - 2015-03-10 05:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-15 17:51 - 2015-03-10 05:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-15 17:51 - 2015-02-25 05:03 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-15 11:09 - 2010-01-16 14:40 - 00000000 ____D () C:\Users\Ernst
2015-05-15 08:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\security
2015-05-15 07:45 - 2015-03-10 21:44 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-15 07:30 - 2011-01-08 10:44 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-15 06:57 - 2012-09-23 10:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-15 03:30 - 2011-01-08 10:44 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-14 22:03 - 2014-10-01 14:23 - 00000000 ____D () C:\Windows\rescache
2015-05-14 19:36 - 2009-07-14 06:34 - 00023168 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-14 19:36 - 2009-07-14 06:34 - 00023168 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-14 19:29 - 2015-03-21 11:14 - 00000266 _____ () C:\Windows\Tasks\AbelssoftPreloader.job
2015-05-14 19:28 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-14 14:41 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-05-14 14:24 - 2009-07-14 10:56 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-14 13:55 - 2013-09-14 12:45 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-14 12:01 - 2015-04-02 18:31 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2015-05-14 12:01 - 2013-11-04 14:46 - 00000000 ____D () C:\Users\Ernst\AppData\Local\Help
2015-05-14 12:01 - 2011-08-22 16:37 - 00000000 ____D () C:\ProgramData\tmp
2015-05-14 12:01 - 2010-05-06 13:32 - 00000000 ____D () C:\temp
2015-05-14 12:01 - 2010-03-16 23:02 - 00000000 ____D () C:\Program Files\iPhoto Plus 4
2015-05-14 12:01 - 2010-02-07 11:43 - 00000000 ____D () C:\med7net
2015-05-14 12:01 - 2010-02-07 11:42 - 00000000 ____D () C:\Med7
2015-05-14 11:49 - 2014-01-27 15:35 - 00000000 ____D () C:\Program Files\PDF24
2015-05-14 11:49 - 2013-08-25 09:33 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\TeamViewer
2015-05-14 11:49 - 2010-01-18 17:53 - 00000000 ____D () C:\Program Files\K-Lite Codec Pack
2015-05-14 11:49 - 2010-01-16 14:45 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-05-14 11:48 - 2015-02-01 10:50 - 00000000 ____D () C:\ProgramData\install_clap
2015-05-14 11:48 - 2013-11-04 09:19 - 00000000 ____D () C:\Users\Ernst\AppData\Local\NETGEARGenie
2015-05-14 11:48 - 2011-01-23 11:06 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\vlc
2015-05-14 11:47 - 2014-06-29 13:35 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\MusicNet
2015-05-14 11:47 - 2011-07-09 19:56 - 00000000 ____D () C:\Windows\Minidump
2015-05-14 11:47 - 2010-01-18 18:06 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\Media Player Classic
2015-05-14 10:14 - 2010-01-16 14:43 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-14 04:08 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-05-14 03:55 - 2012-08-30 18:58 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-14 03:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-14 03:15 - 2010-12-08 23:11 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-14 03:08 - 2012-08-30 18:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 13:17 - 2010-01-17 15:09 - 00000349 _____ () C:\Users\Public\Documents\PCLECHAL.INI
2015-05-12 14:55 - 2013-11-09 19:20 - 00000000 ____D () C:\Users\Ernst\AppData\Local\FRITZ!
2015-05-10 18:14 - 2010-06-08 20:37 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\Audacity
2015-05-10 17:07 - 2014-09-15 15:57 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft
2015-05-10 17:07 - 2013-09-06 18:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-05-10 17:07 - 2013-09-06 18:49 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\DVDVideoSoft
2015-05-10 17:07 - 2013-09-06 18:49 - 00000000 ____D () C:\Program Files\DVDVideoSoft
2015-05-02 20:58 - 2010-02-05 19:46 - 00000000 ____D () C:\Program Files\Java
2015-05-02 20:56 - 2015-03-18 18:50 - 00096352 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-05-02 20:27 - 2014-12-30 14:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2015-05-02 20:27 - 2014-12-30 14:13 - 00000000 ____D () C:\Program Files\MyDrive Connect
2015-05-02 11:06 - 2015-01-23 18:56 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\Steganos
2015-05-02 10:26 - 2010-02-09 14:39 - 00000024 _____ () C:\ProgramData\__FileUploader.log
2015-05-01 09:58 - 2010-09-07 14:11 - 00000000 ____D () C:\Users\Ernst\Documents\DVDVideoSoft
2015-05-01 09:54 - 2010-11-27 22:01 - 00001971 _____ () C:\Users\Ernst\Documents\GNMIDI.ini
2015-04-30 13:32 - 2014-09-15 15:57 - 00001197 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2015-04-25 09:24 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-25 09:23 - 2012-05-06 18:05 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-22 07:48 - 2010-01-19 14:28 - 00000000 ____D () C:\Program Files\Microsoft Office
2015-04-22 07:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2015-04-18 10:56 - 2014-10-23 13:17 - 00001656 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Med7 Arztpraxisprogramm.lnk
2015-04-18 10:36 - 2010-02-07 11:40 - 00000000 ____D () C:\Windows\Downloaded Installations
2015-04-16 04:44 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\AppCompat
2015-04-16 03:40 - 2014-12-12 04:33 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-16 03:40 - 2014-05-07 03:20 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-04-15 19:57 - 2012-09-23 10:36 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-15 19:57 - 2011-07-10 18:15 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======

2010-11-13 18:16 - 2010-11-13 18:16 - 0000604 ____H () C:\Program Files\STFT Notifier
2014-05-08 14:45 - 2014-05-08 14:45 - 0000000 _____ () C:\Users\Ernst\AppData\Roaming\gdfw.log
2014-05-08 14:45 - 2015-03-16 14:53 - 0003116 _____ () C:\Users\Ernst\AppData\Roaming\gdscan.log
2010-01-16 20:02 - 2010-01-15 23:42 - 4302944 _____ () C:\Users\Ernst\AppData\Roaming\IMAG0023.AVI
2014-05-14 21:54 - 2014-05-14 22:06 - 0028268 _____ () C:\Users\Ernst\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2014-12-07 12:01 - 2014-12-07 12:03 - 0583820 _____ () C:\Users\Ernst\AppData\Roaming\Scorch_Install.log
2010-03-08 23:21 - 2010-03-08 23:31 - 0282624 _____ () C:\Users\Ernst\AppData\Local\filesync.metadata
2010-02-09 14:39 - 2015-05-02 10:26 - 0000024 _____ () C:\ProgramData\__FileUploader.log

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-14 21:54

==================== End Of Log ============================
--- --- ---

Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 14-05-2015 02
Ran by Ernst at 2015-05-15 11:11:37
Running from C:\Users\Ernst\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3539214255-4280287789-3925056074-500 - Administrator - Enabled) => C:\Users\Administrator
Ernst (S-1-5-21-3539214255-4280287789-3925056074-1000 - Administrator - Enabled) => C:\Users\Ernst
Gast (S-1-5-21-3539214255-4280287789-3925056074-501 - Limited - Enabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-3539214255-4280287789-3925056074-1051 - Limited - Enabled)
UpdatusUser (S-1-5-21-3539214255-4280287789-3925056074-1003 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: G Data InternetSecurity CBE (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G Data InternetSecurity CBE (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G Data Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

3D-Viewer-innoplus (HKLM\...\{B96DB037-DBEA-4186-9081-9CBD537F82E8}) (Version: 14.00.70 - INNOVA-engineering GmbH)
7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
AceBackup 3 (HKLM\...\{87B60A11-AA9E-43FE-A68F-B3C4F80F7D2F}) (Version: 3.0.2 - AceBIT)
Acronis*True*Image*Home (HKLM\...\{67ED38A3-4882-448B-B44D-3428AB00D7D5}) (Version: 13.0.7154 - Acronis)
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AmazingMIDI (HKLM\...\AmazingMIDI) (Version:  - )
Apple Application Support (32-Bit) (HKLM\...\{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{E1DB0812-2D60-43DB-AE09-6C7027D93B28}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ashampoo Photo Commander 11 v.11.1.6 (HKLM\...\{C92AB6F1-0F9C-8526-5DF1-0A2FD0FB33D9}_is1) (Version: 11.1.6 - Ashampoo GmbH & Co. KG)
Audacity 2.0.5 (HKLM\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Audials (HKLM\...\{356DC986-755B-471C-83C7-49BD0CB1614F}) (Version: 11.0.55900.0 - Audials AG)
Audials (HKLM\...\{69626CD9-18D4-4DA7-BB50-D452A93B3D68}) (Version: 12.0.54100.0 - Audials AG)
AudibleManager (HKLM\...\AudibleManager) (Version: 2000640624.48.56.11209962 - Audible, Inc.)
Aura Video to Audio Converter 1.2.5 (HKLM\...\Aura Video to Audio Converter_is1) (Version:  - Aura4You.com)
Aura4You Software Manager 1.0.2 (HKLM\...\Aura4You Software Manager_is1) (Version:  - aura4you.com)
AutoHotkey 1.0.48.05 (HKLM\...\AutoHotkey) (Version: 1.0.48.05 - Chris Mallett)
AviSynth 2.5 (HKLM\...\AviSynth) (Version:  - )
AVS Video ReMaker 4.2.2.153 (HKLM\...\AVS Video ReMaker_is1) (Version: 4.2.2.153 - Online Media Technologies Ltd.)
BCL easyConverter 3.0 Licensing Module (BCL License) (Version: 3.0.18 - BCL Technologies) Hidden
BCL easyConverter 3.0 Loader SDK Module (Version: 3.0.18 - BCL Technologies) Hidden
BCL easyConverter 3.0 Module (Loader, BCL License) (Version: 3.0.18 - BCL Technologies) Hidden
BCL easyConverter 3.0 Module (RTF, BCL License) (Version: 3.0.18 - BCL Technologies) Hidden
BCL easyConverter 3.0 RTF SDK Module (Version: 3.0.18 - BCL Technologies) Hidden
BCL easyConverter 3.0 SDK Module (Version: 3.0.18 - BCL Technologies) Hidden
Biet-O-Matic v2.14.8 (HKLM\...\Biet-O-Matic v2.14.8) (Version: 2.14.8 - BOM Development Team)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Canon Easy-WebPrint EX (HKLM\...\Easy-WebPrint EX) (Version: 1.3.5.0 - Canon Inc.)
Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version: 3.1.0 - Canon Inc.)
Canon iP7200 series Benutzerregistrierung (HKLM\...\Canon iP7200 series Benutzerregistrierung) (Version:  - Canon Inc.‎)
Canon iP7200 series On-screen Manual (HKLM\...\Canon iP7200 series On-screen Manual) (Version: 7.5.0 - Canon Inc.)
Canon iP7200 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP7200_series) (Version:  - Canon Inc.)
Canon My Image Garden (HKLM\...\Canon My Image Garden) (Version: 1.0.0 - Canon Inc.)
Canon My Image Garden Design Files (HKLM\...\Canon My Image Garden Design Files) (Version: 1.0.0 - Canon Inc.)
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)
Canon ScanGear Starter (HKLM\...\{18A5DFF2-8A95-49F3-873F-743CB5549F3D}) (Version:  - )
CanoScan Toolbox Ver4.9 (HKLM\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version:  - )
CardRecovery 6.00 (HKLM\...\{88D68A69-D247-466B-90DD-575F6BE16230}_is1) (Version:  - WinRecovery Software)
CD-LabelPrint (HKLM\...\MediaNavigation.CDLabelPrint) (Version:  - )
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CuteFTP 9 (HKLM\...\{89B9E358-75C6-4C6B-BD38-803FF156CC4B}) (Version: 9.0.5 - Globalscape)
CyberLink PhotoDirector 5 (HKLM\...\InstallShield_{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.5724.0 - CyberLink Corp.)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
DMPmanager (HKLM\...\DMPmanager) (Version:  - )
Dropbox (HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\...\Dropbox) (Version: 3.2.9 - Dropbox, Inc.)
DVAPTray (HKLM\...\{30D1B542-44E0-44F0-8A31-2A101CB626B5}) (Version: 1.0.0.3 - )
DVR-Capture 1.01.1 (HKLM\...\DVR-Capture) (Version: 1.01.1 - Haenien-Software)
EaseUS Partition Master 9.2.2 (HKLM\...\EaseUS Partition Master_is1) (Version:  - EaseUS)
eHealth500 Terminal (HKLM\...\{0DAB42A7-C726-4E23-B5B9-1D774B96FC2D}) (Version: 1.07 - SCM Microsystems)
eToken PKI Client 5.0 SP1 (HKLM\...\{11B9A0E0-4FAB-4296-A633-2534F80C60FE}) (Version: 5.00.0.65 - Aladdin Knowledge Systems Ltd.)
EURACOM_4D03 (HKLM\...\EURACOM_4D03) (Version:  - )
Fotogalerie (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Foxit Cloud (HKLM\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 2.6.36.116 - Foxit Software Inc.)
Foxit Reader (HKLM\...\Foxit Reader_is1) (Version: 6.1.5.624 - Foxit Corporation)
Free Audio Converter version 5.0.47.906 (HKLM\...\Free Audio Converter_is1) (Version: 5.0.47.906 - DVDVideoSoft Ltd.)
Free DVD MP3 Ripper 1.12 (HKLM\...\Free DVD MP3 Ripper_is1) (Version:  - Jodix Technologies Ltd.)
Free M4a to MP3 Converter 6.2 (HKLM\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)
Free MP4 Video Converter version 5.0.57.219 (HKLM\...\Free MP4 Video Converter_is1) (Version: 5.0.57.219 - DVDVideoSoft Ltd.)
Free PDF to Word Doc Converter v1.1 (HKLM\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com)
Free Video Flip and Rotate version 1.0.8.1215 (HKLM\...\Free Video Flip and Rotate_is1) (Version: 1.0.8.1215 - DVDVideoSoft Ltd.)
Free Video to iPad Converter version 5.0.52.1122 (HKLM\...\Free Video to iPad Converter_is1) (Version: 5.0.52.1122 - DVDVideoSoft Ltd.)
Free Video to iPhone Converter version 5.0.51.1022 (HKLM\...\Free Video to iPhone Converter_is1) (Version: 5.0.51.1022 - DVDVideoSoft Ltd.)
Free Video to MP3 Converter version 5.0.51.1022 (HKLM\...\Free Video to MP3 Converter_is1) (Version: 5.0.51.1022 - DVDVideoSoft Ltd.)
Free YouTube to iPhone Converter version 2.12.45.923 (HKLM\...\Free YouTube to iPhone Converter_is1) (Version: 2.12.45.923 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.49.1022 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.49.1022 - DVDVideoSoft Ltd.)
FreeOCR v5.0 (HKLM\...\freeocr_is1) (Version:  - )
FreePDF (Remove only) (HKLM\...\FreePDF_XP) (Version:  - )
FRITZ!Box-Fernzugang einrichten (HKLM\...\{EFADD989-D9F2-49F6-A280-675951CC78D3}) (Version: 1.0.3 - AVM Berlin)
G Data InternetSecurity CBE (HKLM\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.1.2 - G Data Software AG)
Gelbe Liste Pharmindex (HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\...\Gelbe Liste Pharmindex GLP) (Version:  - )
GIMP 2.8.0 (HKLM\...\GIMP-2_is1) (Version: 2.8.0 - The GIMP Team)
GoGear ARIA Device Manager (HKLM\...\{43B0D334-9A1B-4257-9E51-D3813BD8B9D0}) (Version: 01.05 - Philips)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.27.5 - Google Inc.) Hidden
GPL Ghostscript 8.56 (HKLM\...\GPL Ghostscript 8.56) (Version:  - )
GPL Ghostscript 9.00 (HKLM\...\GPL Ghostscript 9.00) (Version:  - )
GPL Ghostscript Fonts (HKLM\...\GPL Ghostscript Fonts) (Version:  - )
Haali Media Splitter (HKLM\...\HaaliMkx) (Version:  - )
H-Series_ASIO32 (HKLM\...\{17FE3002-491F-11DF-9F17-00269E8DC781}) (Version: 1.1.0 - ZOOM)
iBackupBot 5.1.7 (HKLM\...\iBackupBot) (Version: 5.1.7 - VOWSoft, Ltd.)
iCloud (HKLM\...\{760BB327-3973-4608-85C8-88162E2FF3B6}) (Version: 4.0.6.28 - Apple Inc.)
iFunbox (v2.7.2386.747), iFunbox DevTeam (HKLM\...\iFunbox_is1) (Version: v2.7.2386.747 - )
ImgBurn (HKLM\...\ImgBurn) (Version: 2.5.1.0 - LIGHTNING UK!)
iTunes (HKLM\...\{3A9FE6B1-EE7F-40AC-B831-AC7C9ABB58A0}) (Version: 12.1.1.4 - Apple Inc.)
Java 8 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Java SE Development Kit 8 Update 40 (HKLM\...\{32A3A4F4-B792-11D6-A78A-00B0D0180400}) (Version: 8.0.400.25 - Oracle Corporation)
KaraFun Player (HKLM\...\KaraFun Player_is1) (Version: 1.20.86.771 - Recisio)
KaraFun Player 2 (HKLM\...\KaraFun Player 2_is1) (Version: 2.1.30.158 - Recisio)
KeyView for Lotus 97 (HKLM\...\KeyView for Lotus) (Version:  - )
K-Lite Codec Pack 5.2.0 (Full) (HKLM\...\KLiteCodecPack_is1) (Version: 5.2.0 - )
LAME v3.99.3 (for Windows) (HKLM\...\LAME_is1) (Version:  - )
LightScribe System Software  1.12.29.2 (HKLM\...\{CF8C077A-B467-4C43-8DB5-3A9B94FF9681}) (Version: 1.12.29.2 - hxxp://www.lightscribe.com)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Med7 (HKLM\...\{04DA1E4E-F84C-45B4-90E2-1C7AA63C5DCB}) (Version: 7.97.0014 - Bitron GmbH)
Med7 (HKLM\...\{0CC63C00-BEF6-4CF8-BB4D-E576201A9EE1}) (Version: 7.98.0008 - Bitron GmbH)
Med7 (HKLM\...\{14CD8819-7665-41D3-AC82-D417F2B66F79}) (Version: 7.82.0021 - Bitron GmbH)
Med7 (HKLM\...\{1904F9D8-C3F3-4AC8-9CDA-950C5995B69D}) (Version: 7.98.0062 - Bitron GmbH)
Med7 (HKLM\...\{1AC9A8F0-A373-4329-892A-5062032408BD}) (Version: 7.93.0022 - Bitron GmbH)
Med7 (HKLM\...\{207FD790-4234-4815-A0C3-2FE7C7994EDD}) (Version: 7.77.0004 - Bitron GmbH)
Med7 (HKLM\...\{3C374744-04A9-45BF-BCE0-A9E0DF1FC9E0}) (Version: 7.77.0026 - Bitron GmbH)
Med7 (HKLM\...\{3D3380D6-3445-49A1-865B-8E35B8D0B551}) (Version: 7.96.0009 - Bitron GmbH)
Med7 (HKLM\...\{4640E6BE-D987-4F21-8919-5CECE52DF023}) (Version: 7.76.0038 - Bitron GmbH)
Med7 (HKLM\...\{50259A1D-0095-4F7D-AB68-7A081D154142}) (Version: 7.98.0034 - Bitron GmbH)
Med7 (HKLM\...\{5AEC8DBB-2711-4E25-8799-C5481F78185B}) (Version: 7.99.0019 - Bitron GmbH)
Med7 (HKLM\...\{5FE3AC79-8507-4458-BD5D-F976FCE4BC93}) (Version: 7.87.0002 - Bitron GmbH)
Med7 (HKLM\...\{74E5B1D3-6AD3-4579-8721-325DDA7F33F7}) (Version: 7.96.0012 - Bitron GmbH)
Med7 (HKLM\...\{7DF1EA59-F9CA-4EF3-850C-B27BF084A4EE}) (Version: 7.98.0033 - Bitron GmbH)
Med7 (HKLM\...\{810D62D2-5216-470F-84C7-429CF829424A}) (Version: 7.98.0037 - Bitron GmbH)
Med7 (HKLM\...\{81E08CC8-E93F-428C-BDAD-6EA2A6980D54}) (Version: 7.99.0007 - Bitron GmbH)
Med7 (HKLM\...\{83504068-F2AA-4A93-B6C7-3671AE4DD5DA}) (Version: 7.97.0005 - Bitron GmbH)
Med7 (HKLM\...\{8589EB24-4CA3-4B5F-8D1E-55432FADBAAC}) (Version: 7.98.0011 - Bitron GmbH)
Med7 (HKLM\...\{86DC298C-6468-4B58-A793-28128828497C}) (Version: 7.95.0011 - Bitron GmbH)
Med7 (HKLM\...\{963234F7-5757-4E53-9CC6-F0F122F7AA0D}) (Version: 7.94.0010 - Bitron GmbH)
Med7 (HKLM\...\{9BB904D7-2CDB-4DE7-9713-EC4D607FE26C}) (Version: 7.80.0010 - Bitron GmbH)
Med7 (HKLM\...\{A086E995-265F-4FC0-8A9B-BD036E297494}) (Version: 7.98.0050 - Bitron GmbH)
Med7 (HKLM\...\{A283FAC3-E628-499B-AF19-48C3863EBBB4}) (Version: 7.82.0011 - Bitron GmbH)
Med7 (HKLM\...\{A343BBE3-BA27-4406-8377-C0A0F0141363}) (Version: 7.84.0002 - Bitron GmbH)
Med7 (HKLM\...\{A798BD1D-BD81-4CAF-8870-9F14A3010410}) (Version: 7.82.0019 - Bitron GmbH)
Med7 (HKLM\...\{AEFF6F11-9F11-446F-8723-13097A8931A1}) (Version: 7.84.0017 - Bitron GmbH)
Med7 (HKLM\...\{AF22E4F0-1F5B-4252-B912-1A9DFAA44634}) (Version: 7.98.0012 - Bitron GmbH)
Med7 (HKLM\...\{B187514D-0A81-4C5C-919A-AAED78F21BA2}) (Version: 7.98.0060 - Bitron GmbH)
Med7 (HKLM\...\{B71D7ECF-334E-4FE3-AC9B-5DB2104BDFB6}) (Version: 7.98.0052 - Bitron GmbH)
Med7 (HKLM\...\{B7B279AC-EFF6-4EBC-A559-DA2C2D05C55A}) (Version: 7.99.0023 - Bitron GmbH)
Med7 (HKLM\...\{BA0972B9-BE7C-4FEE-9EEE-DFC42AC935D2}) (Version: 7.80.0005 - Bitron GmbH)
Med7 (HKLM\...\{BEBBC42A-E7A2-466B-9E12-BAA6F4FCD28D}) (Version: 7.77.0010 - Bitron GmbH)
Med7 (HKLM\...\{C09D663B-A9ED-4EEE-8CC3-2C7A3DB63514}) (Version: 7.85.0014 - Bitron GmbH)
Med7 (HKLM\...\{C09D663B-A9ED-4EEE-8CC3-2C7A3DB63526}) (Version: 7.86.0011 - Bitron GmbH)
Med7 (HKLM\...\{C09D663B-A9ED-4EEE-8CC3-2C7A3DB63527}) (Version: 7.86.0012 - Bitron GmbH)
Med7 (HKLM\...\{C09D663B-A9ED-4EEE-8CC3-2C7A3DB63534}) (Version: 7.86.0019 - Bitron GmbH)
Med7 (HKLM\...\{C09D663B-A9ED-4EEE-8CC3-2C7A3DB63535}) (Version: 7.86.0021 - Bitron GmbH)
Med7 (HKLM\...\{C09D663B-A9ED-4EEE-8CC3-2C7A3DB63537}) (Version: 7.86.0023 - Bitron GmbH)
Med7 (HKLM\...\{C751A1AB-5BD1-428C-BC0D-BB3274CAA5F4}) (Version: 7.99.0004 - Bitron GmbH)
Med7 (HKLM\...\{CA674646-942F-45C2-998E-01B4B52D3506}) (Version: 7.98.0039 - Bitron GmbH)
Med7 (HKLM\...\{CAF793AB-C155-4CF6-98F9-8616ADA85D01}) (Version: 7.98.0007 - Bitron GmbH)
Med7 (HKLM\...\{CBD38EDF-5414-4F5F-87C7-E11A5F07B437}) (Version: 7.82.0020 - Bitron GmbH)
Med7 (HKLM\...\{D3407639-1992-49A3-B6A6-F1C3485B9234}) (Version: 7.84.0010 - Bitron GmbH)
Med7 (HKLM\...\{D3407639-1992-49A3-B6A6-F1C3485B9238}) (Version: 7.84.0014 - Bitron GmbH)
Med7 (HKLM\...\{D81B70B9-BAE2-4196-9798-75107C196978}) (Version: 7.99.0008 - Bitron GmbH)
Med7 (HKLM\...\{D93A0256-9E7F-4670-A616-1AA8073FCC09}) (Version: 7.98.0014 - Bitron GmbH)
Med7 (HKLM\...\{E29657DB-B1A5-4C57-B1E5-B9B2AC07EADC}) (Version: 7.77.0032 - Bitron GmbH)
Med7 (HKLM\...\{E8A31658-96D9-4205-9201-5AE4D00AC760}) (Version: 7.98.0005 - Bitron GmbH)
Med7 (HKLM\...\{ECD8C743-11D9-409A-ADAF-D096A67A3557}) (Version: 7.94.0010 - Bitron GmbH)
Med7 (HKLM\...\{F321B542-E142-43A9-8933-6D44CCEF181C}) (Version: 7.84.0003 - Bitron GmbH)
Med7 (HKLM\...\{F9FCBD97-B2E3-4890-B5EE-BE68F33E101E}) (Version: 8.01.0026 - Bitron GmbH)
Media Converter for Philips (HKLM\...\{E623BB3F-F7ED-4148-BEB5-A0D1DB28B4DE}) (Version: 2.5.2.232 - ArcSoft)
MEDION GoPal Assistant (HKLM\...\{B9D45A76-61DF-4387-B0FE-CA165D582B57}) (Version: 6.3.6.13143 - MEDION)
Medion GoPal Assistant 4.03.006 (HKLM\...\Medion GoPal Assistant) (Version: 4.3.6.0 - Medion)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office XP Professional mit FrontPage (HKLM\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.6626.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Sync Framework Runtime v1.0 (x86) (HKLM\...\{A8BD5A60-E843-46DC-8271-ABF20756BE0F}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services v1.0 (x86) (HKLM\...\{03CAB33F-D1C2-48C6-8766-DAE84DFC25FE}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
MMI PHARMINDEX (HKLM\...\Gelbe Liste Pharmindex) (Version:  - )
MobileMe Control Panel (HKLM\...\{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}) (Version: 3.1.8.0 - Apple Inc.)
Movie Maker (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.2 (x86 de) (HKLM\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.6.0 (x86 de)) (Version: 31.6.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyDriveConnect 4.0.2.2123 (HKLM\...\MyDriveConnect) (Version: 4.0.2.2123 - TomTom)
MyVoice (HKLM\...\MyVoice) (Version:  - )
Nero 7 Essentials (HKLM\...\{7BAA9BA8-0761-42EF-842A-23FAA5321031}) (Version: 7.03.0976 - Nero AG)
Neuratron AudioScore Lite (HKLM\...\Neuratron AudioScore Lite) (Version: 6.5.0 - Neuratron Limited)
Neuratron PhotoScore Lite (HKLM\...\Neuratron PhotoScore Lite) (Version: 6.0.0 - Neuratron Limited)
nLite 1.4.9.1 (HKLM\...\nLite_is1) (Version: 1.4.9.1 - Dino Nuhagic (nuhi))
Nur Entfernen der CopyTrans Suite möglich (HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\...\CopyTrans Suite) (Version: 2.37 - WindSolutions)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.57.35 - NVIDIA Corporation)
NVIDIA PhysX (HKLM\...\{B83FC356-B7C0-441F-8A4D-D71E088E7974}) (Version: 9.09.0428 - NVIDIA Corporation)
PantsOff 2.0 (HKLM\...\{EC1F15E1-F3CC-46EE-B7A5-849A08ED60DC}}_is1) (Version: 2.0 - Christoph Bünger Software)
PC-Putzer 2015 (HKLM\...\PC-Putzer 2015_is1) (Version: 19.3 - Abelssoft)
PDF Editor 3 (HKLM\...\PDF Editor 3) (Version:  - )
PDF24 Creator 6.5.0 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDF2Word Converter Version 1.1.0 (Build 164, 7-PDF) (HKLM\...\PDF2Word Converter (7-PDF)_is1) (Version: PDF2Word Converter - Version 1.1.0 (Build 164) - 7-PDF, Germany - Thorsten Hodes)
PhoneClean 3.6.0 (HKLM\...\{2FAFFE02-4D6B-4C0A-906B-1B33DAF0DD14}}_is1) (Version: 3.6.0 - iMobie Inc.)
Pinnacle VideoSpin (HKLM\...\{FEB15887-0932-4D2D-BB85-6AC03FBF1AA8}) (Version: 2.0.0.669 - Pinnacle Systems)
Pixum Fotobuch (HKLM\...\Pixum Fotobuch) (Version:  - )
Plantronics Software (HKLM\...\{348B0E64-D410-4CA2-866B-FD1C60BCB3CE}) (Version: 2.2.41656.0 - Plantronics, Inc.)
POIbase 1.071 (HKLM\...\POIbase_is1) (Version:  - POIbase)
proDAD Heroglyph 2.5 (HKLM\...\proDAD-Heroglyph-2.5) (Version:  - )
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7111 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Printer Live Update (HKLM\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
SDFormatter (HKLM\...\{179324FF-7B16-4BA8-9836-055CAAEE4F08}) (Version: 4.0.0 - SD Association)
Security Task Manager 1.8g (HKLM\...\Security Task Manager) (Version: 1.8g - Neuber Software)
Sibelius 6 First (HKLM\...\Sibelius 6 First_is1) (Version:  - )
Sibelius Scorch (all browsers) (HKLM\...\{F533A90F-4E9E-4A17-A085-BD285B6AA57A}) (Version: 6.1.0 - Sibelius Software)
Sibelius Scorch (Firefox, Opera, Netscape only) (HKLM\...\{10ABE49D-343A-463E-9753-C4C5A05ECEF9}) (Version: 6.2.0 - Sibelius Software)
Sibelius Scorch (Firefox, Opera, Netscape, Chrome only) (HKLM\...\{41626CC0-A854-4402-AD06-D7939515C282}) (Version: 6.2.0 - Sibelius Software, a division of Avid Technology, Inc.)
SmartCutter Ps/Ts 20091004 (HKLM\...\SmartCutter Ps/Ts 20091004) (Version:  - )
Songbird 1.9.1 (Build 1920) (HKLM\...\Songbird-release-1920) (Version:  - )
Stream What You Hear (SWYH) Version 1.3 (HKLM\...\{5FBEA9D3-668E-4B88-BF6C-E1BCF441ECFD}_is1) (Version: 1.3 - Sebastien.warin.fr)
Studio 11 (HKLM\...\{110B1ADF-2EAE-4E8F-B501-D2A1E6D8ED9D}) (Version: 11.0 - Pinnacle Systems)
Studio 11 (Version: 11.0.0.0 - Pinnacle Systems) Hidden
sv.net (HKLM\...\sv.net) (Version: 15.0 - ITSG GmbH)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synchredible v3.1 (HKLM\...\Synchredible_is1) (Version:  - ASCOMP Software GmbH)
TeamViewer 7 (HKLM\...\TeamViewer 7) (Version: 7.0.13989 - TeamViewer)
T-Online 6.0 (HKLM\...\{B1275E23-717A-4D52-997A-1AD1E24BC7F3}) (Version:  - )
T-Online WLAN-Access Finder (HKLM\...\{295C31E5-3F91-498E-9623-DA24D2FA2B6A}) (Version:  - )
v2011.build.46 (HKLM\...\{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1) (Version: v2011.build.46 - eRightSoft)
vanBasco's Karaoke Player (HKLM\...\VMidi) (Version:  - )
Visual Studio C++ 10.0 Runtime (HKLM\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player 2.1.1 (HKLM\...\VLC media player) (Version: 2.1.1 - VideoLAN)
Windows 7 Codec Pack 2.7.0 (HKLM\...\Windows 7 - Codec Pack) (Version:  - Windows 7 Codec Pack)
Windows 7 USB/DVD Download Tool (HKLM\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Media Encoder 9 Series (HKLM\...\Windows Media Encoder 9) (Version:  - )
Windows Mobile Device Center Driver Update (HKLM\...\{E7044E25-3038-4A76-9064-344AC038043E}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation)
WinRAR 5.00 beta 8 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.8 - win.rar GmbH)
WireNote (remove only) (HKLM\...\WireNote_is1) (Version:  - )
Yahoo! Desktop Login (Version: 1.00.0001 - Pinnacle Systems) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Ernst\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000_Classes\CLSID\{112EA537-7AB9-4e22-8BFB-7FD5FCB19849}\localserver32 -> C:\Program Files\Globalscape\CuteFTP\ftpte.exe (Globalscape, Inc.)
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000_Classes\CLSID\{503E492B-C90C-4E23-842B-EB05CDA61DC9}\InprocServer32 -> No Filepath
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000_Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\localserver32 -> C:\Users\Ernst\AppData\Local\Temp\6AD0\temp\7410.exe No File
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1003_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\UpdatusUser\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1003_Classes\CLSID\{112EA537-7AB9-4e22-8BFB-7FD5FCB19849}\localserver32 -> C:\Program Files\Globalscape\CuteFTP\ftpte.exe (Globalscape, Inc.)
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1003_Classes\CLSID\{503E492B-C90C-4E23-842B-EB05CDA61DC9}\InprocServer32 -> No Filepath
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1003_Classes\CLSID\{7ad3508e-238c-584c-9c26-b0d3417ae12f}\InprocServer32 -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll No File
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1003_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll No File
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1003_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll No File
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1003_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll No File
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1003_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll No File
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1003_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1003_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1003_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File
CustomCLSID: HKU\S-1-5-21-3539214255-4280287789-3925056074-1003_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll No File

==================== Restore Points  =========================

24-04-2015 22:09:23 Windows Update
02-05-2015 00:00:03 Geplanter Prüfpunkt
10-05-2015 17:51:22 Geplanter Prüfpunkt
14-05-2015 03:00:42 Windows Update
14-05-2015 14:22:48 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:04 - 2015-03-16 20:19 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {163BB014-C95E-4B4B-8758-241C89892594} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {28AA8D00-4D1B-4DD0-B32D-113E8074F015} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {2B69D7B1-2E23-4695-A6BB-BBC553FC13F3} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {39144606-BA14-4EA4-8B0D-D5DE5D07F99B} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2015-04-30] (Oracle Corporation)
Task: {4CACA859-6530-4A7D-95CF-2FF34112CD7B} - System32\Tasks\{C4550220-FBAF-421B-BC1A-384FD99EA6E4} => C:\Program Files\IPE\MyVoice\MyVoice.exe [2010-03-14] (Copyright© 2002-2003 International Print Edition M.Vachal)
Task: {4DE9049B-CD3F-4278-8B5A-AF41B01A9AD4} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {50DDD3A0-ED96-4A68-ACCE-D8D73F384CB3} - System32\Tasks\{5EF930E6-E5DC-45BC-8529-00E0E2333E37} => C:\Program Files\IPE\MyVoice\MyVoice.exe [2010-03-14] (Copyright© 2002-2003 International Print Edition M.Vachal)
Task: {6E1B0DDD-FD99-46E0-8614-F2FB222CBE8B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)
Task: {7184CE8D-AC2F-4BDF-8160-21D9EBD4BEFB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)
Task: {745E2502-2BB6-4C3C-9BA1-7A149D58F2F7} - System32\Tasks\{C800BC0C-157D-4E75-83B8-C6BF1EE32352} => pcalua.exe -a C:\Users\Ernst\Downloads\paipw(3).exe -d C:\Users\Ernst\Downloads
Task: {76A4C466-5365-4F01-839E-AB25B2C603AD} - System32\Tasks\{A63B9182-3EEB-406E-A139-EE54FAD4F760} => pcalua.exe -a C:\Windows\NVUnInst\Setup.exe
Task: {7D3252B5-11CE-41D4-A311-28BDF18A86E3} - System32\Tasks\AbelssoftPreloader => C:\Program Files\WashAndGo\AbelssoftPreloader.exe [2015-03-06] (Microsoft)
Task: {8AE32741-6070-454F-AF87-B224025DC0F1} - System32\Tasks\{C0989A87-AB97-47AF-966C-9389E1B3B971} => pcalua.exe -a C:\Users\Ernst\Downloads\vkaraoke(2).exe -d C:\Users\Ernst\Downloads
Task: {925794A6-364B-4ACC-808E-2C597D4639D8} - System32\Tasks\{2C2740A6-6145-41B2-A146-2C5CE2339E51} => pcalua.exe -a D:\NeroExpress\setupx.exe -d D:\NeroExpress
Task: {A7073F9C-D60D-4219-B5E6-45C72BAB5D0F} - System32\Tasks\Synchredible-Ernst => C:\Program Files\ASCOMP Software\Synchredible\synchredible.exe [2011-02-04] (ASCOMP Software GmbH)
Task: {A944BEAA-7485-422A-9F61-1D000D78B489} - System32\Tasks\ArcSoft Connect Daemon => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-10-27] (ArcSoft Inc.)
Task: {A94D229D-4DF4-427C-9598-81AE0908AE47} - \Bidaily Synchronize Task No Task File <==== ATTENTION
Task: {AAA52C27-D57E-4669-98EF-07C13E5C181C} - System32\Tasks\{D74FDF6A-0D09-44B9-AAA7-A13DDE9F0B1A} => pcalua.exe -a "C:\Program Files\AviSynth 2.5\Uninstall.exe"
Task: {B58BD9F5-6E25-4AC7-82FA-E0C34453C6A3} - System32\Tasks\{00F428A2-13E7-4E9B-BD2E-748E56309617} => pcalua.exe -a C:\Users\Ernst\Downloads\paipw(2).exe -d C:\Users\Ernst\Downloads
Task: {BEB1B996-A9CD-4214-81FA-D0A859390347} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)
Task: {C14E3E27-7B98-4B69-B7D2-62D9EAAB7872} - System32\Tasks\Apple Diagnostics => C:\Program Files\Common Files\Apple\Internet Services\EReporter.exe [2014-12-01] (Apple Inc.)
Task: {C1FD0453-8080-40BA-BD92-AFC65A3C0FF7} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {F596A9DE-8B4E-43F9-B6E9-CBD07B550759} - System32\Tasks\{B3BFF757-8659-4205-915B-FFFD4049EC0C} => C:\Program Files\IPE\MyVoice\MyVoice.exe [2010-03-14] (Copyright© 2002-2003 International Print Edition M.Vachal)
Task: {F96B266D-170D-40A7-8E04-56239AD54517} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\AbelssoftPreloader.job =>
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job =>
Task: C:\Windows\Tasks\Bidaily Synchronize Task.job =>  <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job =>
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job =>

==================== Loaded Modules (Whitelisted) ==============

2013-08-24 23:36 - 2013-12-19 20:37 - 00107296 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
2010-09-18 10:13 - 2005-01-06 18:33 - 00116224 _____ () C:\Windows\System32\redmonnt.dll
2013-06-28 14:12 - 2013-06-28 13:12 - 00024064 _____ () C:\Windows\System32\ssj1mlm.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2012-01-12 12:23 - 2012-01-12 12:23 - 00018432 _____ () C:\Users\Ernst\AppData\LocalLow\WOT\IE\WOTUpdater.exe
2010-03-27 18:39 - 2010-12-11 20:18 - 01002224 _____ () C:\Program Files\Acronis\TrueImageHome\tishell.dll
2013-12-19 04:42 - 2013-12-19 04:42 - 00287864 ____N () C:\Program Files\Common Files\G Data\AVKProxy\PktIcpt2.dll
2015-04-28 19:53 - 2015-04-28 19:53 - 00140288 _____ () C:\Program Files\MyDrive Connect\quazip.dll
2014-09-11 17:06 - 2014-09-11 17:06 - 00878592 _____ () C:\Program Files\MyDrive Connect\Plugins\platforms\qwindows.dll
2014-09-11 17:05 - 2014-09-11 17:05 - 00036352 _____ () C:\Program Files\MyDrive Connect\Plugins\bearer\qgenericbearer.dll
2014-09-11 17:06 - 2014-09-11 17:06 - 00038912 _____ () C:\Program Files\MyDrive Connect\Plugins\bearer\qnativerwifibearer.dll
2014-09-11 17:14 - 2014-09-11 17:14 - 00032256 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qdds.dll
2014-09-11 17:05 - 2014-09-11 17:05 - 00021504 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qgif.dll
2014-09-11 17:14 - 2014-09-11 17:14 - 00027648 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qicns.dll
2014-09-11 17:05 - 2014-09-11 17:05 - 00021504 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qico.dll
2014-09-11 17:14 - 2014-09-11 17:14 - 00381952 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qjp2.dll
2014-09-11 17:05 - 2014-09-11 17:05 - 00204800 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qjpeg.dll
2014-09-11 17:14 - 2014-09-11 17:14 - 00218112 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qmng.dll
2014-09-11 17:08 - 2014-09-11 17:08 - 00015872 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qsvg.dll
2014-09-11 17:14 - 2014-09-11 17:14 - 00015360 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qtga.dll
2014-09-11 17:15 - 2014-09-11 17:15 - 00307712 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qtiff.dll
2014-09-11 17:15 - 2014-09-11 17:15 - 00014848 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qwbmp.dll
2014-09-11 17:15 - 2014-09-11 17:15 - 00252928 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qwebp.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7775 more restricted sites.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Ernst\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.33.2

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^Ernst^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: ApplePhotoStreams => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
MSCONFIG\startupreg: AppleSyncNotifier => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: ArcSoft Connection Service => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
MSCONFIG\startupreg: BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} => "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
MSCONFIG\startupreg: DVAPTray => C:\Windows\System32\DVAPTray.exe
MSCONFIG\startupreg: EaseUS EPM tray => C:\Program Files\EaseUS\EaseUS Partition Master 9.2.2\bin\EpmNews.exe
MSCONFIG\startupreg: eTMonitor => "C:\Program Files\Aladdin\eToken\PKIClient\x32\PKIMonitor.exe"
MSCONFIG\startupreg: FreePDF Assistant => C:\Program Files\FreePDF_XP\fpassist.exe
MSCONFIG\startupreg: iCloudServices => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: NBKeyScan => "C:\Program Files\Nero\Nero 7\Nero BackItUp\NBKeyScan.exe"
MSCONFIG\startupreg: NeroFilterCheck => C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
MSCONFIG\startupreg: PDFPrint => C:\Program Files\PDF24\pdf24.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RTHDVCPL => "C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe" -s
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: TrueImageMonitor.exe => C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
MSCONFIG\startupreg: Windows Mobile Device Center => %windir%\WindowsMobile\wmdc.exe
MSCONFIG\startupreg: Wondershare Helper Compact.exe => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [{8B827819-153B-4CBA-967C-FE6BD54C3565}] => (Allow) C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{2A7E9954-701E-48E4-B0C6-BA4C424FA9C1}] => (Allow) E:\Program Files\Pinnacle\Studio 11\programs\RM.exe
FirewallRules: [{BC60A0D5-B6A9-4A76-B728-1299EA3BE491}] => (Allow) E:\Program Files\Pinnacle\Studio 11\programs\RM.exe
FirewallRules: [{E4611160-CD3E-4B61-BDA5-5F9071CE8551}] => (Allow) E:\Program Files\Pinnacle\Studio 11\programs\Studio.exe
FirewallRules: [{A35C937C-C653-407E-A154-B001FE6ECD65}] => (Allow) E:\Program Files\Pinnacle\Studio 11\programs\Studio.exe
FirewallRules: [{27E09C16-924D-4370-8A6D-EFAC87B56C45}] => (Allow) E:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe
FirewallRules: [{6E822718-0DF3-4F1E-B617-712747A436F8}] => (Allow) E:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe
FirewallRules: [{7FCB8A21-A319-4E41-8A24-4DBC8CC1C6B6}] => (Allow) E:\Program Files\Pinnacle\Studio 11\programs\umi.exe
FirewallRules: [{60C8D496-7AAF-4BCA-B415-5EEBC71F9A5A}] => (Allow) E:\Program Files\Pinnacle\Studio 11\programs\umi.exe
FirewallRules: [TCP Query User{FE8BE8F1-0C3E-4047-93BF-6F8379540BA1}C:\program files\wiredplane\wirenote\wirenote.exe] => (Allow) C:\program files\wiredplane\wirenote\wirenote.exe
FirewallRules: [UDP Query User{C62C6DC2-357A-44CB-80B5-59544034B814}C:\program files\wiredplane\wirenote\wirenote.exe] => (Allow) C:\program files\wiredplane\wirenote\wirenote.exe
FirewallRules: [TCP Query User{D2432D45-9203-40CD-8605-1C2D1B7293BD}C:\program files\wiredplane\wirenote\wirenote.exe] => (Block) C:\program files\wiredplane\wirenote\wirenote.exe
FirewallRules: [UDP Query User{4A3D1466-225A-4590-AD7C-05A559ADB213}C:\program files\wiredplane\wirenote\wirenote.exe] => (Block) C:\program files\wiredplane\wirenote\wirenote.exe
FirewallRules: [TCP Query User{080F6A03-99D3-4663-B963-880584C950DD}C:\program files\ws_ftp\ws_ftp95.exe] => (Block) C:\program files\ws_ftp\ws_ftp95.exe
FirewallRules: [UDP Query User{B86DF262-35FB-4223-8479-F27B66C54127}C:\program files\ws_ftp\ws_ftp95.exe] => (Block) C:\program files\ws_ftp\ws_ftp95.exe
FirewallRules: [{FBE64AD7-26C2-42E4-9C3C-971BBFF9786C}] => (Allow) D:\NeroExpress\Installation\SetupX.exe
FirewallRules: [{36C3DB1E-79FD-4DA6-B123-FB6616BFE3C6}] => (Allow) D:\NeroExpress\Installation\SetupX.exe
FirewallRules: [TCP Query User{C0BE8010-5EB3-424D-95AD-8ACC77393CA4}C:\program files\nero\nero 7\nero home\nerohome.exe] => (Block) C:\program files\nero\nero 7\nero home\nerohome.exe
FirewallRules: [UDP Query User{DD5126E1-B430-48F2-96AB-D114037F8B3E}C:\program files\nero\nero 7\nero home\nerohome.exe] => (Block) C:\program files\nero\nero 7\nero home\nerohome.exe
FirewallRules: [TCP Query User{15975A09-6F7A-4A0A-B89C-4AAD45C384A3}C:\windows\system32\wfs.exe] => (Allow) C:\windows\system32\wfs.exe
FirewallRules: [UDP Query User{A56C8C6A-6308-4C6E-8D5C-8B52EE124DF7}C:\windows\system32\wfs.exe] => (Allow) C:\windows\system32\wfs.exe
FirewallRules: [TCP Query User{D2318EC5-6B3B-44DA-BB1D-28C4849691B0}C:\program files\google\google earth\client\googleearth.exe] => (Allow) C:\program files\google\google earth\client\googleearth.exe
FirewallRules: [UDP Query User{849D6DB9-29DD-4457-B37F-BF026A417E86}C:\program files\google\google earth\client\googleearth.exe] => (Allow) C:\program files\google\google earth\client\googleearth.exe
FirewallRules: [TCP Query User{A2F1005A-C687-4B70-B0EF-2291A68D48B5}C:\windows\system32\wfs.exe] => (Block) C:\windows\system32\wfs.exe
FirewallRules: [UDP Query User{2C61D6CB-4099-4478-AA11-9168ABFC37EB}C:\windows\system32\wfs.exe] => (Block) C:\windows\system32\wfs.exe
FirewallRules: [{A645B862-99F9-4C83-B905-5CF25A527765}] => (Allow) C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe
FirewallRules: [{E89BB41A-91F1-4DC1-99C6-FC45700A2354}] => (Allow) C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe
FirewallRules: [{31D71CF0-E360-4ABB-991E-E4476581AA56}] => (Allow) C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe
FirewallRules: [{BE8ECD78-D56C-43E4-880C-0FC07E4A9550}] => (Allow) C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe
FirewallRules: [{76C651F8-7BF6-41F5-9560-B6203638682A}] => (Allow) C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe
FirewallRules: [{F9615484-6C67-4118-85B8-4822CA68188F}] => (Allow) C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe
FirewallRules: [TCP Query User{A739ABBB-6D20-4826-B9D9-71852D4D700F}C:\program files\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files\google\google earth\plugin\geplugin.exe
FirewallRules: [UDP Query User{050AD8A8-AA77-4854-B6A9-59CA0D3CDF80}C:\program files\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files\google\google earth\plugin\geplugin.exe
FirewallRules: [{0B6906FE-5419-49B8-B9A3-A1C7AC63D029}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{FEE88298-8934-4F6F-9371-4F9E041E7E6F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{8C185BF2-98B0-4096-828E-702CE44B16DA}] => (Allow) C:\Program Files\TeamViewer\Version7\TeamViewer.exe
FirewallRules: [{0C8E2415-AF0E-4FBD-AA2A-329C63F88CF0}] => (Allow) C:\Program Files\TeamViewer\Version7\TeamViewer.exe
FirewallRules: [{DAF90C96-86B3-47E7-A303-51C8C937CE56}] => (Allow) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
FirewallRules: [{5511D929-76AD-48BC-8ACF-6AD2AA1E03C0}] => (Allow) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
FirewallRules: [{4CDBA1E0-26CD-4057-B737-4878AC19CFBD}] => (Allow) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{32CC6B4C-7888-45E9-A74F-16B07CA77AC3}] => (Allow) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{629D9513-6A11-4DF3-94CA-433646DD7BBD}] => (Allow) C:\Users\Ernst\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{1546608D-C02D-40DF-BE58-93992E1A9FD1}] => (Allow) C:\Users\Ernst\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{4BDE8623-0300-40FA-B3AA-413AC168E6A8}C:\users\ernst\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\ernst\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{90A3A3E7-C2AB-4C82-9618-65004CEBDD67}C:\users\ernst\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\ernst\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{D4596064-8C94-417C-B780-602DE01C1950}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [TCP Query User{999AA3E9-4650-4048-B834-BA3D6BA2026B}C:\program files\fritz!\frifax32.exe] => (Allow) C:\program files\fritz!\frifax32.exe
FirewallRules: [UDP Query User{9D00BBFB-06CB-43E6-8A68-1878BE8F65D4}C:\program files\fritz!\frifax32.exe] => (Allow) C:\program files\fritz!\frifax32.exe
FirewallRules: [{38524A6E-CB30-4E3F-97A5-97EC38210625}] => (Allow) C:\Program Files\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{75020967-E3C2-400D-B55C-A979DEB023DA}] => (Allow) LPort=2869
FirewallRules: [{910A795A-66A4-4936-ABB4-BABB5F39CFF4}] => (Allow) LPort=1900
FirewallRules: [{1707B53F-8F99-47FD-8B34-F0CB1BDFACC4}] => (Allow) C:\Program Files\Audials\Audials 11\Audials.exe
FirewallRules: [{41F1E003-9E44-4C4A-B7A3-E19923E0C2BF}] => (Allow) LPort=12972
FirewallRules: [{4889EE94-DC1C-4CB7-BA86-9CCCA305620A}] => (Allow) LPort=14714
FirewallRules: [{19BF172D-96E2-47BE-857A-CBE20DA7C973}] => (Allow) LPort=31931
FirewallRules: [{549278F8-520B-44BA-AE7D-A075BBDE3124}] => (Allow) E:\Program Files\Audials\Audials 12\Audials.exe
FirewallRules: [{71E96D00-086F-4108-B9C1-AEC32937B768}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{C369B193-7561-4E3D-A91A-A102A443E3F3}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{4A88FF4C-E4E3-43AB-A653-AAA9F3ABA34E}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{E87C7856-D225-47E8-8362-910F26D84C34}] => (Allow) C:\Program Files\Sony\PlayMemories Home\PMBBrowser.exe
FirewallRules: [{DBBEB1E0-3DB1-4D78-9362-3B6DEF7176FB}] => (Allow) C:\Program Files\Sony\PlayMemories Home\PMBBrowser.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/15/2015 00:12:20 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "PDR.X,type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "PDR.X,type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/15/2015 00:12:20 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "PDR.X,type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "PDR.X,type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/15/2015 00:11:46 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "PCLE.DiscAPI,processorArchitecture="x86",type="win32",version="3.0.0.0"1".
Die abhängige Assemblierung "PCLE.DiscAPI,processorArchitecture="x86",type="win32",version="3.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/15/2015 00:08:24 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/15/2015 00:08:22 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/15/2015 00:08:22 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/15/2015 00:08:21 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/15/2015 00:07:48 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/15/2015 00:07:45 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/15/2015 00:07:44 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (05/14/2015 07:29:27 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80070422

Error: (05/14/2015 07:28:23 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Windows-Bilderfassung (WIA)" ist vom Dienst "Shellhardwareerkennung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058

Error: (05/14/2015 02:44:51 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80070422

Error: (05/14/2015 02:43:26 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Windows-Bilderfassung (WIA)" ist vom Dienst "Shellhardwareerkennung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058

Error: (05/14/2015 02:41:35 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Diagnostics Tracking Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================
Error: (05/15/2015 00:12:20 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: PDR.X,type="win32",version="1.0.0.0"E:\Program Files\CyberLink\PhotoDirector5\Kernel\CES\CES_CacheAgent.exe.Manifest

Error: (05/15/2015 00:12:20 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: PDR.X,type="win32",version="1.0.0.0"E:\Program Files\CyberLink\PhotoDirector5\Kernel\CES\CES_AudioCacheAgent.exe.Manifest

Error: (05/15/2015 00:11:46 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: PCLE.DiscAPI,processorArchitecture="x86",type="win32",version="3.0.0.0"e:\program files\Pinnacle\studio 11\patch_backup\studio.exe

Error: (05/15/2015 00:08:24 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"E:\Program Files\Audials\Audials 12\tbhsd\tools64\uninstall.exe

Error: (05/15/2015 00:08:22 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"E:\Program Files\Audials\Audials 12\tbhsd\tools64\install.exe

Error: (05/15/2015 00:08:22 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"E:\Program Files\Audials\Audials 12\HookHelper64.exe

Error: (05/15/2015 00:08:21 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"E:\Program Files\Audials\Audials 12\tbhsd\tools64\cleanup.exe

Error: (05/15/2015 00:07:48 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Audials\Audials 11\tbhsd\tools64\uninstall.exe

Error: (05/15/2015 00:07:45 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Audials\Audials 11\tbhsd\tools64\cleanup.exe

Error: (05/15/2015 00:07:44 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Audials\Audials 11\tbhsd\tools64\install.exe


==================== Memory info ===========================

Processor: AMD Phenom(tm) 8650 Triple-Core Processor
Percentage of memory in use: 44%
Total physical RAM: 3583.55 MB
Available physical RAM: 1976.09 MB
Total Pagefile: 11258.36 MB
Available Pagefile: 9286.36 MB
Total Virtual: 2047.88 MB
Available Virtual: 1873 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:196.12 GB) (Free:23.47 GB) NTFS
Drive e: (Platte E) (Fixed) (Total:269.54 GB) (Free:138.29 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: C4BE7463)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=196.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=269.5 GB) - (Type=OF Extended)

==================== End Of Log ============================
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-15 12:10:09
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\00000068 TOSHIBA_ rev.MS1O 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Ernst\AppData\Local\Temp\ufldapog.sys


---- Kernel code sections - GMER 2.1 ----

.text          ntoskrnl.exe!ZwRequestPort + 14CD                                                                                      83445B55 1 Byte  [06]
.text          ntoskrnl.exe!KiDispatchInterrupt + 5A2                                                                                  83465E62 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
init            C:\Windows\system32\DRIVERS\aksifdh.sys                                                                                entry point in "init" section [0x953B2090]

---- Devices - GMER 2.1 ----

Device                                                                                                                                  Ntfs.sys

AttachedDevice                                                                                                                          tdrpm273.sys

Device                                                                                                                                  volmgr.sys

AttachedDevice                                                                                                                          fltmgr.sys

---- Registry - GMER 2.1 ----

Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active                                     
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@0340DA30                            2238
Reg            HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{CC04A9CA-0F0D-11E3-9CC6-806E6F6E6963}  13443299480
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32                                     
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel                        Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@                                      C:\Windows\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b      0xC8 0x28 0x51 0xAF ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32                                     
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel                        Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@                                      C:\Windows\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b      0x71 0x3B 0x04 0x66 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32                                     
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel                        Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@                                      C:\Windows\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016      0xFF 0x7C 0x85 0xE0 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32                                     
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel                        Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@                                      C:\Windows\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48      0x86 0x8C 0x21 0x01 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32                                     
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel                        Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@                                      C:\Windows\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472      0xCD 0x44 0xCD 0xB9 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32                                     
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel                        Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@                                      C:\Windows\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d      0xB0 0x18 0xED 0xA7 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32                                     
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel                        Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@                                      C:\Windows\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b      0x31 0x77 0xE1 0xBA ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32                                     
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel                        Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@                                      C:\Windows\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d      0x01 0x3A 0x48 0xFC ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32                                     
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel                        Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@                                      C:\Windows\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3      0xF6 0x0F 0x4E 0x58 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32                                     
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel                        Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@                                      C:\Windows\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b      0x3D 0xCE 0xEA 0x26 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32                                     
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel                        Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@                                      C:\Windows\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6      0xE3 0x0E 0x66 0xD5 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32                                     
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel                        Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@                                      C:\Windows\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2      0x6C 0x43 0x2D 0x1E ...

---- EOF - GMER 2.1 ----
GData hat nichts gefunden: kann sich trotzdem etwas eingeschlichen haben?

schrauber 15.05.2015 11:48
Hi,

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Erlu 15.05.2015 13:43
Hier der mbar log file:
Code:
Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.05.15.02
  rootkit: v2015.05.14.01

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.17801
Ernst :: ELINEU [administrator]

15.05.2015 13:15:01
mbar-log-2015-05-15 (13-15-01).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 534141
Time elapsed: 1 hour(s), 10 minute(s), 46 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
Hier TDSSkiller.log
Code:
14:31:03.0030 0x110c  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
14:31:12.0404 0x110c  ============================================================
14:31:12.0405 0x110c  Current date / time: 2015/05/15 14:31:12.0404
14:31:12.0405 0x110c  SystemInfo:
14:31:12.0405 0x110c 
14:31:12.0405 0x110c  OS Version: 6.1.7601 ServicePack: 1.0
14:31:12.0405 0x110c  Product type: Workstation
14:31:12.0405 0x110c  ComputerName: ELINEU
14:31:12.0405 0x110c  UserName: Ernst
14:31:12.0405 0x110c  Windows directory: C:\Windows
14:31:12.0406 0x110c  System windows directory: C:\Windows
14:31:12.0406 0x110c  Processor architecture: Intel x86
14:31:12.0406 0x110c  Number of processors: 3
14:31:12.0406 0x110c  Page size: 0x1000
14:31:12.0406 0x110c  Boot type: Normal boot
14:31:12.0406 0x110c  ============================================================
14:31:14.0849 0x110c  KLMD registered as C:\Windows\system32\drivers\28944821.sys
14:31:15.0507 0x110c  System UUID: {EBABDB1D-03A4-543C-2D83-5929EA490859}
14:31:17.0068 0x110c  Drive \Device\Harddisk0\DR0 - Size: 0x7470AFDE00 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xFC59, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000050
14:31:17.0122 0x110c  ============================================================
14:31:17.0122 0x110c  \Device\Harddisk0\DR0:
14:31:17.0183 0x110c  MBR partitions:
14:31:17.0183 0x110c  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
14:31:17.0183 0x110c  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1883B1F0
14:31:17.0196 0x110c  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x1886DA2F, BlocksNum 0x21B16E61
14:31:17.0196 0x110c  ============================================================
14:31:17.0481 0x110c  E: <-> \Device\Harddisk0\DR0\Partition3
14:31:17.0510 0x110c  C: <-> \Device\Harddisk0\DR0\Partition2
14:31:17.0510 0x110c  ============================================================
14:31:17.0510 0x110c  Initialize success
14:31:17.0510 0x110c  ============================================================
14:33:50.0716 0x0b30  ============================================================
14:33:50.0716 0x0b30  Scan started
14:33:50.0716 0x0b30  Mode: Manual; SigCheck; TDLFS;
14:33:50.0716 0x0b30  ============================================================
14:33:50.0716 0x0b30  KSN ping started
14:34:05.0537 0x0b30  KSN ping finished: true
14:34:07.0955 0x0b30  ================ Scan system memory ========================
14:34:07.0955 0x0b30  System memory - ok
14:34:07.0955 0x0b30  ================ Scan services =============================
14:34:08.0111 0x0b30  [ 1B133875B8AA8AC48969BD3458AFE9F5, 01753BDD47F3F9BC0E0D23A069B9C56D4AE6A6B6295BC19B95AE245D25B12744 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
14:34:08.0361 0x0b30  1394ohci - ok
14:34:08.0439 0x0b30  [ BEB5E6A8C17C3C7485563281E0F9E77E, D04ACF4833370AC1BFA5365B7D23DB0F6BD5067102B4AD523D74DBE89EDDABBA ] 61883          C:\Windows\system32\DRIVERS\61883.sys
14:34:08.0501 0x0b30  61883 - ok
14:34:08.0611 0x0b30  [ ADC420616C501B45D26C0FD3EF1E54E4, 29FC41D40A35AC5476E2A673CE5B12684E0CFA12A1AEBEEBE5883FBA5CA68B67 ] ACDaemon        C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
14:34:08.0657 0x0b30  ACDaemon - ok
14:34:08.0735 0x0b30  [ CEA80C80BED809AA0DA6FEBC04733349, AE69C142DC2210A4AE657C23CEA4A6E7CB32C4F4EBA039414123CAC52157509B ] ACPI            C:\Windows\system32\drivers\ACPI.sys
14:34:08.0767 0x0b30  ACPI - ok
14:34:08.0798 0x0b30  [ 1EFBC664ABFF416D1D07DB115DCB264F, BF94D069D692140B792DBF4FD3CB0127D27C26CC5BFB6B0C28A8B6346767EE58 ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
14:34:08.0845 0x0b30  AcpiPmi - ok
14:34:08.0954 0x0b30  [ A5FF55A28E59E7B8EB6B7A4D9ABB0B86, A6029F11901E10F01B2DBA8A3A794A6777B5BA5120824AFBB5DEEBD0DAC8AFEE ] AcrSch2Svc      C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
14:34:09.0032 0x0b30  AcrSch2Svc - ok
14:34:09.0110 0x0b30  [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
14:34:09.0141 0x0b30  AdobeARMservice - ok
14:34:09.0219 0x0b30  [ B04A4810C6CC205F9DC72DC22E4AB236, 547321F5C28C80D4818372D65E2A33D4BAC593015DD6613B24586FE4B4A95D5D ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
14:34:09.0266 0x0b30  AdobeFlashPlayerUpdateSvc - ok
14:34:09.0313 0x0b30  [ 21E785EBD7DC90A06391141AAC7892FB, A2D3D764C5E6DC0AD5AAF48485FFB8B121D2A40DC08ECF2D2CB92278A1002B25 ] adp94xx        C:\Windows\system32\DRIVERS\adp94xx.sys
14:34:09.0375 0x0b30  adp94xx - ok
14:34:09.0406 0x0b30  [ 0C676BC278D5B59FF5ABD57BBE9123F2, 339E8A433D186BAAB6FCB44C82CC9FB6FCD63C87981449494CBEB2072CB6B7BB ] adpahci        C:\Windows\system32\DRIVERS\adpahci.sys
14:34:09.0453 0x0b30  adpahci - ok
14:34:09.0469 0x0b30  [ 7C7B5EE4B7B822EC85321FE23A27DB33, A934AFB71D439555E6376DA9B34F82E8D39A300A4547BE9AC9311F6A3C36270C ] adpu320        C:\Windows\system32\DRIVERS\adpu320.sys
14:34:09.0515 0x0b30  adpu320 - ok
14:34:09.0562 0x0b30  [ 12E6A172D72AFC626727B8635DD17E39, 33B3D109C39DF6EA86AFC3C89A93657906E981D3D22FF854401BC7326990CC08 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
14:34:09.0640 0x0b30  AeLookupSvc - ok
14:34:09.0687 0x0b30  [ FE3EA6E9AFC1A78E6EDCA121E006AFB7, B596ABBAC058D93C505C9DBF8685049C88E4364195A4092DB580D2D44FA8C23C ] Afc            C:\Windows\system32\drivers\Afc.sys
14:34:09.0718 0x0b30  Afc - ok
14:34:09.0781 0x0b30  [ 53696AD8FFC5FAC51949A525FF65A689, 6233D5407670052A922897B7845DDEE285794613C9F58183D38726FB15B27944 ] afcdp          C:\Windows\system32\DRIVERS\afcdp.sys
14:34:09.0812 0x0b30  afcdp - ok
14:34:10.0015 0x0b30  [ AF44F7E027037628F1FAC3C13CDE73E6, 56A95EBF2241C275FD401487C5F0E86859F8637D8B1BD01B7157EE9BC22B1907 ] afcdpsrv        C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
14:34:10.0233 0x0b30  afcdpsrv - ok
14:34:10.0311 0x0b30  [ D0B388DA1D111A34366E04EB4A5DD156, 60D226F027F4025CC032CAFF73A80FAFB5FA75445654FDCF80CA8C0419C6E938 ] AFD            C:\Windows\system32\drivers\afd.sys
14:34:10.0405 0x0b30  AFD - ok
14:34:10.0436 0x0b30  [ 507812C3054C21CEF746B6EE3D04DD6E, D7E59350AC338AD229E3D10C76E32AE16D120311B263714A9CD94AB538633B0E ] agp440          C:\Windows\system32\drivers\agp440.sys
14:34:10.0467 0x0b30  agp440 - ok
14:34:10.0498 0x0b30  [ 8B30250D573A8F6B4BD23195160D8707, 64EC289AFCD63D84EAFD9D81C50D0A77BCC79A1EFF32C50B2776BB0C0151757D ] aic78xx        C:\Windows\system32\DRIVERS\djsvs.sys
14:34:10.0545 0x0b30  aic78xx - ok
14:34:10.0576 0x0b30  [ CABBAE3643304B22269B200248BDBE77, E55530783346A1A3AB59348451F9F302BB5D7FFFF3F3BD8490D6550B7BC90361 ] AKSIFDH        C:\Windows\system32\DRIVERS\aksifdh.sys
14:34:10.0623 0x0b30  AKSIFDH - ok
14:34:10.0654 0x0b30  [ 6D657B9517F8C8EA55BD306E3C1BCFBC, 0A362A15C5A37A8A5477ABCF9716C97B67A6D13935F6FB04AE5303A4D18C9917 ] AKSUP          C:\Windows\system32\drivers\aksup.sys
14:34:10.0685 0x0b30  AKSUP - ok
14:34:10.0717 0x0b30  [ 18A54E132947CD98FEA9ACCC57F98F13, 9D39AF972785E49F0DD12C4BAEF39A79CD69F098886BF152AF1B7CCE2E902115 ] ALG            C:\Windows\System32\alg.exe
14:34:10.0779 0x0b30  ALG - ok
14:34:10.0826 0x0b30  [ 0D40BCF52EA90FC7DF2AEAB6503DEA44, 1D1AA8F50935D976C29DE7A84708CADBBBDD936F0DD2C059E820F0D21367B3B6 ] aliide          C:\Windows\system32\drivers\aliide.sys
14:34:10.0857 0x0b30  aliide - ok
14:34:10.0857 0x0b30  [ 3C6600A0696E90A463771C7422E23AB5, 370B33DC1C25B981628A318BAE434A78A5F0A0DA93C2896DC7A3D7B87AE1A5E7 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
14:34:10.0904 0x0b30  amdagp - ok
14:34:10.0935 0x0b30  [ CD5914170297126B6266860198D1D4F0, 2239FCBD1A7EC27CE4F10DA36AE6BD6CCB87E5128C82CA71B84BFE5AF5602A60 ] amdide          C:\Windows\system32\drivers\amdide.sys
14:34:10.0951 0x0b30  amdide - ok
14:34:10.0982 0x0b30  [ 00DDA200D71BAC534BF56A9DB5DFD666, CA316B1FFD85BA1CF8664B3229DA1F238A5341E016059F7ED89702324CFD124B ] AmdK8          C:\Windows\system32\DRIVERS\amdk8.sys
14:34:11.0029 0x0b30  AmdK8 - ok
14:34:11.0060 0x0b30  [ 3CBF30F5370FDA40DD3E87DF38EA53B6, 7EACF1743367BE805357B6FD10F8F99E9B1C301FE3782D77719347B13DFA65EC ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
14:34:11.0107 0x0b30  AmdPPM - ok
14:34:11.0138 0x0b30  [ D320BF87125326F996D4904FE24300FC, F767D8C5C58D57202905D829F7AE1B1FF33937F407FDCE4C90E32A6638F27416 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
14:34:11.0185 0x0b30  amdsata - ok
14:34:11.0200 0x0b30  [ EA43AF0C423FF267355F74E7A53BDABA, 3F1335909AB0281A2FBDD7AD90E18309E091656CD32B48894B992789D8C61DB4 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
14:34:11.0247 0x0b30  amdsbs - ok
14:34:11.0263 0x0b30  [ 46387FB17B086D16DEA267D5BE23A2F2, 8B8AC61B91F154B4EB5CC6DECB5FCCEBA8B42EFE94859947136AD06681EA8ED0 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
14:34:11.0294 0x0b30  amdxata - ok
14:34:11.0356 0x0b30  [ C1C6EA3F8ACD2A9818C0A73A5F63B9B6, 739FFF33CBBC4F8E8613906760D36286AB249A5C4004BF000D76CABB48D35433 ] Apowersoft_AudioDevice C:\Windows\system32\drivers\Apowersoft_AudioDevice.sys
14:34:11.0387 0x0b30  Apowersoft_AudioDevice - ok
14:34:11.0434 0x0b30  [ 81F97D8F8B3FB94A451CC6F7CF8B2965, 8DEBA4E47E1016D69740C0BB7CDD23852D86E0D42C1C1EA5A847ECB115C38CB1 ] AppID          C:\Windows\system32\drivers\appid.sys
14:34:11.0465 0x0b30  AppID - ok
14:34:11.0497 0x0b30  [ F5090F8FA6757C58E17BAEAA86093636, 5E14CF3032DF5801240F45C59AA93962EA41AA5648A0C6458D16D9B9D95A131F ] AppIDSvc        C:\Windows\System32\appidsvc.dll
14:34:11.0528 0x0b30  AppIDSvc - ok
14:34:11.0559 0x0b30  [ EACFDF31921F51C097629F1F3C9129B4, 24138755D823E69760579ECBD672421192457CDC9941B2BC499C2D34D83E86C3 ] Appinfo        C:\Windows\System32\appinfo.dll
14:34:11.0606 0x0b30  Appinfo - ok
14:34:11.0746 0x0b30  [ D2B87FC03BE28CD0B33C2B5C1119FD8E, 97EB74CB7F62C0D06D45CB250E3A90657A0F107C2FC20738FF6B2C87B0240080 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
14:34:11.0777 0x0b30  Apple Mobile Device - ok
14:34:11.0855 0x0b30  [ 2932004F49677BD84DBC72EDB754FFB3, 73F84582244AC53994A2F4499A119B4A84A6BF7FD3046C29A8080C763DE540B8 ] arc            C:\Windows\system32\DRIVERS\arc.sys
14:34:11.0887 0x0b30  arc - ok
14:34:11.0918 0x0b30  [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7, F7C9C3B4F2C816F57A43B2921672858C291054220BADE291044343778216F6BA ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
14:34:11.0965 0x0b30  arcsas - ok
14:34:12.0074 0x0b30  [ 9D768C43FEF254DD50B1DBF8AD5C4C0B, A50854EA5C08605133B8BB4DFDC6090357C5665314AA72E0BFA1E07D4E451F09 ] aspnet_state    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
14:34:12.0105 0x0b30  aspnet_state - ok
14:34:12.0152 0x0b30  [ ADD2ADE1C2B285AB8378D2DAAF991481, 7965A705F37924C0EC7A934E64E89C5DF4069816E2EEA3509E0AC90F78910519 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
14:34:12.0277 0x0b30  AsyncMac - ok
14:34:12.0308 0x0b30  [ 338C86357871C167A96AB976519BF59E, F28CC534523D1701B0552F5D7E18E88369C4218BDB1F69110C3E31D395884AD6 ] atapi          C:\Windows\system32\drivers\atapi.sys
14:34:12.0339 0x0b30  atapi - ok
14:34:12.0401 0x0b30  [ C1619A13B10CAC5038BF7129F57D8DE3, 9F71EA6C844650658938E68CCC1383F92D37C68E46E08461A8351491185BA791 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
14:34:12.0464 0x0b30  AudioEndpointBuilder - ok
14:34:12.0479 0x0b30  [ C1619A13B10CAC5038BF7129F57D8DE3, 9F71EA6C844650658938E68CCC1383F92D37C68E46E08461A8351491185BA791 ] Audiosrv        C:\Windows\System32\Audiosrv.dll
14:34:12.0573 0x0b30  Audiosrv - ok
14:34:12.0635 0x0b30  [ C44BDD77E06053CF5AFE046F3A47C16B, FB0EF5AEDD5F8760765A3AB890B32867C0A38397B6423D5291BCFF6FC38346D9 ] Avc            C:\Windows\system32\DRIVERS\avc.sys
14:34:12.0682 0x0b30  Avc - ok
14:34:12.0729 0x0b30  [ 6F76908F065C3C151C4BFCA7DFD86979, 437622BF84AC996E8E1103055444335B12D12C1885A123086EBDA081195FA320 ] avgtp          C:\Windows\system32\drivers\avgtpx86.sys
14:34:12.0760 0x0b30  avgtp - ok
14:34:13.0088 0x0b30  [ B90962C56D37665500E3B2510844F57E, D3A97436CACA7FD2E6EF6B07536F26665C06F6251472FAB96E923039412E6E85 ] AVKProxy        C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe
14:34:13.0244 0x0b30  AVKProxy - ok
14:34:13.0384 0x0b30  [ 56C6F2D7F1D515B4B534217443D3B67F, CB9E94EE515EE7C426B34EC40DFDEF27893C3379C011B2FF6EEF318A34BCF482 ] AVKService      C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe
14:34:13.0447 0x0b30  AVKService - ok
14:34:13.0603 0x0b30  [ 460DF58F2B393689EA6B87288BA7DFC5, D0330FC768B98DB4E76132CB40044E600AFE83964E63845C2534254EA5B15DA2 ] AVKWCtl        C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe
14:34:13.0774 0x0b30  AVKWCtl - ok
14:34:13.0821 0x0b30  [ 6E30D02AAC9CAC84F421622E3A2F6178, 229DC527C1D6C778BCA2C855A2A6F6D2C4B0F4F6DE56C886B3AAD26E3347952C ] AxInstSV        C:\Windows\System32\AxInstSV.dll
14:34:13.0899 0x0b30  AxInstSV - ok
14:34:13.0946 0x0b30  [ 1A231ABEC60FD316EC54C66715543CEC, 09E2897BA80737997A286EA5408C03DD3CC0EBACD24CB391C2455B6D4BE7D67E ] b06bdrv        C:\Windows\system32\DRIVERS\bxvbdx.sys
14:34:14.0086 0x0b30  b06bdrv - ok
14:34:14.0117 0x0b30  [ BD8869EB9CDE6BBE4508D869929869EE, F4363A12EBFDBB89C69FD59B22F9EE05BADA07D477A1DF2DE01F59D6EE496543 ] b57nd60x        C:\Windows\system32\DRIVERS\b57nd60x.sys
14:34:14.0180 0x0b30  b57nd60x - ok
14:34:14.0227 0x0b30  [ EE1E9C3BB8228AE423DD38DB69128E71, ED54FD9795F3A4D32F02BED6052AD9404409A05644CDBEBFF19C662D104DA95A ] BDESVC          C:\Windows\System32\bdesvc.dll
14:34:14.0273 0x0b30  BDESVC - ok
14:34:14.0320 0x0b30  [ CB7CE2E47139B620D2B87078165F1AD0, 2859F85C463FD34D659EAFDDFE4DE472D04D3D2D639BE4876E19F5DC775D0BA1 ] becldr3Service  C:\Program Files\BCL Technologies\easyConverter SDK 3\Common\becldr.exe
14:34:14.0367 0x0b30  becldr3Service - detected UnsignedFile.Multi.Generic ( 1 )
14:34:17.0019 0x0b30  Detect skipped due to KSN trusted
14:34:17.0019 0x0b30  becldr3Service - ok
14:34:17.0035 0x0b30  [ 505506526A9D467307B3C393DEDAF858, 8AD6F1492E357F57CF42261497BA29122045D4FC0DCC9669AA5AC9B2A4BABFA4 ] Beep            C:\Windows\system32\drivers\Beep.sys
14:34:17.0144 0x0b30  Beep - ok
14:34:17.0191 0x0b30  [ 1E2BAC209D184BB851E1A187D8A29136, 53933C938DA5126986FFF2918C1F522ABE93ABAB460AE32E4453161C2F7B68DF ] BFE            C:\Windows\System32\bfe.dll
14:34:17.0284 0x0b30  BFE - ok
14:34:17.0347 0x0b30  [ E585445D5021971FAE10393F0F1C3961, 178C008A9A0A6BFDA65EB0B98C510271360AD4474F22F13594F5EB60AA4E1CF5 ] BITS            C:\Windows\System32\qmgr.dll
14:34:17.0456 0x0b30  BITS - ok
14:34:17.0487 0x0b30  [ 2287078ED48FCFC477B05B20CF38F36F, 55BCA6174E6034A8D61CBE4126B2F1989F6052BFA624BEA9C0A0A664AEC74521 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
14:34:17.0534 0x0b30  blbdrive - ok
14:34:17.0643 0x0b30  [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A, 10F21999FF6B1D410EBF280F7F27DEACA5289739CF12F4293B614B8FC6C88DCC ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
14:34:17.0690 0x0b30  Bonjour Service - ok
14:34:17.0721 0x0b30  [ 8F2DA3028D5FCBD1A060A3DE64CD6506, E234672E9CFE1A95AD2E78E306E41E010B870221E6EBBC0E2B0BE2FA5CE0CD76 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
14:34:17.0799 0x0b30  bowser - ok
14:34:17.0815 0x0b30  [ 9F9ACC7F7CCDE8A15C282D3F88B43309, A9131334BD9CF8FD60BA9D54AA054E2DF2BE1219FB650DF1464F2787BDEAE98F ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
14:34:17.0861 0x0b30  BrFiltLo - ok
14:34:17.0893 0x0b30  [ 56801AD62213A41F6497F96DEE83755A, 0DEB8318FB47DF6473C171C795C735E26A73FA12232876C6856549EA16F33361 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
14:34:17.0924 0x0b30  BrFiltUp - ok
14:34:17.0986 0x0b30  [ 77361D72A04F18809D0EFB6CCEB74D4B, 55E7DB65BB29FF421F138CDFF05E5ECFFC7C8862FAA68F6179A3BA9D6B69AE64 ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys
14:34:18.0049 0x0b30  BridgeMP - ok
14:34:18.0095 0x0b30  [ 3DAA727B5B0A45039B0E1C9A211B8400, 903B51E75F0C503A0E255120F53BF51B047B219FEC1E15F2F1D02DDD562FC73B ] Browser        C:\Windows\System32\browser.dll
14:34:18.0158 0x0b30  Browser - ok
14:34:18.0205 0x0b30  [ 845B8CE732E67F3B4133164868C666EA, 9309B094CD9B5EBC46295A5EB806BED472C3CEDE3B5F6F497EBDABA496A2A27F ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
14:34:18.0267 0x0b30  Brserid - ok
14:34:18.0283 0x0b30  [ 203F0B1E73ADADBBB7B7B1FABD901F6B, 782FA7B26940FE479C49C9BAA2EB582CDAAAD607013E9BCFC85E6FBBB7D49A6D ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
14:34:18.0345 0x0b30  BrSerWdm - ok
14:34:18.0376 0x0b30  [ BD456606156BA17E60A04E18016AE54B, DFBDC9DA6A3EA40BACFF204BC6C55C2C122B5885D2CBF6D45054DE43EE15EC4D ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
14:34:18.0423 0x0b30  BrUsbMdm - ok
14:34:18.0454 0x0b30  [ AF72ED54503F717A43268B3CC5FAEC2E, 4A638669B0C30B1BDED242A8BF2015A37749570FF4D67D190BACC8D7E0C44468 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
14:34:18.0501 0x0b30  BrUsbSer - ok
14:34:18.0532 0x0b30  [ ED3DF7C56CE0084EB2034432FC56565A, B5B75E002E7BC0209582C635CCCA26DB569BDB23C33A126634E00C6434BF941B ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
14:34:18.0563 0x0b30  BTHMODEM - ok
14:34:18.0610 0x0b30  [ 1DF19C96EEF6C29D1C3E1A8678E07190, 1F4BB161FF3A1C5B1465BB52F3520FEDB7ACB1FAA132466F07D16DB8E394AEA5 ] bthserv        C:\Windows\system32\bthserv.dll
14:34:18.0673 0x0b30  bthserv - ok
14:34:18.0751 0x0b30  catchme - ok
14:34:18.0782 0x0b30  [ 77EA11B065E0A8AB902D78145CA51E10, 160EB3BBE9E5F3CC4A02584E6F2576A812C7565B940D74838B983F1EE51FA73A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
14:34:18.0844 0x0b30  cdfs - ok
14:34:18.0891 0x0b30  [ BE167ED0FDB9C1FA1133953C18D5A6C9, E26A851CA13E7300F977E5B20FA5D25FD0E1442AB6AD5DB58BBDB2DAAD87027C ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
14:34:18.0938 0x0b30  cdrom - ok
14:34:18.0969 0x0b30  [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] CertPropSvc    C:\Windows\System32\certprop.dll
14:34:19.0031 0x0b30  CertPropSvc - ok
14:34:19.0078 0x0b30  [ 3FE3FE94A34DF6FB06E6418D0F6A0060, 6B3A2A26609A75B690D4C0B3059E40822F3B3DB08943F58EC496BABDA7D0A735 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
14:34:19.0141 0x0b30  circlass - ok
14:34:19.0172 0x0b30  [ 33A60554882FDF59CDA3E1806370BBA1, 3DE5451E1CB84AAEBD03F54BEFC670C401447B4881A8B022748B6ECF0F500F01 ] CLFS            C:\Windows\system32\CLFS.sys
14:34:19.0219 0x0b30  CLFS - ok
14:34:19.0265 0x0b30  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:34:19.0297 0x0b30  clr_optimization_v2.0.50727_32 - ok
14:34:19.0375 0x0b30  [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
14:34:19.0421 0x0b30  clr_optimization_v4.0.30319_32 - ok
14:34:19.0453 0x0b30  [ DEA805815E587DAD1DD2C502220B5616, 2D6A7668C95352B818F5EC59FF462894935833D34190257DA9CAC7E67FD3631C ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
14:34:19.0499 0x0b30  CmBatt - ok
14:34:19.0531 0x0b30  [ C537B1DB64D495B9B4717B4D6D9EDBF2, 400EEFE662DE117C9CC956E4CBD5E98F28F962E7447CD93E8A78FDD8CA39EB4B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
14:34:19.0562 0x0b30  cmdide - ok
14:34:19.0609 0x0b30  [ 3051724F223EA48968B19567DE2A81F4, DCC27DE1B2B35866FC6DBDE95A368E7D0D346B6C3F31D0BACA63DD39B0A8874E ] CNG            C:\Windows\system32\Drivers\cng.sys
14:34:19.0671 0x0b30  CNG - ok
14:34:19.0702 0x0b30  [ A6023D3823C37043986713F118A89BEE, FAC239A7FA6251C7EDFFA34B4BAE3910B8BC0BD4A3574B6DB6931A8D691E207B ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
14:34:19.0733 0x0b30  Compbatt - ok
14:34:19.0780 0x0b30  [ CBE8C58A8579CFE5FCCF809E6F114E89, AC083A1C649EBA18C59FCC1772D0784B10E2B8C63094E3C14388E147DBC3F6DF ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
14:34:19.0827 0x0b30  CompositeBus - ok
14:34:19.0858 0x0b30  COMSysApp - ok
14:34:19.0889 0x0b30  [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1, 6FC323217D82EF661BA0E3F949B61B05BB5235D1A69C81D24876C2153FAECEF6 ] crcdisk        C:\Windows\system32\DRIVERS\crcdisk.sys
14:34:19.0921 0x0b30  crcdisk - ok
14:34:19.0983 0x0b30  [ 49474B3E37969AF4B5C076F42B623AFF, BDA6B57E9B60EF1B67C74099263D33A367AAA035667239F76AB8B268FD3E8F23 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
14:34:20.0030 0x0b30  CryptSvc - ok
14:34:20.0061 0x0b30  DCamUSBSTK02N - ok
14:34:20.0108 0x0b30  [ 01B4614CAC8D500379185B5F73B87673, 89D8BA28C97811F313DEACBE72A78787101361B4AC09C4DA68C59E1170B3B8CE ] DCamUSBTP10    C:\Windows\system32\Drivers\iP293x.sys
14:34:20.0155 0x0b30  DCamUSBTP10 - detected UnsignedFile.Multi.Generic ( 1 )
14:34:22.0978 0x0b30  DCamUSBTP10 ( UnsignedFile.Multi.Generic ) - warning
14:34:25.0537 0x0b30  [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] DcomLaunch      C:\Windows\system32\rpcss.dll
14:34:25.0615 0x0b30  DcomLaunch - ok
14:34:25.0661 0x0b30  [ 8D6E10A2D9A5EED59562D9B82CF804E1, 888F9650F4E872BA8F4E0C27E38A6672A561042B17EBA40E306A22357965B0AD ] defragsvc      C:\Windows\System32\defragsvc.dll
14:34:25.0755 0x0b30  defragsvc - ok
14:34:25.0802 0x0b30  [ F024449C97EC1E464AAFFDA18593DB88, 7EF1E241892E098A472BCA14C724DFF1AACCF190954AF1C4A38B6D542CC74BD2 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
14:34:25.0864 0x0b30  DfsC - ok
14:34:25.0911 0x0b30  [ E9E01EB683C132F7FA27CD607B8A2B63, 4D9037B458C522874619143A4176BCED42472C68933E6E83D37B67242706F3C4 ] Dhcp            C:\Windows\system32\dhcpcore.dll
14:34:25.0973 0x0b30  Dhcp - ok
14:34:26.0051 0x0b30  [ E95DE5B790B2D16706DAC8472E51F31A, 9D7A72742D369B9F0E4ACEC9C1850D0D60E975AEBEFF5BA06B954EA3AB3E9FF6 ] DiagTrack      C:\Windows\system32\diagtrack.dll
14:34:26.0176 0x0b30  DiagTrack - ok
14:34:26.0207 0x0b30  [ 1A050B0274BFB3890703D490F330C0DA, 79D74F4679A2EE040FAAF4D0392A9311239A10A5F8A5CCB48656C6F89B6D62FB ] discache        C:\Windows\system32\drivers\discache.sys
14:34:26.0285 0x0b30  discache - ok
14:34:26.0317 0x0b30  [ 565003F326F99802E68CA78F2A68E9FF, ABC42B24DBA4FFC411120E09278EF26AF56CCAB463B69B4BD6C530B4A07063D2 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
14:34:26.0348 0x0b30  Disk - ok
14:34:26.0379 0x0b30  [ 33EF4861F19A0736B11314AAD9AE28D0, 4C4B84365D85758E3263B88F157D8B086B392C6F1EA5F0F3DB6BF87EF90248EC ] Dnscache        C:\Windows\System32\dnsrslvr.dll
14:34:26.0441 0x0b30  Dnscache - ok
14:34:26.0473 0x0b30  [ 366BA8FB4B7BB7435E3B9EACB3843F67, 65B7C61ACF34F1F0149045AA9E09A3F917A927963237A385A914D0B80551DC31 ] dot3svc        C:\Windows\System32\dot3svc.dll
14:34:26.0551 0x0b30  dot3svc - ok
14:34:26.0582 0x0b30  [ 8EC04CA86F1D68DA9E11952EB85973D6, 2E3FBC2D683D1274E8BC45EEEA87D43B77EDDCAAF0D453296D9FDA6B9D717071 ] DPS            C:\Windows\system32\dps.dll
14:34:26.0660 0x0b30  DPS - ok
14:34:26.0707 0x0b30  [ B918E7C5F9BF77202F89E1A9539F2EB4, C589A37DE50BBEF22E2DAA9682EA43147F614AA1AF7DAAA942BA5FC192313A0B ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
14:34:26.0753 0x0b30  drmkaud - ok
14:34:26.0816 0x0b30  [ 3583A5A8CC2E682BFFBD4630D0FEC08B, FD0F184B358FCECAA763444B414074BEF4E871EB7527D88385519FC158435C72 ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
14:34:26.0894 0x0b30  DXGKrnl - ok
14:34:26.0925 0x0b30  [ 8600142FA91C1B96367D3300AD0F3F3A, 5713625E27DF11FAAFDA7AC79899A6AD813166E167088FA990EC5DE87DBE83DF ] EapHost        C:\Windows\System32\eapsvc.dll
14:34:26.0987 0x0b30  EapHost - ok
14:34:27.0190 0x0b30  [ 024E1B5CAC09731E4D868E64DBFB4AB0, AB0826A74BBEE5B7A1B035861B665C79BC98305CFC7D82BEF420558FBD3EE994 ] ebdrv          C:\Windows\system32\DRIVERS\evbdx.sys
14:34:27.0440 0x0b30  ebdrv - ok
14:34:27.0487 0x0b30  [ 1667D76FBF42B24B9DE3E8B0A7CF06BE, AB9FD4F7B007633FEC552D14932CDEB56DBCE56D152C0EDC91FAFD08E636AADC ] EFS            C:\Windows\System32\lsass.exe
14:34:27.0533 0x0b30  EFS - ok
14:34:27.0611 0x0b30  [ A8C362018EFC87BEB013EE28F29C0863, 07971C681FBD391C0BA0172618AF8AD77520182207F1C57F134B34D6A113857F ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
14:34:27.0721 0x0b30  ehRecvr - ok
14:34:27.0752 0x0b30  [ D389BFF34F80CAEDE417BF9D1507996A, 12859B9925D7A4631DE61A820922F43F56ED23C2AF014CBF36322685E5CF641E ] ehSched        C:\Windows\ehome\ehsched.exe
14:34:27.0799 0x0b30  ehSched - ok
14:34:27.0861 0x0b30  [ 0ED67910C8C326796FAA00B2BF6D9D3C, 97FAA7627A162B0AEC15545E0165D13355D535B4157604BB87F8EEB72ECD24A8 ] elxstor        C:\Windows\system32\DRIVERS\elxstor.sys
14:34:27.0923 0x0b30  elxstor - ok
14:34:27.0970 0x0b30  [ 093CEE3B45F0954DCE6CB891F6A920F7, 8C614CF476F871274AA06153224E8F7354BF5E23E6853358591BF35A381FB75B ] epmntdrv        C:\Windows\system32\epmntdrv.sys
14:34:28.0001 0x0b30  epmntdrv - detected UnsignedFile.Multi.Generic ( 1 )
14:34:30.0669 0x0b30  Detect skipped due to KSN trusted
14:34:30.0669 0x0b30  epmntdrv - ok
14:34:30.0700 0x0b30  [ 8FC3208352DD3912C94367A206AB3F11, 69B65C12BDADD4B730508674B1B77C5496612B4ACCC447DB9AFE49ADEA8CBF02 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
14:34:30.0731 0x0b30  ErrDev - ok
14:34:30.0809 0x0b30  [ C09D5F6340EB255835439D3004762C2E, F87EFF86E9A2ABCD7C6C72950D428728D93FC68B3303D5F2217B15A3DD042D09 ] eTSrv          C:\Program Files\Aladdin\eToken\PKIClient\x32\eTSrv.exe
14:34:30.0825 0x0b30  eTSrv - detected UnsignedFile.Multi.Generic ( 1 )
14:34:33.0477 0x0b30  Detect skipped due to KSN trusted
14:34:33.0477 0x0b30  eTSrv - ok
14:34:33.0539 0x0b30  [ F1DE3EEF501DDA7DDF99F2EDF0C5540E, 8D604553A3F5DB03BFFD50473ECB6F05EBCFCC6B5E1F149322830DBD6C806866 ] EuGdiDrv        C:\Windows\system32\EuGdiDrv.sys
14:34:33.0555 0x0b30  EuGdiDrv - detected UnsignedFile.Multi.Generic ( 1 )
14:34:36.0191 0x0b30  Detect skipped due to KSN trusted
14:34:36.0191 0x0b30  EuGdiDrv - ok
14:34:36.0285 0x0b30  [ F6916EFC29D9953D5D0DF06882AE8E16, ED41893960018D5EC2F7829B1DE4B6967D9FD074D60B11B9EB854E3E0948EC24 ] EventSystem    C:\Windows\system32\es.dll
14:34:36.0363 0x0b30  EventSystem - ok
14:34:36.0410 0x0b30  [ 2DC9108D74081149CC8B651D3A26207F, 75CB47923A867DDAC512701CE71DFCFC340FC3A2E27F4255D0836A1FBC463176 ] exfat          C:\Windows\system32\drivers\exfat.sys
14:34:36.0488 0x0b30  exfat - ok
14:34:36.0519 0x0b30  [ 7E0AB74553476622FB6AE36F73D97D35, 41463A255FDA1D550B3385EC7C73ABC343B1BBBE9CEE4DF9F2A8B3E7338C4947 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
14:34:36.0597 0x0b30  fastfat - ok
14:34:36.0659 0x0b30  [ 967EA5B213E9984CBE270205DF37755B, 43153E23210B03FAE16897D62D55B8742F834EDC695F8401EAB5DE307F62602D ] Fax            C:\Windows\system32\fxssvc.exe
14:34:36.0753 0x0b30  Fax - ok
14:34:36.0769 0x0b30  [ E817A017F82DF2A1F8CFDBDA29388B29, 4CC9320A21E6FEA2D16C48D6BEA14391B695BD541A3C5FDDAEEE086A414FC837 ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
14:34:36.0815 0x0b30  fdc - ok
14:34:36.0831 0x0b30  [ F3222C893BD2F5821A0179E5C71E88FB, A85B947249DBB986358CCD4B158DD58A9301F074F3C6CCCDEF2D01F432E59D1B ] fdPHost        C:\Windows\system32\fdPHost.dll
14:34:36.0909 0x0b30  fdPHost - ok
14:34:36.0925 0x0b30  [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B, 0E76C29D2A974A3F2FBFCB63D066D4136B78E02F6B1F579B1865CA7A76193987 ] FDResPub        C:\Windows\system32\fdrespub.dll
14:34:37.0003 0x0b30  FDResPub - ok
14:34:37.0034 0x0b30  [ 6CF00369C97F3CF563BE99BE983D13D8, F65F35324A2FB9DFB533B1C4D089D990CC242218FE83414329D07B786D8EFF33 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
14:34:37.0065 0x0b30  FileInfo - ok
14:34:37.0081 0x0b30  [ 42C51DC94C91DA21CB9196EB64C45DB9, 388C68D12ECC8FFE3116FEAAF4DB7B80CF4A3F97E935788DD21C6ADE2369F635 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
14:34:37.0159 0x0b30  Filetrace - ok
14:34:37.0174 0x0b30  [ 87907AA70CB3C56600F1C2FB8841579B, CA1CD82A1CD453617CE5EA431A1836997F14E3580554E8A516D9FE1E9926D979 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
14:34:37.0205 0x0b30  flpydisk - ok
14:34:37.0237 0x0b30  [ 7520EC808E0C35E0EE6F841294316653, 6EC65511B4838A7172A8F89E35C2F9DF4F0BFCE3BE12EDA790F3EB567102FF67 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
14:34:37.0283 0x0b30  FltMgr - ok
14:34:37.0346 0x0b30  [ 6EC244F102C7F129678E5F7309D1366D, C30DA201AC623DA440B0A0716534557C578218C2A591FA8893CCCBD96B4518F9 ] FontCache      C:\Windows\system32\FntCache.dll
14:34:37.0471 0x0b30  FontCache - ok
14:34:37.0517 0x0b30  [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F, DBED26852B99B362152DA9CD4F31A1883EF6F9B496F3CF3772A197BA72DB61DA ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
14:34:37.0549 0x0b30  FontCache3.0.0.0 - ok
14:34:37.0627 0x0b30  [ 064D13A0AEDC66FDD4C5AAF0D3A5BE36, C9BC80D7B2BC02A4D16E87B071A93EC26FAFB21BB799D1850D211655B6B3A1AB ] FoxitCloudUpdateService C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
14:34:37.0673 0x0b30  FoxitCloudUpdateService - ok
14:34:37.0673 0x0b30  [ 1A16B57943853E598CFF37FE2B8CBF1D, 87609F46F3B8123552141FD70866E895220B1BBD92BC2B580CAF49201AA0197E ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
14:34:37.0705 0x0b30  FsDepends - ok
14:34:37.0736 0x0b30  [ 7DAE5EBCC80E45D3253F4923DC424D05, 8A2C4D5591509B0B0A44583520617A9AE34F32BB6E68A012A7D7870ED24F703A ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
14:34:37.0767 0x0b30  Fs_Rec - ok
14:34:37.0798 0x0b30  [ 8142D5D886829B9876CB93AF59475C09, 36038497ABE807365B8353B2EDE31E81FD50E3D644F3D7BBEC890C4538135DE9 ] FTDIBUS        C:\Windows\system32\drivers\ftdibus.sys
14:34:37.0829 0x0b30  FTDIBUS - ok
14:34:37.0845 0x0b30  [ 63D72A4CF9F163B59DB0CEED940A7D76, A9CBBEC0F7D8170F410501734E7AFE475E2515D53753637C40C8F0F6B8ADE148 ] FTSER2K        C:\Windows\system32\drivers\ftser2k.sys
14:34:37.0876 0x0b30  FTSER2K - ok
14:34:37.0923 0x0b30  [ E306A24D9694C724FA2491278BF50FDB, 1D246B9C28550640EACBF8CF9DC980FD75106B92832D392FEBEF0C7012353091 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
14:34:37.0970 0x0b30  fvevol - ok
14:34:38.0001 0x0b30  [ 65EE0C7A58B65E74AE05637418153938, 0E1A398ADD8411AF4CCC3344D67BE1B261320C58328BD5C5855A357476FAEBEF ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
14:34:38.0032 0x0b30  gagp30kx - ok
14:34:38.0079 0x0b30  [ 6E755F8DA0790AA6924B8BE91CC99A4B, 7804DC14E6CC1775DB4A7833D0B8FC73C8AA1A2A81F65811FC26FC773FB50670 ] GDBehave        C:\Windows\system32\drivers\GDBehave.sys
14:34:38.0110 0x0b30  GDBehave - ok
14:34:38.0266 0x0b30  [ FE489997ABB4335371188561E22E08C7, 8F7859E2228464664B410FCC9224C727784A2EC115D618BF0889BFFEC96D97C2 ] GDFwSvc        C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe
14:34:38.0438 0x0b30  GDFwSvc - ok
14:34:38.0469 0x0b30  [ 0B644EB2DA939985D674B653FA446933, BE4517F73A6A20433403100F6B30EDDB194EB243772C8D4AB0C5FB732793FF74 ] GDMnIcpt        C:\Windows\system32\drivers\MiniIcpt.sys
14:34:38.0500 0x0b30  GDMnIcpt - ok
14:34:38.0531 0x0b30  [ B7D00C0B098A27937B249E50398D0A73, FD2EF6B9FB85E7A8FB92051C11EB7A3DCD334F9BEAE7F0F242972C06A94BD799 ] GDPkIcpt        C:\Windows\system32\drivers\PktIcpt.sys
14:34:38.0563 0x0b30  GDPkIcpt - ok
14:34:38.0656 0x0b30  [ 846972E3EBB10D2F39A69B5E6CF08313, 7E2EC3BBF066C3C40F75F2533D1AB2307C3331FA460243A4F4B31A61714C159E ] GDScan          C:\Program Files\Common Files\G Data\GDScan\GDScan.exe
14:34:38.0719 0x0b30  GDScan - ok
14:34:38.0765 0x0b30  [ 3B6E35FDA3AB07A081CA1D0BCB205F19, F0C92BC0152A427D11EA9B1389DA7CDE2BB1DBAE12EE8D9C781E7A215F511D61 ] gdwfpcd        C:\Windows\system32\drivers\gdwfpcd32.sys
14:34:38.0797 0x0b30  gdwfpcd - ok
14:34:38.0875 0x0b30  [ 185ADA973B5020655CEE342059A86CBB, D3E352DFAF30761505480A4C557D980083F65EC5BD46E2656B2114D47B272A89 ] GEARAspiWDM    C:\Windows\system32\Drivers\GEARAspiWDM.sys
14:34:38.0921 0x0b30  GEARAspiWDM - ok
14:34:38.0999 0x0b30  [ E897EAF5ED6BA41E081060C9B447A673, A428DC68516F19C6C53A8B62E4BDB2587E70FB751B9D77700B6B147D347DA157 ] gpsvc          C:\Windows\System32\gpsvc.dll
14:34:39.0109 0x0b30  gpsvc - ok
14:34:39.0140 0x0b30  [ 3CC33DAB9350C99538BB8CC2D675E1F2, 9ADB2B8CDC87E3CF6E707635EF6EB8EB4DBF14ADFE059E6C7FABCD771592066B ] GRD            C:\Windows\system32\drivers\GRD.sys
14:34:39.0171 0x0b30  GRD - ok
14:34:39.0218 0x0b30  [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdate        C:\Program Files\Google\Update\GoogleUpdate.exe
14:34:39.0233 0x0b30  gupdate - ok
14:34:39.0249 0x0b30  [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
14:34:39.0280 0x0b30  gupdatem - ok
14:34:39.0311 0x0b30  [ C44E3C2BAB6837DB337DDEE7544736DB, 88A24FF7D2FECCEAFFD421B2039A0FB623DA47A6B220B80EF1E52DD26D9E222D ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
14:34:39.0374 0x0b30  hcw85cir - ok
14:34:39.0421 0x0b30  [ A5EF29D5315111C80A5C1ABAD14C8972, A181DA72E946F121C3F4A19438C547B0BFD15138AB1DB5465945EC89DF1F6B0A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
14:34:39.0499 0x0b30  HdAudAddService - ok
14:34:39.0530 0x0b30  [ 9036377B8A6C15DC2EEC53E489D159B5, 1E56D2ACFE92E6DF96D755B05C63D580EED82C210F075C8623E138BEE6BCD41B ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
14:34:39.0577 0x0b30  HDAudBus - ok
14:34:39.0608 0x0b30  [ 1D58A7F3E11A9731D0EAAAA8405ACC36, 7056FA18B86FBD52C4A6092D80476C02553EA053D6A0BEDB01A2FA5E152D5215 ] HidBatt        C:\Windows\system32\DRIVERS\HidBatt.sys
14:34:39.0639 0x0b30  HidBatt - ok
14:34:39.0655 0x0b30  [ 89448F40E6DF260C206A193A4683BA78, 71E0FCC32AE6FF8DFF420DB0383D6A200E1EAE14BD2E32453F92CE18B31C1F3C ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
14:34:39.0701 0x0b30  HidBth - ok
14:34:39.0733 0x0b30  [ CF50B4CF4A4F229B9F3C08351F99CA5E, B97843620AF80FF0EC8F2C438255C0A42A756C6314FAF3DEF415DE16E14C108F ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
14:34:39.0779 0x0b30  HidIr - ok
14:34:39.0811 0x0b30  [ 2BC6F6A1992B3A77F5F41432CA6B3B6B, 2AF3312F1C8C8923C0A29AA5DAE57CE269417E53DEA2F0CCCC8DB57029698FE1 ] hidserv        C:\Windows\System32\hidserv.dll
14:34:39.0873 0x0b30  hidserv - ok
14:34:39.0904 0x0b30  [ 10C19F8290891AF023EAEC0832E1EB4D, E208553029488A6EE2F5216CC9FE5F93E9931A94C0D0625253BB159E30642853 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
14:34:39.0982 0x0b30  HidUsb - ok
14:34:40.0013 0x0b30  [ 196B4E3F4CCCC24AF836CE58FACBB699, 7A2E1F603A073421FA0987EFB96647F1F0F2D4E0C82AA62EBC041585DA811DAF ] hkmsvc          C:\Windows\system32\kmsvc.dll
14:34:40.0060 0x0b30  hkmsvc - ok
14:34:40.0091 0x0b30  [ 6658F4404DE03D75FE3BA09F7ABA6A30, E51D9C1580A283EB862F09B73AAE1B647DD683A53F3DD99834222F12DD15E40F ] HomeGroupListener C:\Windows\system32\ListSvc.dll
14:34:40.0154 0x0b30  HomeGroupListener - ok
14:34:40.0169 0x0b30  [ DBC02D918FFF1CAD628ACBE0C0EAA8E8, 02121800D9062692C102475876AE8143EBE46D855E8328B8CDCFE6A2F0D19696 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
14:34:40.0232 0x0b30  HomeGroupProvider - ok
14:34:40.0263 0x0b30  [ 6AD5573C959D466C1BB6360C3CE21FEF, 7CA95C1D756C2223C16B9DF517FCDBBBAAAE3C6FD85F1EE8DA8628ECBD24E93E ] HookCentre      C:\Windows\system32\drivers\HookCentre.sys
14:34:40.0294 0x0b30  HookCentre - ok
14:34:40.0341 0x0b30  [ 295FDC419039090EB8B49FFDBB374549, 670E8015FD374640C6570F56F7FE8DE4D8F92E7A8072F5D1B2B95D0BD699CEF7 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
14:34:40.0388 0x0b30  HpSAMD - ok
14:34:40.0435 0x0b30  [ 487569E5DA56A5A432FF8AF6D3599CF9, 7C974D8379C60B4F69A20B01876C49181B0A63AC318C4BD0A21DABFF27A15C9D ] HTTP            C:\Windows\system32\drivers\HTTP.sys
14:34:40.0528 0x0b30  HTTP - ok
14:34:40.0544 0x0b30  [ 0C4E035C7F105F1299258C90886C64C5, CFB4FBE7B28058E6D3E6E508CF3C1645F6AAE0AFEB4C5364835B9C42311DF0D4 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
14:34:40.0575 0x0b30  hwpolicy - ok
14:34:40.0606 0x0b30  [ F151F0BDC47F4A28B1B20A0818EA36D6, 84B24B5796D9F70A8C37773F5484A4606CC7908370CCD942627ACBEDC4952D79 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
14:34:40.0637 0x0b30  i8042prt - ok
14:34:40.0669 0x0b30  [ 5CD5F9A5444E6CDCB0AC89BD62D8B76E, 72870092A80C6DAE0105025B0ED8B607E98BA81E59298364A7FE4C9C56C68FF0 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
14:34:40.0715 0x0b30  iaStorV - ok
14:34:40.0809 0x0b30  [ 3E9213A2A050BF429E91898C90F8B4E3, D80ABE5691087661B19F01927B631CB8C5291120B814B6F863F046E0D643E9E4 ] idsvc          C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
14:34:40.0903 0x0b30  idsvc - ok
14:34:40.0934 0x0b30  IEEtwCollectorService - ok
14:34:40.0965 0x0b30  [ 4173FF5708F3236CF25195FECD742915, 0A9C0701DF6EAC6602BE342FC13C7950EF04BB5BDF7D96C2C5DABBD2A29AA55D ] iirsp          C:\Windows\system32\DRIVERS\iirsp.sys
14:34:40.0996 0x0b30  iirsp - ok
14:34:41.0074 0x0b30  [ B9C54120F46392100478F58F374E5709, A28EE8B0988F580D5984E815FC78DF41B169260814234AA0E453375542D0957B ] IKEEXT          C:\Windows\System32\ikeext.dll
14:34:41.0168 0x0b30  IKEEXT - ok
14:34:41.0371 0x0b30  [ C6B9C84B5965E4BD6B9967B16058E4DE, F2F4F4C0522025782022E8F162A09697B18461DD06CB07E12B330AE00A7ABEFE ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
14:34:41.0589 0x0b30  IntcAzAudAddService - ok
14:34:41.0636 0x0b30  [ A0F12F2C9BA6C72F3987CE780E77C130, 5F53DF8BE1621AA7DFB655CFD9C95E0AFA1AD3CE2E290E19D7B7FB3C6E380034 ] intelide        C:\Windows\system32\drivers\intelide.sys
14:34:41.0667 0x0b30  intelide - ok
14:34:41.0698 0x0b30  [ 3B514D27BFC4ACCB4037BC6685F766E0, F12D7AC62F8550E6F33B28AD751D8413AB7FFEF963242D99FFA76CE8A48B027A ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
14:34:41.0745 0x0b30  intelppm - ok
14:34:41.0776 0x0b30  [ ACB364B9075A45C0736E5C47BE5CAE19, 202F77C659103D2D0E787B8CB0A23BE32EA5AA2E6B3B0A0F0A8DFA906AB3C0C0 ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
14:34:41.0870 0x0b30  IPBusEnum - ok
14:34:41.0885 0x0b30  [ 709D1761D3B19A932FF0238EA6D50200, 0A9D2C3A6E91CA45540555B40CB4E2DF3EBE98C1D164C4EECEE20C86782F5823 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
14:34:41.0948 0x0b30  IpFilterDriver - ok
14:34:42.0010 0x0b30  [ 58F67245D041FBE7AF88F4EAF79DF0FA, 67468D6A46FF4D87AD321BFEA42F2FC843D09AA292A119C76D4D795D06028F96 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
14:34:42.0104 0x0b30  iphlpsvc - ok
14:34:42.0135 0x0b30  [ 4BD7134618C1D2A27466A099062547BF, 20284ABEF4433A59E2981F4143CAEC67DC990864FE0B9E3DC70EE0B88539E964 ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
14:34:42.0166 0x0b30  IPMIDRV - ok
14:34:42.0197 0x0b30  [ A5FA468D67ABCDAA36264E463A7BB0CD, EDB828D596E43372F97DAE1AADA46428C4C45FB80646DDC64FAD5F25C826CF63 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
14:34:42.0275 0x0b30  IPNAT - ok
14:34:42.0338 0x0b30  [ 1323570D55CE9D70D1F10144A8249D20, 5876576289CCDC994D6BC8D1B8D29EFFF66811EBECC577F8C2F9BDC2E59ADFBC ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
14:34:42.0416 0x0b30  iPod Service - ok
14:34:42.0431 0x0b30  [ 42996CFF20A3084A56017B7902307E9F, 688176DAB91BE569280E4822E4C5BDE755794D293591C53F8047AD59C441751D ] IRENUM          C:\Windows\system32\drivers\irenum.sys
14:34:42.0463 0x0b30  IRENUM - ok
14:34:42.0494 0x0b30  [ 1F32BB6B38F62F7DF1A7AB7292638A35, 86522358680FBB1CEBC56B4D139290689BB0F71A3EC78CE883E4D75D0B37586F ] isapnp          C:\Windows\system32\drivers\isapnp.sys
14:34:42.0525 0x0b30  isapnp - ok
14:34:42.0556 0x0b30  [ EB34CE31FABD4DC4343FD2AD16D2CAF9, D21C91227A15DA89ECF522345D0AB80B3B7FC24A230596DABDB8BD3B7554CE8C ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
14:34:42.0603 0x0b30  iScsiPrt - ok
14:34:42.0634 0x0b30  [ ADEF52CA1AEAE82B50DF86B56413107E, A3AE1E96B04AC81665ABBD3CB267DFB3F78376DAE18FB0DBD447908DDAAA22D2 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
14:34:42.0665 0x0b30  kbdclass - ok
14:34:42.0697 0x0b30  [ 9E3CED91863E6EE98C24794D05E27A71, 90CF59F20E14E4A5A793266805E82BF7AE1F0CF4C7BAB1FD2EEF3B53C5DF770F ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
14:34:42.0728 0x0b30  kbdhid - ok
14:34:42.0743 0x0b30  [ 1667D76FBF42B24B9DE3E8B0A7CF06BE, AB9FD4F7B007633FEC552D14932CDEB56DBCE56D152C0EDC91FAFD08E636AADC ] KeyIso          C:\Windows\system32\lsass.exe
14:34:42.0775 0x0b30  KeyIso - ok
14:34:42.0806 0x0b30  [ 6DD2A1064DD8AFBED22E71176E2AF59B, 915F36860DAA72DA89E906A7F6F255A854A2A91EEA536A7C2EDB4A63250F66CC ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
14:34:42.0837 0x0b30  KSecDD - ok
14:34:42.0853 0x0b30  [ 76C0D35167B1369C68388FEDB56A3048, 2788962AB21DBB0A4D130AE5F822E9FDB96D7FF6320E2798714BF18BCB9CAE4F ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
14:34:42.0899 0x0b30  KSecPkg - ok
14:34:42.0931 0x0b30  [ 89A7B9CC98D0D80C6F31B91C0A310FCD, 4583CAEEE0D50C0C7CE955E533FDA063CDC37B69033D41EF22EF1BA242E4C747 ] KtmRm          C:\Windows\system32\msdtckrm.dll
14:34:43.0024 0x0b30  KtmRm - ok
14:34:43.0071 0x0b30  [ D64AF876D53ECA3668BB97B51B4E70AB, D5C07C019BFEAFBEDC29AB5060356A3B07449712B21B50E03378BEF04AF180F9 ] LanmanServer    C:\Windows\System32\srvsvc.dll
14:34:43.0165 0x0b30  LanmanServer - ok
14:34:43.0196 0x0b30  [ 58405E4F68BA8E4057C6E914F326ABA2, C3E6519A1A38F1B3597D4391E42ABFE8F1F5E86256C4B3BD876CDAD9BB68B0A6 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
14:34:43.0258 0x0b30  LanmanWorkstation - ok
14:34:43.0305 0x0b30  [ D57D1BE0129C1B45653B0FA920BC4B38, E6A5C600A2A7F8EB373B5555A1EB718B167EF5265E55E8A75CA3ADBDE04A2DA1 ] LightScribeService C:\Program Files\Common Files\LightScribe\LSSrvc.exe
14:34:43.0321 0x0b30  LightScribeService - detected UnsignedFile.Multi.Generic ( 1 )
14:34:45.0988 0x0b30  Detect skipped due to KSN trusted
14:34:45.0988 0x0b30  LightScribeService - ok
14:34:46.0019 0x0b30  [ F7611EC07349979DA9B0AE1F18CCC7A6, 879AA7A391966F00761CA039C25EBC62F6712DD5461694911EEC673E12DE103E ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
14:34:46.0082 0x0b30  lltdio - ok
14:34:46.0097 0x0b30  [ 5700673E13A2117FA3B9020C852C01E2, 6684A2905EE8C438F2A64BE47E51A54D287B08DEFB8E0AE7FC2809D845EE3C5F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
14:34:46.0175 0x0b30  lltdsvc - ok
14:34:46.0191 0x0b30  [ 55CA01BA19D0006C8F2639B6C045E08B, 4DBBDC820C514DB18CC13F8EE178F8C4E39C295C6E3C255416C235553CE7BDC1 ] lmhosts        C:\Windows\System32\lmhsvc.dll
14:34:46.0253 0x0b30  lmhosts - ok
14:34:46.0285 0x0b30  [ EB119A53CCF2ACC000AC71B065B78FEF, 1FD60735C4945AE565C223F0B47EAF9602D8777E3D15600914C1A9D761215AF9 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
14:34:46.0316 0x0b30  LSI_FC - ok
14:34:46.0331 0x0b30  [ 8ADE1C877256A22E49B75D1CC9161F9C, 3D64F233DC866537E50549A7C1A2B40A954055B22F0BDA39825B04C38C607CB7 ] LSI_SAS        C:\Windows\system32\DRIVERS\lsi_sas.sys
14:34:46.0363 0x0b30  LSI_SAS - ok
14:34:46.0394 0x0b30  [ DC9DC3D3DAA0E276FD2EC262E38B11E9, A264990857CBC74036799E17A087130626C0A09BE19879019BAF2D761C62AECC ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
14:34:46.0425 0x0b30  LSI_SAS2 - ok
14:34:46.0441 0x0b30  [ 0A036C7D7CAB643A7F07135AC47E0524, 2F662D07FCB74B8D493156DB555EAA90A47E93CF14C7B30039D2FE47EB8682B8 ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
14:34:46.0472 0x0b30  LSI_SCSI - ok
14:34:46.0487 0x0b30  [ 6703E366CC18D3B6E534F5CF7DF39CEE, 7396B9AF938284D99EC51206A7B2FA4A0DC10A493DCE6707818B03A7473782C4 ] luafv          C:\Windows\system32\drivers\luafv.sys
14:34:46.0565 0x0b30  luafv - ok
14:34:46.0597 0x0b30  [ A3E700D78EEC390F1208098CDCA5C6B6, 37D92D4AF24C43B4C468974CBBD55B6DF3AB92780560285039A0B078E566985A ] MarvinBus      C:\Windows\system32\DRIVERS\MarvinBus.sys
14:34:46.0643 0x0b30  MarvinBus - ok
14:34:46.0690 0x0b30  [ F0435FE3C1EC2659D2BBF073CA0752EE, BFC17ABFEF83316E2BE2FC6CBFEB5E143281AA588C5F071D96122AD67701717B ] massfilter      C:\Windows\system32\DRIVERS\massfilter.sys
14:34:46.0721 0x0b30  massfilter - ok
14:34:46.0909 0x0b30  [ 0BB29DE40C9D9529793DCDB59A43CF5B, 251001A407D32EF22F64915EEFFAAEC229073C4549BF7D9D1D4209B7D15B4681 ] MBAMScheduler  C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
14:34:47.0033 0x0b30  MBAMScheduler - ok
14:34:47.0080 0x0b30  [ BFB9EE8EE977EFE85D1A3105ABEF6DD1, D2A84EBF0C0B7A14AD432FD2EF43CC12300027AEA3FA4075659FB088AB62B588 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
14:34:47.0111 0x0b30  Mcx2Svc - ok
14:34:47.0143 0x0b30  [ 0FFF5B045293002AB38EB1FD1FC2FB74, 49071B565FD5B2DE43EC00D8518C3BE70843F38919E82F13104B8C1FAFB20374 ] megasas        C:\Windows\system32\DRIVERS\megasas.sys
14:34:47.0174 0x0b30  megasas - ok
14:34:47.0221 0x0b30  [ DCBAB2920C75F390CAF1D29F675D03D6, 85C3A7A010BEA5E3C6179161B295F2CB900A6A214833A5F87A4327392880E2BB ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
14:34:47.0252 0x0b30  MegaSR - ok
14:34:47.0283 0x0b30  [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] MMCSS          C:\Windows\system32\mmcss.dll
14:34:47.0345 0x0b30  MMCSS - ok
14:34:47.0361 0x0b30  [ F001861E5700EE84E2D4E52C712F4964, F4DC5AEED6F34D76CCEF360862CC47EF71097BE0813C8CE04EE5F0DB387DFFAE ] Modem          C:\Windows\system32\drivers\modem.sys
14:34:47.0439 0x0b30  Modem - ok
14:34:47.0486 0x0b30  [ 79D10964DE86B292320E9DFE02282A23, 52714827B7EEDACA55326A4E4F6158D4942DFAA3BACDE303A2F569BF3F4FAA72 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
14:34:47.0533 0x0b30  monitor - ok
14:34:47.0564 0x0b30  [ FB18CC1D4C2E716B6B903B0AC0CC0609, F10CCA63493782B16DE6B96B94A27078DBE68AECEF34FDF840CFF86D2C6E3C5E ] mouclass        C:\Windows\system32\drivers\mouclass.sys
14:34:47.0595 0x0b30  mouclass - ok
14:34:47.0611 0x0b30  [ 2C388D2CD01C9042596CF3C8F3C7B24D, B2FB72272BB01AEDA4047B57C943B7E9BD8A6497854F8CC34672AAA592D0A703 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
14:34:47.0642 0x0b30  mouhid - ok
14:34:47.0673 0x0b30  [ 644905A19D0F37F2233DFCE53BC4BC19, F52CB40AA0FD1EBF8CBF0F3BFB20C47142C637719840877FB93F10D085EB8C2B ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
14:34:47.0704 0x0b30  mountmgr - ok
14:34:47.0767 0x0b30  [ 03D14BF1DC59130002F6B8BA3AD89DB9, 1729CCD8AAF51CDB86ED67569974D0B6B1CFFA5F90EF6E6004B0D8A305D88C27 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
14:34:47.0798 0x0b30  MozillaMaintenance - ok
14:34:47.0813 0x0b30  [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0, D3D903EEA465D77345AAC9B9F02CDEADF4831212EA2DE4FCA33BEE26EBB47420 ] mpio            C:\Windows\system32\drivers\mpio.sys
14:34:47.0860 0x0b30  mpio - ok
14:34:47.0876 0x0b30  [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0, 1D6DCFA0E56C3E55B6AED819176E751502F863BA0FCF4F0B3253A81D208141A2 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
14:34:47.0954 0x0b30  mpsdrv - ok
14:34:48.0016 0x0b30  [ 9835584E999D25004E1EE8E5F3E3B881, 71798B0CBE9AE69F1F29B845319019C69EC7F415CBABB3B87DDE92C360675021 ] MpsSvc          C:\Windows\system32\mpssvc.dll
14:34:48.0110 0x0b30  MpsSvc - ok
14:34:48.0141 0x0b30  [ 03F899F521D2AAED1C55008F734DF252, 4E56A51476A13F5630719018037B1F63DF9ACEA1CFE782AF04E669BD696954C5 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
14:34:48.0203 0x0b30  MRxDAV - ok
14:34:48.0235 0x0b30  [ 5D16C921E3671636C0EBA3BBAAC5FD25, 5BC107B95CAFC88F51FBB9F657B99944B20627A2B618F263093D7045E4FFD65C ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
14:34:48.0281 0x0b30  mrxsmb - ok
14:34:48.0328 0x0b30  [ 6D17A4791ACA19328C685D256349FEFC, 012AA3D84EEAAF53780D06D2D11B9727DFC3441F3FAD75BC9E751FB814403668 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
14:34:48.0375 0x0b30  mrxsmb10 - ok
14:34:48.0406 0x0b30  [ B81F204D146000BE76651A50670A5E9E, 78193D0F967BE9829E53F9B500342934B4B1E1F4CEFC444382959E2061BC3B17 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
14:34:48.0453 0x0b30  mrxsmb20 - ok
14:34:48.0484 0x0b30  [ 012C5F4E9349E711E11E0F19A8589F0A, 208B92DFCF7AD43202660FBBC9FF5E03AEDBEE38178FF3628EB74CB6CD37C584 ] msahci          C:\Windows\system32\drivers\msahci.sys
14:34:48.0515 0x0b30  msahci - ok
14:34:48.0562 0x0b30  [ 55055F8AD8BE27A64C831322A780A228, C2C9FD1F61302997117B1CD0835E8234405BB80084065ED05363B77868397304 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
14:34:48.0593 0x0b30  msdsm - ok
14:34:48.0625 0x0b30  [ E1BCE74A3BD9902B72599C0192A07E27, 5162EB623FE64E9DFEAC6CA2410EFA1314E62EC13207FFBFED2D61AA887603C4 ] MSDTC          C:\Windows\System32\msdtc.exe
14:34:48.0671 0x0b30  MSDTC - ok
14:34:48.0718 0x0b30  [ 114B67C324D64C8195FD3BF93B4DF02A, EF9349BD28578D3BE57946125AA909DFF902D8CB0BFCD9902F690C70F78E3EEB ] MSDV            C:\Windows\system32\DRIVERS\msdv.sys
14:34:48.0765 0x0b30  MSDV - ok
14:34:48.0796 0x0b30  [ DAEFB28E3AF5A76ABCC2C3078C07327F, 6EB558532400B489763BAE7203538DE5F196282A8CB46A1B31D59120FC5AFCEF ] Msfs            C:\Windows\system32\drivers\Msfs.sys
14:34:48.0843 0x0b30  Msfs - ok
14:34:48.0859 0x0b30  [ 3E1E5767043C5AF9367F0056295E9F84, B2EDFECD3C14E4FE1BA87D9A86334043A9BD696A554EBD186DA7EAEB2EBD4F70 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
14:34:48.0921 0x0b30  mshidkmdf - ok
14:34:48.0921 0x0b30  [ 0A4E5757AE09FA9622E3158CC1AEF114, ED574E420E57374E328C7C526504ECA569C164287966F06019EC207CB17F2C54 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
14:34:48.0952 0x0b30  msisadrv - ok
14:34:48.0983 0x0b30  [ 90F7D9E6B6F27E1A707D4A297F077828, BEFC220EAA7307849600748842ACB9254A6A91158812D9B23EFAF912C498BA7F ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
14:34:49.0046 0x0b30  MSiSCSI - ok
14:34:49.0061 0x0b30  msiserver - ok
14:34:49.0093 0x0b30  [ 8C0860D6366AAFFB6C5BB9DF9448E631, 949C5A14E57F2D7385543C17C3485E7ADE36EA2016F6E0A1866571D2EDE90A77 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
14:34:49.0139 0x0b30  MSKSSRV - ok
14:34:49.0186 0x0b30  [ 3EA8B949F963562CEDBB549EAC0C11CE, 1B0B2F16A1790282504F3C548D47C3281EFB440D5D9711A1EF76D6371B768D2D ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
14:34:49.0249 0x0b30  MSPCLOCK - ok
14:34:49.0264 0x0b30  [ F456E973590D663B1073E9C463B40932, 48BA6D5580EE7B6A4C06E04772FD35B51779553FC0DD6C5C30DD8B5DEEB25B11 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
14:34:49.0342 0x0b30  MSPQM - ok
14:34:49.0373 0x0b30  [ 0E008FC4819D238C51D7C93E7B41E560, 141FCEBDD05874407EAEC35A9DCD3BB16F2A428F23E55487D6A5DBFCADBF10D2 ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
14:34:49.0405 0x0b30  MsRPC - ok
14:34:49.0451 0x0b30  [ FC6B9FF600CC585EA38B12589BD4E246, F05DB01AE1955D2468CE6B51E51998B111CA3B0BDEED090EE6B99B625CBA564A ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
14:34:49.0467 0x0b30  mssmbios - ok
14:34:49.0483 0x0b30  [ B42C6B921F61A6E55159B8BE6CD54A36, 6BB0A7BE005B8F281E551D1B8046CE4202372BC7AE0161881C858BFAC675FE1C ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
14:34:49.0545 0x0b30  MSTEE - ok
14:34:49.0561 0x0b30  [ 33599130F44E1F34631CEA241DE8AC84, E15B31D1AFDC8DC6D2B21D4215796A99ECC69EEDBB06CEED01AECC3C99A44C8B ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
14:34:49.0607 0x0b30  MTConfig - ok
14:34:49.0639 0x0b30  [ 159FAD02F64E6381758C990F753BCC80, E55AB01DCFA95ECAB24A2A9656E28FF9D064BA08B3D82DC8AA42F5991BA09598 ] Mup            C:\Windows\system32\Drivers\mup.sys
14:34:49.0670 0x0b30  Mup - ok
14:34:49.0717 0x0b30  [ 61D57A5D7C6D9AFE10E77DAE6E1B445E, D252248532142E9E2332DA693BC51B795102CA938B568FF04981E98B19BFBC5C ] napagent        C:\Windows\system32\qagentRT.dll
14:34:49.0795 0x0b30  napagent - ok
14:34:49.0841 0x0b30  [ 26384429FCD85D83746F63E798AB1480, 957C115C263A4B4DC854558B43ECE632D8E2BCCB744E23A01EBA7476BA2E7FFB ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
14:34:49.0904 0x0b30  NativeWifiP - ok
14:34:49.0997 0x0b30  [ 5E8EDD6A52E897C19EC6E149FE6C7A8E, 0ACF2237F5AFA72505FFE2C9639FFDBBB991EDF804376610B0719F0131F63E43 ] NBService      C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
14:34:50.0075 0x0b30  NBService - ok
14:34:50.0153 0x0b30  [ 8C9C922D71F1CD4DEF73F186416B7896, 15FF43CD90C7913F83B35F2E7986561584588E8A45196EBD965C3A355836A9C7 ] NDIS            C:\Windows\system32\drivers\ndis.sys
14:34:50.0216 0x0b30  NDIS - ok
14:34:50.0247 0x0b30  [ 0E1787AA6C9191D3D319E8BAFE86F80C, F535022747355B2C66424BDA892D7DCB820C2EB8EE05BAE5BC6D1B1D65186278 ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
14:34:50.0309 0x0b30  NdisCap - ok
14:34:50.0341 0x0b30  [ E4A8AEC125A2E43A9E32AFEEA7C9C888, 6EA181117126FC70B3C1DD1AC73CC26D1603A2CF49E47F66623E2C9489C49B55 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
14:34:50.0419 0x0b30  NdisTapi - ok
14:34:50.0450 0x0b30  [ D8A65DAFB3EB41CBB622745676FCD072, 874D3C3D247C4A309DA813DB1D2EDB0037D3C489824BD5FE95B0C20699764EF7 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
14:34:50.0512 0x0b30  Ndisuio - ok
14:34:50.0559 0x0b30  [ 38FBE267E7E6983311179230FACB1017, CFD1CBCA59650795C030DB30E5795B37C11C736E14003AE1DAB081BA5C0C9B14 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
14:34:50.0653 0x0b30  NdisWan - ok
14:34:50.0684 0x0b30  [ A4BDC541E69674FBFF1A8FF00BE913F2, 18CCFD063E9870B8B6958715BC0414C4D920AE63528EA1E9D7E30F7138918FFA ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
14:34:50.0731 0x0b30  NDProxy - ok
14:34:50.0762 0x0b30  [ 80B275B1CE3B0E79909DB7B39AF74D51, 75B406B0D9D28239D4EB2A298419A5F78A58237D88C5FD688EF1DFFAFACCF796 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
14:34:50.0824 0x0b30  NetBIOS - ok
14:34:50.0855 0x0b30  [ 280122DDCF04B378EDD1AD54D71C1E54, F98B2ADE34F7E67C7C06C1D0FFB80ECBC353D044D4B4784CD952910345DC2ED0 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
14:34:50.0918 0x0b30  NetBT - ok
14:34:50.0933 0x0b30  [ 1667D76FBF42B24B9DE3E8B0A7CF06BE, AB9FD4F7B007633FEC552D14932CDEB56DBCE56D152C0EDC91FAFD08E636AADC ] Netlogon        C:\Windows\system32\lsass.exe
14:34:50.0965 0x0b30  Netlogon - ok
14:34:51.0011 0x0b30  [ 7CCCFCA7510684768DA22092D1FA4DB2, BB9E4F8FABBF596D888E6D303CB54A336D9DFF95B36AEA9369D2ED787DDC4B5D ] Netman          C:\Windows\System32\netman.dll
14:34:51.0089 0x0b30  Netman - ok
14:34:51.0136 0x0b30  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
14:34:51.0183 0x0b30  NetMsmqActivator - ok
14:34:51.0214 0x0b30  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
14:34:51.0245 0x0b30  NetPipeActivator - ok
14:34:51.0277 0x0b30  [ 8C338238C16777A802D6A9211EB2BA50, 0D08A47CD403EDA5E8CAD7409BBBBCDC29A9861D2DC41D42B68B22B1AA1EBDD6 ] netprofm        C:\Windows\System32\netprofm.dll
14:34:51.0370 0x0b30  netprofm - ok
14:34:51.0370 0x0b30  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
14:34:51.0417 0x0b30  NetTcpActivator - ok
14:34:51.0433 0x0b30  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
14:34:51.0464 0x0b30  NetTcpPortSharing - ok
14:34:51.0495 0x0b30  [ 1D85C4B390B0EE09C7A46B91EFB2C097, 6A8850B151E88EE371F3CC543A946302DDF9494908D684B8B0C706A42CC54348 ] nfrd960        C:\Windows\system32\DRIVERS\nfrd960.sys
14:34:51.0526 0x0b30  nfrd960 - ok
14:34:51.0573 0x0b30  [ F115C5CD29E512F18BD7138A094B77E5, 90C2CE8B256EE9AABF674ADDE7F85E91DAF48EA368452D03C187A4AE027D4E39 ] NlaSvc          C:\Windows\System32\nlasvc.dll
14:34:51.0620 0x0b30  NlaSvc - ok
14:34:51.0698 0x0b30  [ A328A46D87BB92CE4D8A4528E9D84787, D3245ED700151111592BA82FB675B284DA7FCE52B07A7F68352F64A402CAB37C ] NMIndexingService C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
14:34:51.0745 0x0b30  NMIndexingService - ok
14:34:51.0760 0x0b30  [ 1DB262A9F8C087E8153D89BEF3D2235F, A51EE5D5AD3CD76B74BEA9C66C462608BF3B50C53DAA4110A75DB10495A8C101 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
14:34:51.0823 0x0b30  Npfs - ok
14:34:51.0854 0x0b30  [ BA387E955E890C8A88306D9B8D06BF17, 3477BD9686C5777A93251C154512671AAA7533B18C536DF51F7B1D6D28E7F8A5 ] nsi            C:\Windows\system32\nsisvc.dll
14:34:51.0916 0x0b30  nsi - ok
14:34:51.0963 0x0b30  [ E9A0A4D07E53D8FEA2BB8387A3293C58, 690CAD6C4E35ECC1172A2E1FD3933DF73158B3BF42CB21244269612A53DE4D7A ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
14:34:52.0010 0x0b30  nsiproxy - ok
14:34:52.0119 0x0b30  [ C8DFF8D07755A66C7A4A738930F0FEAC, A2CC58312CE57988ABD976155BE91F558DCEC4C23481C6FBE64B361D511A36EA ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
14:34:52.0228 0x0b30  Ntfs - ok
14:34:52.0244 0x0b30  [ F9756A98D69098DCA8945D62858A812C, 572ADBFCFDE2030B34A013AADC14DBC144EB3F34D06991E2464A3EA9605BC045 ] Null            C:\Windows\system32\drivers\Null.sys
14:34:52.0291 0x0b30  Null - ok
14:34:52.0337 0x0b30  [ B5E37E31C053BC9950455A257526514B, 16E2880621F3AA12BDADE71CD7682CA79E2A199D3C9E3E5927C49DCEF0F6183B ] NVENETFD        C:\Windows\system32\DRIVERS\nvm62x32.sys
14:34:52.0400 0x0b30  NVENETFD - ok
14:34:53.0024 0x0b30  [ 29043016196A52984E0A7575D6C779A0, CE2A1B826A1C987766E9667BE876E04844259BA932DD72A9CA51DBC6FF8C6533 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
14:34:53.0726 0x0b30  nvlddmkm - ok
14:34:53.0804 0x0b30  [ 0219B05730635FCAB3A9925D3374C464, FD5ED0FAFA1DB8229B3963C29D7AC98684C5F75772AAE05A79D4452237CF7C1D ] NVNET          C:\Windows\system32\DRIVERS\nvmf6232.sys
14:34:53.0851 0x0b30  NVNET - ok
14:34:53.0882 0x0b30  [ B3E25EE28883877076E0E1FF877D02E0, 402B6FED6FBBF645190396DC141141EF52DD059DABD01F8AC9CF01D23664070C ] nvraid          C:\Windows\system32\drivers\nvraid.sys
14:34:53.0913 0x0b30  nvraid - ok
14:34:53.0960 0x0b30  [ 4380E59A170D88C4F1022EFF6719A8A4, 93EDB3F4CDBF53C9C1970DD29AB146E390695C568180847BA8903F5FBEABCFF2 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
14:34:53.0991 0x0b30  nvstor - ok
14:34:54.0053 0x0b30  [ 23D06D9DFE7F3270DBC069A0574BD257, E108509E4C116B20FD904507F383AE764DE053302ABDCA192594C19C48C3EB56 ] nvsvc          C:\Windows\system32\nvvsvc.exe
14:34:54.0116 0x0b30  nvsvc - ok
14:34:54.0225 0x0b30  [ 03E60E0BFA53ED15DC984FA34B44BB0F, 50ABF2E303B9A2B6DDD0DB411C24C3CD6CC30AFA664B5682CF9189F96548CC10 ] nvUpdatusService C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
14:34:54.0319 0x0b30  nvUpdatusService - ok
14:34:54.0334 0x0b30  [ 5A0983915F02BAE73267CC2A041F717D, D83461D74597BF2BE042FEFCC27FCD18BF63CB8135B0666D731D50951C3468A8 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
14:34:54.0365 0x0b30  nv_agp - ok
14:34:54.0397 0x0b30  [ 08A70A1F2CDDE9BB49B885CB817A66EB, 0BB98123B544124B144F3E95D77E01E973D060B8B2302503FF24ABBBE803EB63 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
14:34:54.0428 0x0b30  ohci1394 - ok
14:34:54.0475 0x0b30  [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
14:34:54.0553 0x0b30  p2pimsvc - ok
14:34:54.0599 0x0b30  [ 59C3DDD501E39E006DAC31BF55150D91, E02B63AB7F34CF6FF3F644AF354D10004E6F50014E03172D80BD78934EF71EF1 ] p2psvc          C:\Windows\system32\p2psvc.dll
14:34:54.0662 0x0b30  p2psvc - ok
14:34:54.0709 0x0b30  [ 2EA877ED5DD9713C5AC74E8EA7348D14, 14BA3722CE5F8FF07F2D97DCDD6558EB49C9B02E5E6FAD6D9F18D354733EFECE ] Parport        C:\Windows\system32\DRIVERS\parport.sys
14:34:54.0740 0x0b30  Parport - ok
14:34:54.0771 0x0b30  [ 3F34A1B4C5F6475F320C275E63AFCE9B, 31295D5121C0C3F2085E0EEBA260EEE4CA003993C026E2F81986D19158036E6B ] partmgr        C:\Windows\system32\drivers\partmgr.sys
14:34:54.0802 0x0b30  partmgr - ok
14:34:54.0818 0x0b30  [ EB0A59F29C19B86479D36B35983DAADC, AC09AFE7F13BE4079D01383BAC44091997E1AAF6512C9673A42B9E3780EB08A8 ] Parvdm          C:\Windows\system32\DRIVERS\parvdm.sys
14:34:54.0865 0x0b30  Parvdm - ok
14:34:54.0896 0x0b30  [ 52954BE460EC6C54C0ACB2B3B126FFC6, 9F9878EC5ABC74C5A8EE8E1D940F0934F081895B07D844F42F80A638FE713F7B ] PcaSvc          C:\Windows\System32\pcasvc.dll
14:34:54.0974 0x0b30  PcaSvc - ok
14:34:55.0005 0x0b30  [ 673E55C3498EB970088E812EA820AA8F, 1F81315664B8CBFDD569416C0ECCE4C6251F34577313A0858AB46609781303B5 ] pci            C:\Windows\system32\drivers\pci.sys
14:34:55.0036 0x0b30  pci - ok
14:34:55.0067 0x0b30  [ AFE86F419014DB4E5593F69FFE26CE0A, CAF36E61BE7B511D3A03A65FF5A3017CEE4D2F53005B410F2D4A2AAE9FED4C00 ] pciide          C:\Windows\system32\drivers\pciide.sys
14:34:55.0099 0x0b30  pciide - ok
14:34:55.0145 0x0b30  [ 1BEBE7DE8508A02650CDCE45C664C2A2, 67841EA7F1F6B7F19ABD38A004B23610A21AD5BD5E508EED16CC7856CBE44D9C ] PCLEPCI        C:\Windows\system32\drivers\pclepci.sys
14:34:55.0161 0x0b30  PCLEPCI - detected UnsignedFile.Multi.Generic ( 1 )
14:34:57.0829 0x0b30  Detect skipped due to KSN trusted
14:34:57.0829 0x0b30  PCLEPCI - ok
14:34:57.0860 0x0b30  [ F396431B31693E71E8A80687EF523506, BC614FC21E029E2497F1CCE3131BBD295B827F2310762B47D5BBC7703D80554B ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
14:34:57.0891 0x0b30  pcmcia - ok
14:34:57.0922 0x0b30  [ 250F6B43D2B613172035C6747AEEB19F, A91F15B133F2619912CF750E6F3662E011CD0FA4B9477CE532CE3196D23307D9 ] pcw            C:\Windows\system32\drivers\pcw.sys
14:34:57.0953 0x0b30  pcw - ok
14:34:58.0016 0x0b30  [ AEBC369F7DC72AB3F5B9BDF34FA0D43F, 2A819154AC6C23E97C583D90B4D0C112188B7AE9D8D9B3F88811BFCED124E551 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
14:34:58.0094 0x0b30  PEAUTH - ok
14:34:58.0203 0x0b30  [ 414BBA67A3DED1D28437EB66AEB8A720, D6DF254E2615FA402044824DCD9004F579FC0DF74B90E44C99D5F0253CF8AD88 ] pla            C:\Windows\system32\pla.dll
14:34:58.0359 0x0b30  pla - ok
14:34:58.0406 0x0b30  [ EC7BC28D207DA09E79B3E9FAF8B232CA, A42F8F69C3CD753D787A5D558659DEA2CC306C896D75B8C82549219CF654504F ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
14:34:58.0468 0x0b30  PlugPlay - ok
14:34:58.0484 0x0b30  [ 63FF8572611249931EB16BB8EED6AFC8, 9732CCBCB93A7A4BEC88812B952C20244479E9BD781240C195E57F09E619EA33 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
14:34:58.0532 0x0b30  PNRPAutoReg - ok
14:34:58.0563 0x0b30  [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
14:34:58.0610 0x0b30  PNRPsvc - ok
14:34:58.0656 0x0b30  [ 53946B69BA0836BD95B03759530C81EC, 7F14A34635354CCA0F5342C8D9DF5A6AA1B94F6A508BD8834029E9BACF252920 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
14:34:58.0750 0x0b30  PolicyAgent - ok
14:34:58.0781 0x0b30  [ F87D30E72E03D579A5199CCB3831D6EA, B09328E89954584F97908FA5946376BA990B8C650DABCBF3CA3B08719937C694 ] Power          C:\Windows\system32\umpo.dll
14:34:58.0859 0x0b30  Power - ok
14:34:58.0906 0x0b30  [ 631E3E205AD6D86F2AED6A4A8E69F2DB, 1D3BF0CFC37D91A3A56246920B9CF1084E78A055D56E85A773417809C58C8065 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
14:34:59.0000 0x0b30  PptpMiniport - ok
14:34:59.0015 0x0b30  [ 85B1E3A0C7585BC4AAE6899EC6FCF011, 1E067113C146D6842D7FB04007F363D6FB7783C6BC7C9AB6614E44075C4F86C3 ] Processor      C:\Windows\system32\DRIVERS\processr.sys
14:34:59.0046 0x0b30  Processor - ok
14:34:59.0078 0x0b30  [ FD9692A3D31E021207D3C2A9DDDC2BE3, 5295EFAD9BD4B59996935A41825392C12A4C968D161BEEA37797F90AF8E54229 ] ProfSvc        C:\Windows\system32\profsvc.dll
14:34:59.0140 0x0b30  ProfSvc - ok
14:34:59.0156 0x0b30  [ 1667D76FBF42B24B9DE3E8B0A7CF06BE, AB9FD4F7B007633FEC552D14932CDEB56DBCE56D152C0EDC91FAFD08E636AADC ] ProtectedStorage C:\Windows\system32\lsass.exe
14:34:59.0187 0x0b30  ProtectedStorage - ok
14:34:59.0202 0x0b30  [ 6270CCAE2A86DE6D146529FE55B3246A, 463209CBAF1B0E269DC8FC6FBDEE5BB7E5ADB5D3F024930BFD0B97E0A9678883 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
14:34:59.0280 0x0b30  Psched - ok
14:34:59.0358 0x0b30  [ E42E3433DBB4CFFE8FDD91EAB29AEA8E, 20ABD8372B242FD356AC143E7EB56F93CFEA4988ED1B0C4434CB64C387D7F66C ] PxHelp20        C:\Windows\system32\Drivers\PxHelp20.sys
14:34:59.0390 0x0b30  PxHelp20 - ok
14:34:59.0514 0x0b30  [ AB95ECF1F6659A60DDC166D8315B0751, 0ED6D3460D28978BADF31B930DBB3298A6A10EFF8883763EABA0E36A21A0E83D ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
14:34:59.0639 0x0b30  ql2300 - ok
14:34:59.0670 0x0b30  [ B4DD51DD25182244B86737DC51AF2270, 7E62B04F054A6330B7F9968222523BDE8F3EE47A11D17E6C0E2D5ACDC07B9E6B ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
14:34:59.0702 0x0b30  ql40xx - ok
14:34:59.0733 0x0b30  [ 31AC809E7707EB580B2BDB760390765A, A8481FD19A0F778F5591B7676F591F664ADC68B6867E663C0F9564173F4AC909 ] QWAVE          C:\Windows\system32\qwave.dll
14:34:59.0795 0x0b30  QWAVE - ok
14:34:59.0826 0x0b30  [ 584078CA1B95CA72DF2A27C336F9719D, 836F115C92D343463C14A9DE39648C1EFA7C7EE4720F5C692EE0F68B84830121 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
14:34:59.0873 0x0b30  QWAVEdrv - ok
14:34:59.0920 0x0b30  [ 8F97D374AD1857E1EED85A79F29A1D3D, 4B2D1DBB60C0890E3CB497F534D8DE74952AF8774579B62B0F4ED14912CA583C ] RapiMgr        C:\Windows\WindowsMobile\rapimgr.dll
14:34:59.0951 0x0b30  RapiMgr - ok
14:34:59.0967 0x0b30  [ 30A81B53C766D0133BB86D234E5556AB, 726C6B83B5ACAA84CAB1689B6DD6DDAE3199D61A57B5D7B5B5A0F62FCF838090 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
14:35:00.0045 0x0b30  RasAcd - ok
14:35:00.0092 0x0b30  [ 57EC4AEF73660166074D8F7F31C0D4FD, C66B425EC4DB5E7FD289AE631C9B019EB16717C55E80FAE964BB22203E4AACEF ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
14:35:00.0154 0x0b30  RasAgileVpn - ok
14:35:00.0201 0x0b30  [ A60F1839849C0C00739787FD5EC03F13, B210DFA5A843CF1DA73635F168E2EA5052CBED15C664F8523CDFB34CA165D0E0 ] RasAuto        C:\Windows\System32\rasauto.dll
14:35:00.0263 0x0b30  RasAuto - ok
14:35:00.0294 0x0b30  [ D9F91EAFEC2815365CBE6D167E4E332A, 8350457A39D141C13807E7DB5A8D4113197C4016F7744B9993391F4AEA0C4A5C ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
14:35:00.0357 0x0b30  Rasl2tp - ok
14:35:00.0388 0x0b30  [ CB9E04DC05EACF5B9A36CA276D475006, 4D8C0AEF1D4F84F375AD2BAF786C9F6C52316A3E655B913449E71AD7C0FCA56E ] RasMan          C:\Windows\System32\rasmans.dll
14:35:00.0482 0x0b30  RasMan - ok
14:35:00.0513 0x0b30  [ 0FE8B15916307A6AC12BFB6A63E45507, 64119474DE7499E6E8B82E78BBD50074B3AA70B3E8329089FAE9B7F29919004E ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
14:35:00.0591 0x0b30  RasPppoe - ok
14:35:00.0622 0x0b30  [ 44101F495A83EA6401D886E7FD70096B, 56A0CE5C89870752B9B2AB795C1A248CA28209E049B2F20CCA0308CBE2488A0A ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
14:35:00.0684 0x0b30  RasSstp - ok
14:35:00.0716 0x0b30  [ D528BC58A489409BA40334EBF96A311B, C71E9A4B101DB6C3183B9F97B9098D73D6FE1B12C05C2EB3CE8A8041BEE6BA61 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
14:35:00.0778 0x0b30  rdbss - ok
14:35:00.0825 0x0b30  [ 0D8F05481CB76E70E1DA06EE9F0DA9DF, 2AFCBE3237D27AFBF095F91F1FCCA63E6890F34A9E4F00E5C34C92394CDA89FB ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
14:35:00.0872 0x0b30  rdpbus - ok
14:35:00.0887 0x0b30  [ 23DAE03F29D253AE74C44F99E515F9A1, 8FED93D10B2062F0526FE3508101F8FCF8F72DEB90AFB472EB7CBAE83A0EC430 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
14:35:00.0934 0x0b30  RDPCDD - ok
14:35:00.0965 0x0b30  [ 5A53CA1598DD4156D44196D200C94B8A, 8112FE14FEC94C67B1C5BDE4171E37584F1D0098D2C557C9E4BDD3E0291E25E4 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
14:35:01.0012 0x0b30  RDPENCDD - ok
14:35:01.0028 0x0b30  [ 44B0A53CD4F27D50ED461DAE0C0B4E1F, CDA80B08E67AD034081C0C920CD66147689F1844403CBC552F65005E7C011A91 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
14:35:01.0106 0x0b30  RDPREFMP - ok
14:35:01.0137 0x0b30  [ CD9214A6AE17D188D17C3CF8CB9CC693, 2E16FF1F7446F0600D6519010FD05A30B94D97167C16B3E7FC396A97D8139D60 ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
14:35:01.0184 0x0b30  RDPWD - ok
14:35:01.0230 0x0b30  [ 518395321DC96FE2C9F0E96AC743B656, 5F6A0880B4F3EE7196259EA362DA9554B0687B0236F9A8E5CF7A4A77F01F1776 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
14:35:01.0277 0x0b30  rdyboost - ok
14:35:01.0293 0x0b30  [ 7B5E1419717FAC363A31CC302895217A, 048B96B127CC20833948DAE53C59886D5C725ECA7A744424A01339447D2DDC32 ] RemoteAccess    C:\Windows\System32\mprdim.dll
14:35:01.0371 0x0b30  RemoteAccess - ok
14:35:01.0402 0x0b30  [ CB9A8683F4EF2BF99E123D79950D7935, B9FA3E7E91E76D975CF40BFA37909E50F29CC13AB1399007884710651827E9AA ] RemoteRegistry  C:\Windows\system32\regsvc.dll
14:35:01.0464 0x0b30  RemoteRegistry - ok
14:35:01.0511 0x0b30  [ 564297827D213F52C7A3A2FF749568CA, B09A78D3B3F0BF47818BBEEDEF73BD6ACB9C5E367592BB90C85FD262BE521876 ] ROOTMODEM      C:\Windows\system32\Drivers\RootMdm.sys
14:35:01.0589 0x0b30  ROOTMODEM - ok
14:35:01.0605 0x0b30  [ 78D072F35BC45D9E4E1B61895C152234, 80C924EE1156B4E3172E83DCB9C60817E87885FB9377647E0BF90153E415B1CA ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
14:35:01.0667 0x0b30  RpcEptMapper - ok
14:35:01.0683 0x0b30  [ 94D36C0E44677DD26981D2BFEEF2A29D, D77A93AC60536F3706E8A0154C0C2199E888B7748C84DB7437254FF175F4DF55 ] RpcLocator      C:\Windows\system32\locator.exe
14:35:01.0730 0x0b30  RpcLocator - ok
14:35:01.0776 0x0b30  [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] RpcSs          C:\Windows\system32\rpcss.dll
14:35:01.0854 0x0b30  RpcSs - ok
14:35:01.0901 0x0b30  [ 32222C7492CF9A01C20D29EE1DBEA534, 05488FC21A69118A57CD3E345B71A612AC7815B4E0C2EC712AC7736E83DB1B03 ] RrNetCapFilterDriver C:\Windows\system32\DRIVERS\RrNetCapFilterDriver.sys
14:35:01.0917 0x0b30  RrNetCapFilterDriver - ok
14:35:01.0948 0x0b30  [ 032B0D36AD92B582D869879F5AF5B928, 0F8F18A6A0A689957B886D9368015889091094EDA18BE532093F06A70A7CE184 ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
14:35:02.0010 0x0b30  rspndr - ok
14:35:02.0042 0x0b30  [ 4E20765744BFBC16F6D6E5BD5598786B, CDB5AB7F8BE3C0085D08DC00CC8DB3266ABA16228B2F022380482C9D05070839 ] RTL8023xp      C:\Windows\system32\DRIVERS\Rtnicxp.sys
14:35:02.0073 0x0b30  RTL8023xp - ok
14:35:02.0088 0x0b30  [ 1667D76FBF42B24B9DE3E8B0A7CF06BE, AB9FD4F7B007633FEC552D14932CDEB56DBCE56D152C0EDC91FAFD08E636AADC ] SamSs          C:\Windows\system32\lsass.exe
14:35:02.0120 0x0b30  SamSs - ok
14:35:02.0151 0x0b30  [ 05D860DA1040F111503AC416CCEF2BCA, DAE2F37D09A5A42F945BC8E27E4EA2303521081783A80CEE7FEE7C5A1C2CFC5E ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
14:35:02.0198 0x0b30  sbp2port - ok
14:35:02.0213 0x0b30  [ 8FC518FFE9519C2631D37515A68009C4, 21E10585470CF9FC3BD1977F8A426686CD2FA6BD2094B9E3594B21C7C4541D25 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
14:35:02.0307 0x0b30  SCardSvr - ok
14:35:02.0338 0x0b30  [ 0693B5EC673E34DC147E195779A4DCF6, AF1B56FBF3ADABF94CD9DBA67586B8746DE135151F6B3D1B0EE315BC1E2DB670 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
14:35:02.0385 0x0b30  scfilter - ok
14:35:02.0494 0x0b30  [ A04BB13F8A72F8B6E8B4071723E4E336, E63287FF71C39CBF64C3347C455324C8437F9CF398153E269543588B65389502 ] Schedule        C:\Windows\system32\schedsvc.dll
14:35:02.0603 0x0b30  Schedule - ok
14:35:02.0619 0x0b30  [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] SCPolicySvc    C:\Windows\System32\certprop.dll
14:35:02.0681 0x0b30  SCPolicySvc - ok
14:35:02.0697 0x0b30  [ 08236C4BCE5EDD0A0318A438AF28E0F7, 77727F963F63C4CEC11E7AAD5FB3836179701D512CA9436C3170B9E6A4E5F888 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
14:35:02.0775 0x0b30  SDRSVC - ok
14:35:02.0806 0x0b30  [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
14:35:02.0868 0x0b30  secdrv - ok
14:35:02.0884 0x0b30  [ A59B3A4442C52060CC7A85293AA3546F, 1776D6DEE51991149265AAF39E17065E301C5FA1FF4068653DC0010B9B27185D ] seclogon        C:\Windows\system32\seclogon.dll
14:35:02.0946 0x0b30  seclogon - ok
14:35:02.0962 0x0b30  [ DCB7FCDCC97F87360F75D77425B81737, F8289AF2C458C167038EEFE613EE5E3D6D5B3308B8784168374BC81C47891CE5 ] SENS            C:\Windows\system32\sens.dll
14:35:03.0024 0x0b30  SENS - ok
14:35:03.0056 0x0b30  [ 50087FE1EE447009C9CC2997B90DE53F, B5E6CF1D991F87C29C5E28198E0962E31FFB499A46C3BD43FC20391693389959 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
14:35:03.0102 0x0b30  SensrSvc - ok
14:35:03.0118 0x0b30  [ 9AD8B8B515E3DF6ACD4212EF465DE2D1, E2F019BCD1446236D078D46065DD151DD068778F33BE2F1E8A0CC1EA2F954E86 ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
14:35:03.0149 0x0b30  Serenum - ok
14:35:03.0165 0x0b30  [ 5FB7FCEA0490D821F26F39CC5EA3D1E2, A26DB2EB9F3E2509B4EBA949DB97595CC32332D9321DF68283BFC102E66D766F ] Serial          C:\Windows\system32\DRIVERS\serial.sys
14:35:03.0212 0x0b30  Serial - ok
14:35:03.0243 0x0b30  [ 79BFFB520327FF916A582DFEA17AA813, 7A2A9D69BE02228591186A9F4453D4B5FD98837CA422C873C48040170E8BD18C ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
14:35:03.0290 0x0b30  sermouse - ok
14:35:03.0321 0x0b30  [ 4AE380F39A0032EAB7DD953030B26D28, C8F5F2DD59574E966FDF3057867BB959A554BAB6FD5DC6F1427094A6BC2B2809 ] SessionEnv      C:\Windows\system32\sessenv.dll
14:35:03.0399 0x0b30  SessionEnv - ok
14:35:03.0446 0x0b30  [ 9F976E1EB233DF46FCE808D9DEA3EB9C, 6A5C53F27F8BCA85CE206EE7D196176F67EC6FFA5D4830373A20792C149B5E75 ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
14:35:03.0477 0x0b30  sffdisk - ok
14:35:03.0492 0x0b30  [ 932A68EE27833CFD57C1639D375F2731, 11D6B98FBEEE2B9C7B06EF7091857BBD3B349077997D6261D66280668FD1B5C3 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
14:35:03.0524 0x0b30  sffp_mmc - ok
14:35:03.0524 0x0b30  [ 6D4CCAEDC018F1CF52866BBBAA235982, AAC41F5C97B3FE5A3DC0838457EB8CC9BB71FCA16D3EDBB67D603F0A9D46C131 ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
14:35:03.0570 0x0b30  sffp_sd - ok
14:35:03.0617 0x0b30  [ DB96666CC8312EBC45032F30B007A547, C3AE60FC65A36E96E0D2CC6E184481D70F91A19DC3E2E17E2873DD670A592DD7 ] sfloppy        C:\Windows\system32\DRIVERS\sfloppy.sys
14:35:03.0664 0x0b30  sfloppy - ok
14:35:03.0711 0x0b30  [ D1A079A0DE2EA524513B6930C24527A2, E2BC16DBCF38841EECD49C6FA1A9AC89C17F332F12606CA826F058E995E1B83D ] SharedAccess    C:\Windows\System32\ipnathlp.dll
14:35:03.0789 0x0b30  SharedAccess - ok
14:35:03.0820 0x0b30  [ 414DA952A35BF5D50192E28263B40577, 9C9BAFB9880DA6CC728506A142BE124E186219610DCC3460657A3CA93C865DF1 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
14:35:03.0898 0x0b30  ShellHWDetection - ok
14:35:03.0929 0x0b30  [ 2565CAC0DC9FE0371BDCE60832582B2E, 1A775214E86B83C2F1799F12D71077D81C89AD32734A248BA88787B7F104B79D ] sisagp          C:\Windows\system32\drivers\sisagp.sys
14:35:03.0960 0x0b30  sisagp - ok
14:35:03.0992 0x0b30  [ A9F0486851BECB6DDA1D89D381E71055, 7E909538AB758C18AC2CCBFFEE17BA36FA6ED2E674AA70924AA87AC61375FF35 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
14:35:04.0023 0x0b30  SiSRaid2 - ok
14:35:04.0038 0x0b30  [ 3727097B55738E2F554972C3BE5BC1AA, 75D52A596A298C33EC79A3B0B80F25492C08A182ABC679401502DA9597687566 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
14:35:04.0070 0x0b30  SiSRaid4 - ok
14:35:04.0116 0x0b30  [ 3E21C083B8A01CB70BA1F09303010FCE, 803F8F91299C387110F34A49340E7136AAE91B418E2977A36285EA8F432FF197 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
14:35:04.0179 0x0b30  Smb - ok
14:35:04.0226 0x0b30  [ 85BADA660D57BC5AEF52B11CABD6D8F9, D73A211C51AF28C4C2C5973E8C42B7B4F70DF72E2E8B3AF5D63321ADD42CB0CE ] snapman        C:\Windows\system32\DRIVERS\snapman.sys
14:35:04.0257 0x0b30  snapman - ok
14:35:04.0272 0x0b30  [ 6A984831644ECA1A33FFEAE4126F4F37, 753E23D2B33D47C52C05D892B052CFD96D93B97FB6E9FCB58EF1E4C4A125BF78 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
14:35:04.0319 0x0b30  SNMPTRAP - ok
14:35:04.0319 0x0b30  [ 95CF1AE7527FB70F7816563CBC09D942, CE8BACB91A5A86CBCE82619C6C1873B4D7593B00CED3B522E41B8F7F6258CC65 ] spldr          C:\Windows\system32\drivers\spldr.sys
14:35:04.0350 0x0b30  spldr - ok
14:35:04.0397 0x0b30  [ 9AEA093B8F9C37CF45538382CABA2475, CC63239C412067AA72318ADB8BB80BCDF2CA60DA05D814D32753C92508BC16A8 ] Spooler        C:\Windows\System32\spoolsv.exe
14:35:04.0444 0x0b30  Spooler - ok
14:35:04.0647 0x0b30  [ CF87A1DE791347E75B98885214CED2B8, 7AF4E03D751C951A4E5FBA28200DABFE6B3BF055490163EEEEA84EBA4D0F368A ] sppsvc          C:\Windows\system32\sppsvc.exe
14:35:04.0912 0x0b30  sppsvc - ok
14:35:04.0959 0x0b30  [ B0180B20B065D89232A78A40FE56EAA6, 4D045B23AD58A8822BE9F20119744A8D47455469D54494745CEB099951DA60FF ] sppuinotify    C:\Windows\system32\sppuinotify.dll
14:35:05.0006 0x0b30  sppuinotify - ok
14:35:05.0052 0x0b30  [ E4C2764065D66EA1D2D3EBC28FE99C46, 043AEF06A23069DD17675955C834690A5FD8F1948A05B3969F977E823C4E25F5 ] srv            C:\Windows\system32\DRIVERS\srv.sys
14:35:05.0130 0x0b30  srv - ok
14:35:05.0162 0x0b30  [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB, 4DF31206DF8F33C2975E23C7257ED930C4EDA8BC4E246D8FDA130BB583083ED0 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
14:35:05.0208 0x0b30  srv2 - ok
14:35:05.0224 0x0b30  [ BE6BD660CAA6F291AE06A718A4FA8ABC, CD38939CFBA80B882D38099194FC1EBAE15A9D27A4D941DD03C55EC745E52E59 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
14:35:05.0271 0x0b30  srvnet - ok
14:35:05.0302 0x0b30  [ D887C9FD02AC9FA880F6E5027A43E118, F38BAD90EC791368C37C21090302708D2DFB83ECE9096609AD9AA667B2E5592E ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
14:35:05.0380 0x0b30  SSDPSRV - ok
14:35:05.0380 0x0b30  [ D318F23BE45D5E3A107469EB64815B50, D74355E6FF215AA8CE53BC9DF16AF2740F2FC2FD754939478A3608BDA8C6DDA0 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
14:35:05.0442 0x0b30  SstpSvc - ok
14:35:05.0474 0x0b30  StarOpen - ok
14:35:05.0505 0x0b30  [ DB32D325C192B801DF274BFD12A7E72B, F089DBA719E22BC269720A6B840B873A4AF5639745DB0C3DBC8BD2F2839A1ABA ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
14:35:05.0536 0x0b30  stexstor - ok
14:35:05.0583 0x0b30  [ E1FB3706030FB4578A0D72C2FC3689E4, A62EC9AA4514CAF2A10C0A3AEF7A36F593A7E7DA370A3F130C24E1B612E19427 ] StiSvc          C:\Windows\System32\wiaservc.dll
14:35:05.0661 0x0b30  StiSvc - ok
14:35:05.0692 0x0b30  [ E58C78A848ADD9610A4DB6D214AF5224, 1575A90EB22A4FB066459BDA00C6CAC10198C3C8C74493721EC6D34B51F50426 ] swenum          C:\Windows\system32\drivers\swenum.sys
14:35:05.0723 0x0b30  swenum - ok
14:35:05.0770 0x0b30  [ A28BD92DF340E57B024BA433165D34D7, 889CC7FF143C3549982128473FF927CD80CF36485A347EF399C1271C8CE12CE4 ] swprv          C:\Windows\System32\swprv.dll
14:35:05.0848 0x0b30  swprv - ok
14:35:05.0926 0x0b30  [ 36650D618CA34C9D357DFD3D89B2C56F, 7C3774E53DCF32CB3A4B3504E32D2A651E18467FA0A6AC4C7993C696741B704B ] SysMain        C:\Windows\system32\sysmain.dll
14:35:06.0035 0x0b30  SysMain - ok
14:35:06.0066 0x0b30  [ 763FECDC3D30C815FE72DD57936C6CD1, 1A62C7E63E426D56894F4121C75D9C60FC9A14469ADBD0D6F0B94B8DE48CDA3E ] TabletInputService C:\Windows\System32\TabSvc.dll
14:35:06.0129 0x0b30  TabletInputService - ok
14:35:06.0176 0x0b30  [ 613BF4820361543956909043A265C6AC, FCFF02E466D2501630B452627FB218C01E5245A0921EE3D2117E7FD63AC7E98E ] TapiSrv        C:\Windows\System32\tapisrv.dll
14:35:06.0254 0x0b30  TapiSrv - ok
14:35:06.0363 0x0b30  [ 4780C35A37DE77E0248C6C7AD99DA267, E78C0DEFBC3D6EB8F3A140F81E72371C761D6C5998ABB87C526338D9E88D6492 ] tbhsd          C:\Windows\system32\drivers\tbhsd.sys
14:35:06.0441 0x0b30  tbhsd - ok
14:35:06.0488 0x0b30  [ B799D9FDB26111737F58288D8DC172D9, 409A60819A4305699E2E492A6190637FAAEBD19E745A5DB2A5D6977106C86591 ] TBS            C:\Windows\System32\tbssvc.dll
14:35:06.0550 0x0b30  TBS - ok
14:35:06.0722 0x0b30  [ 5579DD18546999F5D0EC39D018726C6B, 82432BACEE75C34F21222D9CC1607223C2940947118A63DB239777A4B1442AD3 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
14:35:06.0846 0x0b30  Tcpip - ok
14:35:06.0909 0x0b30  [ 5579DD18546999F5D0EC39D018726C6B, 82432BACEE75C34F21222D9CC1607223C2940947118A63DB239777A4B1442AD3 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
14:35:07.0018 0x0b30  TCPIP6 - ok
14:35:07.0049 0x0b30  [ 3EEBD3BD93DA46A26E89893C7AB2FF3B, 2C7204DCD2BCBC6A250FF0F6477616F327AF41FDB7CABE69E5C357361009FB4E ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
14:35:07.0096 0x0b30  tcpipreg - ok
14:35:07.0127 0x0b30  [ 1CB91B2BD8F6DD367DFC2EF26FD751B2, 879E2827354BB21573AC6A7CCEB746D44214540687E6882FFCB4089546FBD954 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
14:35:07.0158 0x0b30  TDPIPE - ok
14:35:07.0252 0x0b30  [ 431801FCC97034E04A6EFF81136578D7, E061662D21FBECAEFDE939727E5892A8ED41C58C4D8738C2447777FB123FA2C3 ] tdrpman273      C:\Windows\system32\DRIVERS\tdrpm273.sys
14:35:07.0330 0x0b30  tdrpman273 - ok
14:35:07.0346 0x0b30  [ 2C2C5AFE7EE4F620D69C23C0617651A8, E828D974C3F9D7004A030C3AD448096C736FDB4C4C1707D043E567D08C845103 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
14:35:07.0377 0x0b30  TDTCP - ok
14:35:07.0424 0x0b30  [ 7FE680A3DFA421C4A8E4879AE4C5AAB0, A4C64E155AB2843823CD3586756BA7681CFDEA50812095468221503BBAD30DCD ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
14:35:07.0470 0x0b30  tdx - ok
14:35:07.0704 0x0b30  [ 2BBB318EA9F34FDC508CEA4AAB98D770, AA98BDB7677A452E38DB207E09A522C558F9E09DE43A57D24CD776C6248CC015 ] TeamViewer7    C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
14:35:07.0892 0x0b30  TeamViewer7 - ok
14:35:07.0907 0x0b30  [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20, 0D81B427720637882077C5024D738191F858FC734ED040697872D906351EF663 ] TermDD          C:\Windows\system32\drivers\termdd.sys
14:35:07.0938 0x0b30  TermDD - ok
14:35:08.0001 0x0b30  [ FCFD4F50419B4BC72E80066DA10D2E54, 7C2314A57A404525F0444986332DBAE0964A3359374671598387051D7AAE72AE ] TermService    C:\Windows\System32\termsrv.dll
14:35:08.0063 0x0b30  TermService - ok
14:35:08.0094 0x0b30  [ 42FB6AFD6B79D9FE07381609172E7CA4, B57C85091209A2FAD19ED490B8FA7FC98F12911F9C9CACE9AF1E540780CE6700 ] Themes          C:\Windows\system32\themeservice.dll
14:35:08.0157 0x0b30  Themes - ok
14:35:08.0188 0x0b30  [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] THREADORDER    C:\Windows\system32\mmcss.dll
14:35:08.0250 0x0b30  THREADORDER - ok
14:35:08.0282 0x0b30  [ 8492B85509BA539B24218F6D0FBCCD21, 050C27EC56BE94964C8BFAB37BBEE1306B3F76A398FDF1E7A73ECFD8FC7D6A84 ] tifsfilter      C:\Windows\system32\DRIVERS\tifsfilt.sys
14:35:08.0297 0x0b30  tifsfilter - detected UnsignedFile.Multi.Generic ( 1 )
14:35:18.0312 0x0b30  tifsfilter ( UnsignedFile.Multi.Generic ) - warning
14:35:22.0992 0x0b30  [ 3E06987FEDBCDFBFF8E85EF8108565F9, 63A06B73FA729F1609822EF08DF288FE91F0CA5295F73706C83B812476A7EF96 ] timounter      C:\Windows\system32\DRIVERS\timntr.sys
14:35:23.0055 0x0b30  timounter - ok
14:35:23.0070 0x0b30  [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A, 532A3A812578B2DFD83001DE66FC73689D79EC729409EB572E07E6D65B281712 ] TrkWks          C:\Windows\System32\trkwks.dll
14:35:23.0148 0x0b30  TrkWks - ok
14:35:23.0195 0x0b30  [ 2C49B175AEE1D4364B91B531417FE583, 6C7995E18F84E465C376D1D5F153C15ACB66CDEA86EE5BF186677F572E7E129B ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
14:35:23.0258 0x0b30  TrustedInstaller - ok
14:35:23.0289 0x0b30  [ 6C5139E4283249518F7743D7043775B3, 58684E8C90EBAC65459A97C905CDCFE3A915CFF7E8E96071DE1AC3489F85E67F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
14:35:23.0351 0x0b30  tssecsrv - ok
14:35:23.0382 0x0b30  [ FD1D6C73E6333BE727CBCC6054247654, 6F7B9AE1A5986204DB3348D13B303F30FC17624939DA74D6BD114FAEED0FB30E ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
14:35:23.0429 0x0b30  TsUsbFlt - ok
14:35:23.0460 0x0b30  [ B2FA25D9B17A68BB93D58B0556E8C90D, 0146931B733CAB1CD87F94C35F97E110D6ED6C55EAFF03345400A29AEDE99BDE ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
14:35:23.0523 0x0b30  tunnel - ok
14:35:23.0538 0x0b30  [ 750FBCB269F4D7DD2E420C56B795DB6D, E1A95C59148FE463539C34336FD0E74B31A33B8AB2B8E34AA10349C3347471D7 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
14:35:23.0570 0x0b30  uagp35 - ok
14:35:23.0601 0x0b30  [ EE43346C7E4B5E63E54F927BABBB32FF, BAD6FC3BEE45E644D5A6A0A31428F5B2AEC72A0AA0C74EF8177B1FE23EEF3AA9 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
14:35:23.0679 0x0b30  udfs - ok
14:35:23.0710 0x0b30  [ 8344FD4FCE927880AA1AA7681D4927E5, 1B54EFA60A221E2B9FFE59BB41C7E7D8B5AC6826F1C5577456D81371D464255A ] UI0Detect      C:\Windows\system32\UI0Detect.exe
14:35:23.0741 0x0b30  UI0Detect - ok
14:35:23.0788 0x0b30  [ 44E8048ACE47BEFBFDC2E9BE4CBC8880, 5D96D90FDF68AE470CC92CA9DF9DA2C05A53EF455A5A109DBBF7C96F3238257C ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
14:35:23.0819 0x0b30  uliagpkx - ok
14:35:23.0850 0x0b30  [ D295BED4B898F0FD999FCFA9B32B071B, D4130DB4AE76EE6DC0B8E7A4FEF5CB8B26EBD822C21021F6FA78FD29C1E211C2 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
14:35:23.0882 0x0b30  umbus - ok
14:35:23.0897 0x0b30  [ 7550AD0C6998BA1CB4843E920EE0FEAC, 24C001E422C3B3B920CDCF6003A3179CE464DE4284775403DD5122EF9780460D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
14:35:23.0944 0x0b30  UmPass - ok
14:35:23.0975 0x0b30  [ 833FBB672460EFCE8011D262175FAD33, C0C3067A305993CBF056C229771CB0593DD60C9C7AC5130FF1CA610BCA812AB5 ] upnphost        C:\Windows\System32\upnphost.dll
14:35:24.0069 0x0b30  upnphost - ok
14:35:24.0116 0x0b30  [ EC1C23779BB41A8B2AB2AA6FCE308BDE, D027A2B472CAE97AECB16F69BE52E06CB61E1C61AE196C22662050B711C1C72D ] USBAAPL        C:\Windows\system32\Drivers\usbaapl.sys
14:35:24.0178 0x0b30  USBAAPL - ok
14:35:24.0209 0x0b30  [ A1977C315BF5691DA99235AA4A6907AF, 34B52FBA83F0E1C6B001D0AD1808B00152F731D18AAECC3C53B9918AA89BACEC ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
14:35:24.0272 0x0b30  usbaudio - ok
14:35:24.0303 0x0b30  [ 0803FBA9FE829D61AE26EC0BCC910C46, 30D00E2C7DFC630C99C1599587D4F9C272BC30D444E07C961AA05BF84587806B ] usbccgp        C:\Windows\system32\drivers\usbccgp.sys
14:35:24.0365 0x0b30  usbccgp - ok
14:35:24.0412 0x0b30  [ 2352AB5F9F8F097BF9D41D5A4718A041, 25BC7828C625B9B2A5110C25B230C5828CEC18EC97ECF9EC4745E8930CBF472C ] usbcir          C:\Windows\system32\drivers\usbcir.sys
14:35:24.0459 0x0b30  usbcir - ok
14:35:24.0490 0x0b30  [ D40855F89B69305140BBD7E9A3BA2DA6, 745DC6D770666F6B19C2B6AA89C21D1A314732E291453BFA2367F9AF86F97C3C ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
14:35:24.0521 0x0b30  usbehci - ok
14:35:24.0552 0x0b30  [ EDF2DF71C4F1E13A6AC75F5224DE655A, 1764D155C6B99201774B57195349304259232A12868ECFC2069CA49443EBDC2C ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
14:35:24.0615 0x0b30  usbhub - ok
14:35:24.0630 0x0b30  [ 9828C8D14CC2676421778F0DE638CF97, 479A28211FFB85190A01FAB0283B927588805D2C0CDB03F85F8F814B88E4F453 ] usbohci        C:\Windows\system32\DRIVERS\usbohci.sys
14:35:24.0662 0x0b30  usbohci - ok
14:35:24.0693 0x0b30  [ 797D862FE0875E75C7CC4C1AD7B30252, 1BBE745E4C85F8911076F6032ACD7A35FAC048D3CB1500C64E08D8B2C70A1069 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
14:35:24.0724 0x0b30  usbprint - ok
14:35:24.0740 0x0b30  [ FC6B21DB4B5B398AB93DBE59CBF11036, A94094C208F376405C07822A6143001EF1B12AE93205CD8002E87F6EB45F6374 ] usbscan        C:\Windows\system32\drivers\usbscan.sys
14:35:24.0786 0x0b30  usbscan - ok
14:35:24.0802 0x0b30  [ 007C0C8D5B01D82ACEB70431D15083F6, 7EAF68CD3C38D3CD2CDFEE9ECE1DFB38E274F1F9E6F70B73BCE1336E87D5496C ] usbser          C:\Windows\system32\DRIVERS\usbser.sys
14:35:24.0849 0x0b30  usbser - ok
14:35:24.0864 0x0b30  [ F991AB9CC6B908DB552166768176896A, AD8E7A16B23B244B7F834622D4E38B5844193C6E31EF96F61E0E2EA16C945026 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
14:35:24.0911 0x0b30  USBSTOR - ok
14:35:24.0942 0x0b30  [ 800AABFD625EEFF899F7E5496BDE37AB, 3EB7ED07760CB348FCA9A06C2B838EF79B51A83C5F70A9C9EAAEAE54480067E2 ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
14:35:24.0958 0x0b30  usbuhci - ok
14:35:24.0989 0x0b30  [ AF77716205C97E902E6C5B78DECE2CCA, ED99EABED1C7F323EE2A76413E2B260F8EE1D76FDF1E60EE35136D060E756735 ] usb_rndisx      C:\Windows\system32\DRIVERS\usb8023x.sys
14:35:25.0067 0x0b30  usb_rndisx - ok
14:35:25.0083 0x0b30  [ 081E6E1C91AEC36758902A9F727CD23C, 9FDAA17A3B99067E035E5D76305427F15FFDBC5D304B2BB78AFC6463EDDE1A75 ] UxSms          C:\Windows\System32\uxsms.dll
14:35:25.0161 0x0b30  UxSms - ok
14:35:25.0192 0x0b30  [ 1667D76FBF42B24B9DE3E8B0A7CF06BE, AB9FD4F7B007633FEC552D14932CDEB56DBCE56D152C0EDC91FAFD08E636AADC ] VaultSvc        C:\Windows\system32\lsass.exe
14:35:25.0223 0x0b30  VaultSvc - ok
14:35:25.0254 0x0b30  [ A059C4C3EDB09E07D21A8E5C0AABD3CB, BDD3729B49DF2E2FC72FFEF9D10235B481A671DE5A721B6B9A80873B7A343F07 ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
14:35:25.0286 0x0b30  vdrvroot - ok
14:35:25.0332 0x0b30  [ C3CD30495687C2A2F66A65CA6FD89BE9, 582E4706C1D6A151020D14B26C7BF166F4E42BDD6E410F30EC452469270C5E9B ] vds            C:\Windows\System32\vds.exe
14:35:25.0520 0x0b30  vds - ok
14:35:25.0676 0x0b30  [ 17C408214EA61696CEC9C66E388B14F3, 829C0416672E2B2DFABCFE641E7F281F41E8DBB3C0EF11C7784CB9BB94F87E97 ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
14:35:25.0754 0x0b30  vga - ok
14:35:25.0769 0x0b30  [ 8E38096AD5C8570A6F1570A61E251561, 4DBA3C1397A2203548F45F006E66D99F837903F601ABBCE2304754F783CA8A39 ] VgaSave        C:\Windows\System32\drivers\vga.sys
14:35:25.0832 0x0b30  VgaSave - ok
14:35:25.0847 0x0b30  [ 5461686CCA2FDA57B024547733AB42E3, 2721D0659AA890172FCAD4EC4D926B58ACD0EE4887DA51545DC7237420D5BF84 ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
14:35:25.0878 0x0b30  vhdmp - ok
14:35:25.0910 0x0b30  [ C829317A37B4BEA8F39735D4B076E923, 55D1796AE750071E1E05BD7702B6C355CCFFE27B4C00E93E7044C3184732B497 ] viaagp          C:\Windows\system32\drivers\viaagp.sys
14:35:25.0956 0x0b30  viaagp - ok
14:35:25.0956 0x0b30  [ E02F079A6AA107F06B16549C6E5C7B74, B530DCE3EE4F285B3D5F69F7148D17E016D54F04E6F93706B829A34567748788 ] ViaC7          C:\Windows\system32\DRIVERS\viac7.sys
14:35:26.0003 0x0b30  ViaC7 - ok
14:35:26.0034 0x0b30  [ E43574F6A56A0EE11809B48C09E4FD3C, 3687BF638E21C00E62ABFED70D728B91ADA08F7164CA898E654F31DA196589E9 ] viaide          C:\Windows\system32\drivers\viaide.sys
14:35:26.0066 0x0b30  viaide - ok
14:35:26.0066 0x0b30  [ 4C63E00F2F4B5F86AB48A58CD990F212, 9796BD4B9CFEEEAF57C5E332A732EFC2770B21F9B35301A5D202F5FC52C1E035 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
14:35:26.0097 0x0b30  volmgr - ok
14:35:26.0128 0x0b30  [ B5BB72067DDDDBBFB04B2F89FF8C3C87, 65B9AD55F43940A5FDD88B6EC5034A7E375DF8E6F5F1AE6519A4BD6B7E992EBC ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
14:35:26.0175 0x0b30  volmgrx - ok
14:35:26.0190 0x0b30  [ F497F67932C6FA693D7DE2780631CFE7, DAE544ED99D2CF570DA31343BD87D2F856D0D13529656D38E1BF854C77F017F6 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
14:35:26.0237 0x0b30  volsnap - ok
14:35:26.0268 0x0b30  [ 9DFA0CC2F8855A04816729651175B631, 37FD9E43A2A3F125E94A315FB4CD8A1B5499A5FD74806EB2D1E5DA88C070D3A3 ] vsmraid        C:\Windows\system32\DRIVERS\vsmraid.sys
14:35:26.0315 0x0b30  vsmraid - ok
14:35:26.0378 0x0b30  [ 209A3B1901B83AEB8527ED211CCE9E4C, 1A431F6409F8E0531F600F8F988ECECECB902DA26BBAAF1DE74A5CAC29A7CB44 ] VSS            C:\Windows\system32\vssvc.exe
14:35:26.0518 0x0b30  VSS - ok
14:35:26.0549 0x0b30  [ 90567B1E658001E79D7C8BBD3DDE5AA6, EFC23BEEA7F54A2DC56CB523DAD1AF0358D904C5278BF08873910E2DB3F13557 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
14:35:26.0580 0x0b30  vwifibus - ok
14:35:26.0612 0x0b30  [ 55187FD710E27D5095D10A472C8BAF1C, AE298E2D3BA366BCBDC092C717214C181E8843FA564A6DFB07FC3238A5A68DC3 ] W32Time        C:\Windows\system32\w32time.dll
14:35:26.0690 0x0b30  W32Time - ok
14:35:26.0721 0x0b30  [ DE3721E89C653AA281428C8A69745D90, 501C78056ED4295625D8A5412025FD2F0CA24077044D3A5800BA79DF3D946516 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
14:35:26.0752 0x0b30  WacomPen - ok
14:35:26.0783 0x0b30  [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
14:35:26.0846 0x0b30  WANARP - ok
14:35:26.0846 0x0b30  [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
14:35:26.0908 0x0b30  Wanarpv6 - ok
14:35:27.0002 0x0b30  [ 691E3285E53DCA558E1A84667F13E15A, 12EDB66EF8FC100402BEA221F354D3BD5542F6DDF715B6E7D873D6BAE7E3D329 ] wbengine        C:\Windows\system32\wbengine.exe
14:35:27.0142 0x0b30  wbengine - ok
14:35:27.0173 0x0b30  [ 9614B5D29DC76AC3C29F6D2D3AA70E67, A2FFB92F0030B4CD771E862DA575ECCF2F3A5B4B85858C1241A0C59262C0EC88 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
14:35:27.0236 0x0b30  WbioSrvc - ok
14:35:27.0298 0x0b30  [ 59E19BD13C3BDB857646B9E436BA27F7, CC84C607E15F5F29D93510387D5486BAF320BDAF79026A0BECE0D242F7B1DF3E ] WcesComm        C:\Windows\WindowsMobile\wcescomm.dll
14:35:27.0345 0x0b30  WcesComm - ok
14:35:27.0376 0x0b30  [ 34EEE0DFAADB4F691D6D5308A51315DC, A040A03E25A0C78B9E26F86C2DF95BCAF8E7EC90183CEB295615D3265350EBEE ] wcncsvc        C:\Windows\System32\wcncsvc.dll
14:35:27.0423 0x0b30  wcncsvc - ok
14:35:27.0438 0x0b30  [ 5D930B6357A6D2AF4D7653BDABBF352F, 677FF2ED14EE0B0CAA710DA81556CC16D5971DAB10E7C7432D167A87CA6F0EAA ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
14:35:27.0516 0x0b30  WcsPlugInService - ok
14:35:27.0548 0x0b30  [ 1112A9BADACB47B7C0BB0392E3158DFF, 1AE2AFA125973571F91E6945FE8A735F63D76EBB250A0075D98C580167FD9ED4 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
14:35:27.0579 0x0b30  Wd - ok
14:35:27.0626 0x0b30  [ 25944D2CC49E0A6C581D02A74B7D6645, AF8FFAFEC07F1A6A3D4008E609E8E1D705A8DFCC7995C766E3946887203F7BEE ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
14:35:27.0688 0x0b30  Wdf01000 - ok
14:35:27.0719 0x0b30  [ DDE994E9159497D0D5AB2CDF66D1EAD6, 49BEDECA469C47E7622542D3B9BCD31ECDDAA27838495EC5C2F1338E33FEA877 ] WdiServiceHost  C:\Windows\system32\wdi.dll
14:35:27.0782 0x0b30  WdiServiceHost - ok
14:35:27.0797 0x0b30  [ DDE994E9159497D0D5AB2CDF66D1EAD6, 49BEDECA469C47E7622542D3B9BCD31ECDDAA27838495EC5C2F1338E33FEA877 ] WdiSystemHost  C:\Windows\system32\wdi.dll
14:35:27.0828 0x0b30  WdiSystemHost - ok
14:35:27.0875 0x0b30  [ 75E8EBD7040CE238684333F97014762A, 2CA0B267FBAEB303D1F8B639D733DC0DE17BA1276CC9096035B4F2BBBED3EF7F ] WebClient      C:\Windows\System32\webclnt.dll
14:35:27.0953 0x0b30  WebClient - ok
14:35:28.0000 0x0b30  [ 760F0AFE937A77CFF27153206534F275, A53940BA28854486FF18F16B98A3314B36322B0B6EFB54D08B921315BEB0ADD5 ] Wecsvc          C:\Windows\system32\wecsvc.dll
14:35:28.0062 0x0b30  Wecsvc - ok
14:35:28.0078 0x0b30  [ AC804569BB2364FB6017370258A4091B, 1856F354146A5946F3E7D0DD09726FC8A3502B0F0776FEADDF10669C81CC28E2 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
14:35:28.0140 0x0b30  wercplsupport - ok
14:35:28.0156 0x0b30  [ 08E420D873E4FD85241EE2421B02C4A4, E1E9436EB096FF7DE9A76DA6217035257EF9FC7565DDB9016DCA3859E7F1EF0F ] WerSvc          C:\Windows\System32\WerSvc.dll
14:35:28.0218 0x0b30  WerSvc - ok
14:35:28.0265 0x0b30  [ 8B9A943F3B53861F2BFAF6C186168F79, 88E2F79F32AFBA17CB8377A508B83A1EC2315E9F3A365F591C87FE4525AA6713 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
14:35:28.0328 0x0b30  WfpLwf - ok
14:35:28.0359 0x0b30  [ 5CF95B35E59E2A38023836FFF31BE64C, CEA21302B3E855EE592810D4E0DE10E47A47A393064C435463CD54598735CD8D ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
14:35:28.0390 0x0b30  WIMMount - ok
14:35:28.0468 0x0b30  [ 082CF481F659FAE0DE51AD060881EB47, BB67D2AF0BB9192D4CCF66C23D80CE5A1B38715556D94E2561DBF8F805FA30A5 ] WinDefend      C:\Program Files\Windows Defender\mpsvc.dll
14:35:28.0562 0x0b30  WinDefend - ok
14:35:28.0608 0x0b30  WinHttpAutoProxySvc - ok
14:35:28.0671 0x0b30  [ F62E510B6AD4C21EB9FE8668ED251826, FA3E5CAC3E67E49377320CFBE4646585E6B62168292768FEA81E4623F9166890 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
14:35:28.0733 0x0b30  Winmgmt - ok
14:35:28.0827 0x0b30  [ 1DE9BD23AFA36150586C732D876D9B74, 32CF2C8EC18CFDA677AB72A182EB4B839DCC72BFCD6CA309BE2F434991CAE973 ] WinRM          C:\Windows\system32\WsmSvc.dll
14:35:28.0967 0x0b30  WinRM - ok
14:35:29.0030 0x0b30  [ A67E5F9A400F3BD1BE3D80613B45F708, E170A8BD31A779403DC9C43ED6483DA8E186512D3EE700B87F6BA292E284E367 ] WINUSB          C:\Windows\system32\drivers\WinUsb.sys
14:35:29.0076 0x0b30  WINUSB - ok
14:35:29.0139 0x0b30  [ 16935C98FF639D185086A3529B1F2067, E9C6B73A572A04FCE9B1B0E6815F941B10332D9A6D55B92927C2B1275F119091 ] Wlansvc        C:\Windows\System32\wlansvc.dll
14:35:29.0248 0x0b30  Wlansvc - ok
14:35:29.0404 0x0b30  [ 5E7C103F8475C4289847D15E129C20F7, C6325D3557545FA1DA26B0B1EA9A1C95AED1FA84A93BE29A771DAD9ECB00768B ] wlidsvc        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
14:35:29.0529 0x0b30  wlidsvc - ok
14:35:29.0560 0x0b30  [ 0217679B8FCA58714C3BF2726D2CA84E, 4494984B922DCF24D37BCD0E6831CEBD07D1CA49235D04E821D17ED3DF84ED2A ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
14:35:29.0607 0x0b30  WmiAcpi - ok
14:35:29.0654 0x0b30  [ 6EB6B66517B048D87DC1856DDF1F4C3F, EBB534C4829477C70062ADBB5626236B02FE563A544C53FA255E79F3CA170FE8 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
14:35:29.0685 0x0b30  wmiApSrv - ok
14:35:29.0794 0x0b30  [ 3B40D3A61AA8C21B88AE57C58AB3122E, 6C67DCB007C3CDF2EB0BBF5FD89C32CD7800C20F7166872F8C387BE262C5CD21 ] WMPNetworkSvc  C:\Program Files\Windows Media Player\wmpnetwk.exe
14:35:29.0903 0x0b30  WMPNetworkSvc - ok
14:35:29.0981 0x0b30  [ 495284CF894336E9512ED7C9ACB3548E, 55D05E94B96F67C50662C4695267CB18994112D086CAED2E493469C7F133F2BE ] WOTUpdater      C:\Users\Ernst\AppData\LocalLow\WOT\IE\WOTUpdater.exe
14:35:29.0997 0x0b30  WOTUpdater - detected UnsignedFile.Multi.Generic ( 1 )
14:35:32.0633 0x0b30  Detect skipped due to KSN trusted
14:35:32.0633 0x0b30  WOTUpdater - ok
14:35:32.0664 0x0b30  [ A2F0EC770A92F2B3F9DE6D518E11409C, 6838F2148B11285E00DC449D51F8AD85AAE57694E89BA2C607B87AC1C650D845 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
14:35:32.0742 0x0b30  WPCSvc - ok
14:35:32.0774 0x0b30  [ AA53356D60AF47EACC85BC617A4F3F66, 155CB8112AA382D841C1891750FF29EF4F1BF716CD9CDF0F2243209E2CCCAC98 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
14:35:32.0820 0x0b30  WPDBusEnum - ok
14:35:32.0852 0x0b30  [ 6DB3276587B853BF886B69528FDB048C, 9972FF6DF0DF6F86D1E9BCEF4C29064748B217DA196B0633C30D3D580144951C ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
14:35:32.0898 0x0b30  ws2ifsl - ok
14:35:32.0914 0x0b30  [ 6F5D49EFE0E7164E03AE773A3FE25340, 15B6AFF7455538189A96F8863CC995A271E02C6FBDAC15B037D44DDA65E61339 ] wscsvc          C:\Windows\system32\wscsvc.dll
14:35:32.0976 0x0b30  wscsvc - ok
14:35:32.0976 0x0b30  WSearch - ok
14:35:33.0132 0x0b30  [ 7E5C454A3F986FEBAD075DB8D915917E, 9E9147DDACD075958689523130DB92FC4ED0E38433461D8AB8792BCFBD9376DA ] wuauserv        C:\Windows\system32\wuaueng.dll
14:35:33.0288 0x0b30  wuauserv - ok
14:35:33.0335 0x0b30  [ 06E6F32C8D0A3F66D956F57B43A2E070, 9A6BD96A28294B0372F16E13D652FD603308F64B74A56E41E0C68C5E8011F943 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
14:35:33.0366 0x0b30  WudfPf - ok
14:35:33.0413 0x0b30  [ 867C301E8B790040AE9CF6486E8041DF, D867D6498C987944D99508B2FAD6D6B749FA1EDFE8124B0863D4A642352F0855 ] WUDFRd          C:\Windows\system32\drivers\WUDFRd.sys
14:35:33.0444 0x0b30  WUDFRd - ok
14:35:33.0476 0x0b30  [ FE47B7BC8EA320C2D9B5E5BF6E303765, 34518DBD1E9EA6E5DA62273B18613761E1D9C6B4E074A93C6D639FBAF02222EA ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
14:35:33.0507 0x0b30  wudfsvc - ok
14:35:33.0554 0x0b30  [ 7CC38741B8F68F1E0D5D79DA6123666A, F90D2DA1C9AFB506C381CD386E1430931B5F81813FEDFD720F87FBC54E7A00DA ] WwanSvc        C:\Windows\System32\wwansvc.dll
14:35:33.0632 0x0b30  WwanSvc - ok
14:35:33.0663 0x0b30  [ 16D6A3F448956D7627C5B247FE525C19, FCADC8675336589D765AD00F6C0C61B29251AB31D291F42A2BD0503BDB433C92 ] ZMHHPAudioSrv  C:\Windows\system32\drivers\zmhhpau.sys
14:35:33.0741 0x0b30  ZMHHPAudioSrv - ok
14:35:33.0772 0x0b30  [ C2215C6ADA8B1E9FEB507CEE9B446661, 8022EBC07ABC1935A4F056F5B7AD2E6893F250E49ABE6B8E0DC8B0478B356E5B ] ZTEusbmdm6k    C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys
14:35:33.0881 0x0b30  ZTEusbmdm6k - ok
14:35:33.0897 0x0b30  [ 9862F9D2FF50AE748ED42C022E6AAC15, 35F4DFDBF150C95AE1D79381A112B43D32FEF2F8C1744C41C7B72DE8A4284226 ] ZTEusbnet      C:\Windows\system32\DRIVERS\ZTEusbnet.sys
14:35:33.0975 0x0b30  ZTEusbnet - ok
14:35:34.0006 0x0b30  [ F16CE3C7690AB7426DC96520D54A737E, AF61228EB656AB152873BC29607A86A000DA8F452321EC46B274E6B1B40672B8 ] ZTEusbnmea      C:\Windows\system32\DRIVERS\ZTEusbnmea.sys
14:35:34.0053 0x0b30  ZTEusbnmea - ok
14:35:34.0084 0x0b30  [ C2215C6ADA8B1E9FEB507CEE9B446661, 8022EBC07ABC1935A4F056F5B7AD2E6893F250E49ABE6B8E0DC8B0478B356E5B ] ZTEusbser6k    C:\Windows\system32\DRIVERS\ZTEusbser6k.sys
14:35:34.0115 0x0b30  ZTEusbser6k - ok
14:35:34.0146 0x0b30  [ F16CE3C7690AB7426DC96520D54A737E, AF61228EB656AB152873BC29607A86A000DA8F452321EC46B274E6B1B40672B8 ] ZTEusbvoice    C:\Windows\system32\DRIVERS\ZTEusbvoice.sys
14:35:34.0178 0x0b30  ZTEusbvoice - ok
14:35:34.0209 0x0b30  ================ Scan global ===============================
14:35:34.0224 0x0b30  [ DAB748AE0439955ED2FA22357533DDDB, 73EDD402C7479DDCE1998D0C7E99E1EC2974F64EFC33A851439CC85D09EDCDF9 ] C:\Windows\system32\basesrv.dll
14:35:34.0256 0x0b30  [ 51BB04243DF6196C06E125898127E397, E1B6C83FC6E455F6806185027C5B56F8BA9ECDF1CD69E97301EC0291F0D3466E ] C:\Windows\system32\winsrv.dll
14:35:34.0287 0x0b30  [ 51BB04243DF6196C06E125898127E397, E1B6C83FC6E455F6806185027C5B56F8BA9ECDF1CD69E97301EC0291F0D3466E ] C:\Windows\system32\winsrv.dll
14:35:34.0318 0x0b30  [ 364455805E64882844EE9ACB72522830, 906561DBBB33F744844CF27E456226044C85DF0FCFD26DE1FD11E09E2CFA6F8F ] C:\Windows\system32\sxssrv.dll
14:35:34.0365 0x0b30  [ 0780A42DBD7D9969F9BF4A19AA4285B5, 8EA41124A4E97732C5DAA616457FBA7111CB38986F3427FA776ED00BC1407171 ] C:\Windows\system32\services.exe
14:35:34.0380 0x0b30  [ Global ] - ok
14:35:34.0380 0x0b30  ================ Scan MBR ==================================
14:35:34.0396 0x0b30  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
14:35:34.0614 0x0b30  \Device\Harddisk0\DR0 - ok
14:35:34.0614 0x0b30  ================ Scan VBR ==================================
14:35:34.0614 0x0b30  [ 38BA5B5E25896930349B10922610BC24 ] \Device\Harddisk0\DR0\Partition1
14:35:34.0614 0x0b30  \Device\Harddisk0\DR0\Partition1 - ok
14:35:34.0630 0x0b30  [ 54D1F5CB27D681D01F0FFA82E29E141D ] \Device\Harddisk0\DR0\Partition2
14:35:34.0630 0x0b30  \Device\Harddisk0\DR0\Partition2 - ok
14:35:34.0630 0x0b30  [ F0B94F83DFA6BAD4091EE7C6612CFECC ] \Device\Harddisk0\DR0\Partition3
14:35:34.0661 0x0b30  \Device\Harddisk0\DR0\Partition3 - ok
14:35:34.0661 0x0b30  ================ Scan generic autorun ======================
14:35:34.0802 0x0b30  [ 2A06A880B6AECB9B1F384B60F35D5831, A5FF754AFBC6F818F470F50253A9E88BA24C5AA3E056D28AAF32ABBF1202C81B ] C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
14:35:34.0926 0x0b30  GDFirewallTray - ok
14:35:34.0989 0x0b30  [ A9F3C6135C9756E21A331F20437BC83E, 2576B4DD5D8374FF3042704DC885B4674ABF3E239BD7697785680C1D705901BA ] C:\Program Files\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe
14:35:35.0036 0x0b30  G Data ASM - ok
14:35:35.0067 0x0b30  [ 34084D25BE6F48D072AA54DE630438FD, 522C96429FC679C2D07E9254E8D1793FEC018D65CD43D88FE9851CC8CEB61A07 ] C:\Program Files\Common Files\Java\Java Update\jusched.exe
14:35:35.0114 0x0b30  SunJavaUpdateSched - ok
14:35:35.0238 0x0b30  [ 3E04F1E482357B1FC8B088197C3D9FF8, 85524ADDC27ADC831EBBD24E079B412CFDC69E5F594BD153319087665A28D546 ] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
14:35:35.0316 0x0b30  Adobe ARM - ok
14:35:35.0457 0x0b30  [ C364540E5B66EFAEAE182EC9AB9EE8B3, 52E8C876C3C26206DB5D53F156CEAF0F24433EDDDBF7FD74D772A8741A9D5D9D ] C:\Program Files\MyDrive Connect\TomTom MyDrive Connect.exe
14:35:35.0597 0x0b30  MyDriveConnect.exe - ok
14:35:35.0660 0x0b30  [ EC58C1A9A3281CE0C8FCC05BDBFECB37, 3738BBC112346B32F686F1CB4B4AAD89B06AA1F8FB2D333BC2D2F554212A0A59 ] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
14:35:35.0675 0x0b30  iCloudServices - ok
14:35:35.0769 0x0b30  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files\Windows Sidebar\Sidebar.exe
14:35:35.0909 0x0b30  Sidebar - ok
14:35:35.0972 0x0b30  [ BBA1A5B86134F496B926DDAF247DB871, 636990AE49C55189B7EF69C419787440B57EC0BAD98A9C280E1028F741BB222E ] C:\Windows\System32\mctadmin.exe
14:35:36.0018 0x0b30  mctadmin - ok
14:35:36.0174 0x0b30  [ 05597A464226C8323B7344CAF37D4335, 45203A47DE9DB157E4B72660621A01510B13E899133A31F62241694F6FD533A2 ] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
14:35:36.0346 0x0b30  LightScribe Control Panel - detected UnsignedFile.Multi.Generic ( 1 )
14:35:38.0998 0x0b30  Detect skipped due to KSN trusted
14:35:38.0998 0x0b30  LightScribe Control Panel - ok
14:35:38.0998 0x0b30  SpybotSD TeaTimer - ok
14:35:39.0014 0x0b30  [ EC58C1A9A3281CE0C8FCC05BDBFECB37, 3738BBC112346B32F686F1CB4B4AAD89B06AA1F8FB2D333BC2D2F554212A0A59 ] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
14:35:39.0045 0x0b30  iCloudServices - ok
14:35:39.0092 0x0b30  [ 86F0D0B3A07C142C81DAB47E8495A822, DA214C967FFE0B3E2BBCE99E7330DBB74EB0BB7F21833FE689277109B0FF92B5 ] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
14:35:39.0123 0x0b30  BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - ok
14:35:39.0123 0x0b30  MobileDocuments - ok
14:35:39.0154 0x0b30  [ 105C276BB7B43501225C419B062096D0, F5D35230FC5E116FB04147F216313D2E2542D96E975B19F5FD9F7641CF11271F ] C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
14:35:39.0185 0x0b30  ApplePhotoStreams - ok
14:35:39.0310 0x0b30  [ 05597A464226C8323B7344CAF37D4335, 45203A47DE9DB157E4B72660621A01510B13E899133A31F62241694F6FD533A2 ] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
14:35:39.0450 0x0b30  LightScribe Control Panel - detected UnsignedFile.Multi.Generic ( 1 )
14:35:39.0450 0x0b30  Detect skipped due to KSN trusted
14:35:39.0450 0x0b30  LightScribe Control Panel - ok
14:35:39.0450 0x0b30  Waiting for KSN requests completion. In queue: 95
14:35:40.0464 0x0b30  Waiting for KSN requests completion. In queue: 95
14:35:41.0478 0x0b30  Waiting for KSN requests completion. In queue: 95
14:35:42.0602 0x0b30  AV detected via SS2: G Data InternetSecurity CBE, C:\Program Files\G Data\InternetSecurity\AVK\avkwscpe.exe ( 25.0.0.0 ), 0x41000 ( enabled : updated )
14:35:42.0602 0x0b30  FW detected via SS2: G Data Personal Firewall, C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe ( 22.0.0.1 ), 0x41010 ( enabled )
14:35:45.0113 0x0b30  ============================================================
14:35:45.0113 0x0b30  Scan finished
14:35:45.0113 0x0b30  ============================================================
14:35:45.0129 0x1480  Detected object count: 2
14:35:45.0129 0x1480  Actual detected object count: 2
14:36:41.0180 0x1480  DCamUSBTP10 ( UnsignedFile.Multi.Generic ) - skipped by user
14:36:41.0180 0x1480  DCamUSBTP10 ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:36:41.0180 0x1480  tifsfilter ( UnsignedFile.Multi.Generic ) - skipped by user
14:36:41.0180 0x1480  tifsfilter ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:36:55.0048 0x11e8  Deinitialize success

schrauber 16.05.2015 06:27
hi,

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Erlu 16.05.2015 08:29
Hier der Combofix.log
Code:
ComboFix 15-05-13.01 - Ernst 16.05.2015  9:02.1.3 - x86
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3584.2489 [GMT 2:00]
ausgeführt von:: c:\users\Ernst\Desktop\ComboFix.exe
AV: G Data InternetSecurity CBE *Disabled/Updated* {545C8713-0744-B079-87F8-349A6D5C8CF0}
FW: G Data Personal Firewall *Disabled* {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
SP: G Data InternetSecurity CBE *Disabled/Updated* {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2015-04-16 bis 2015-05-16  ))))))))))))))))))))))))))))))
.
.
2015-05-16 07:22 . 2015-05-16 07:22        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2015-05-16 07:22 . 2015-05-16 07:22        --------        d-----w-        c:\users\Public\AppData\Local\temp
2015-05-16 07:22 . 2015-05-16 07:22        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2015-05-16 07:22 . 2015-05-16 07:22        --------        d-----w-        c:\users\Default\AppData\Local\temp
2015-05-16 07:22 . 2015-05-16 07:22        --------        d-----w-        c:\users\Administrator\AppData\Local\temp
2015-05-15 09:09 . 2015-05-15 09:16        --------        d-----w-        C:\FRST
2015-05-14 08:24 . 2015-05-14 08:24        --------        d-----w-        c:\program files\Doblon
2015-05-14 01:36 . 2015-05-01 13:16        102608        ----a-w-        c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 15:30 . 2015-05-15 05:41        --------        d-----w-        c:\program files\Quick Login for Google Accounts
2015-05-13 15:30 . 2015-05-15 05:40        --------        d-----w-        c:\program files\bestadblocker
2015-05-13 15:30 . 2015-05-15 05:41        --------        d-----w-        c:\program files\PriceMinus
2015-05-13 15:30 . 2015-05-15 05:40        --------        d-----w-        c:\program files\PriicEEMiNus
2015-05-13 15:30 . 2015-05-13 15:30        --------        d-----w-        c:\programdata\6739778865081373131
2015-05-13 15:28 . 2015-05-14 17:22        --------        d-----w-        c:\programdata\{f3467395-93d6-35df-f346-6739593dce56}
2015-05-13 11:30 . 2015-05-13 11:30        --------        d-----w-        c:\users\Ernst\AppData\Local\MediaMonkey
2015-05-13 11:30 . 2015-05-13 15:12        --------        d-----w-        c:\users\Ernst\AppData\Roaming\MediaMonkey
2015-05-13 06:15 . 2015-05-14 08:15        --------        d-----w-        c:\program files\Karaoke5
2015-05-13 05:42 . 2015-01-29 03:02        844288        ----a-w-        c:\windows\system32\drivers\UMDF\WpdMtpDr.dll
2015-05-13 05:41 . 2015-05-05 01:12        248832        ----a-w-        c:\windows\system32\schannel.dll
2015-05-13 05:41 . 2015-04-18 02:56        342016        ----a-w-        c:\windows\system32\certcli.dll
2015-05-13 05:41 . 2015-04-13 03:19        259072        ----a-w-        c:\windows\system32\services.exe
2015-05-13 05:36 . 2015-03-04 04:11        5120        ----a-w-        c:\windows\system32\shimeng.dll
2015-05-13 05:36 . 2015-03-04 04:10        295936        ----a-w-        c:\windows\system32\apphelp.dll
2015-05-13 05:36 . 2015-03-04 04:10        62464        ----a-w-        c:\windows\system32\aelupsvc.dll
2015-05-13 05:36 . 2015-03-04 04:10        20992        ----a-w-        c:\windows\system32\sdbinst.exe
2015-05-07 12:31 . 2015-05-07 12:31        --------        d-----w-        c:\users\Ernst\.chili
2015-05-01 18:10 . 2015-05-01 18:10        229608        ----a-w-        c:\program files\Internet Explorer\Plugins\nppdf32.dll
2015-04-30 18:40 . 2015-04-30 18:40        --------        d-----w-        C:\med7BDT
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-05-15 11:14 . 2015-03-10 19:44        119512        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-05-15 11:14 . 2015-03-10 19:43        92888        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys
2015-05-02 18:56 . 2015-03-18 16:50        96352        ----a-w-        c:\windows\system32\WindowsAccessBridge.dll
2015-04-15 17:57 . 2012-09-23 08:36        778416        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2015-04-15 17:57 . 2011-07-10 16:15        142512        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2015-03-26 20:43 . 2010-01-16 20:18        499712        ----a-w-        c:\windows\system32\msvcp71.dll
2015-03-26 20:43 . 2010-01-16 20:18        348160        ----a-w-        c:\windows\system32\msvcr71.dll
2015-03-25 03:00 . 2015-04-15 15:51        92672        ----a-w-        c:\windows\system32\wudriver.dll
2015-03-25 03:00 . 2015-04-15 15:51        566784        ----a-w-        c:\windows\system32\wuapi.dll
2015-03-25 03:00 . 2015-04-15 15:51        35328        ----a-w-        c:\windows\system32\wups2.dll
2015-03-25 03:00 . 2015-04-15 15:51        3088384        ----a-w-        c:\windows\system32\wucltux.dll
2015-03-25 03:00 . 2015-04-15 15:51        29696        ----a-w-        c:\windows\system32\wups.dll
2015-03-25 03:00 . 2015-04-15 15:51        2020864        ----a-w-        c:\windows\system32\wuaueng.dll
2015-03-25 03:00 . 2015-04-15 15:51        173056        ----a-w-        c:\windows\system32\wuwebv.dll
2015-03-25 03:00 . 2015-04-15 15:51        50176        ----a-w-        c:\windows\system32\WinSetupUI.dll
2015-03-25 03:00 . 2015-04-15 15:51        11776        ----a-w-        c:\windows\system32\wu.upgrade.ps.dll
2015-03-25 03:00 . 2015-04-15 15:51        33792        ----a-w-        c:\windows\system32\wuapp.exe
2015-03-25 03:00 . 2015-04-15 15:51        131584        ----a-w-        c:\windows\system32\wuauclt.exe
2015-03-23 03:06 . 2015-04-15 15:54        576000        ----a-w-        c:\windows\system32\generaltel.dll
2015-03-23 03:06 . 2015-04-15 15:54        630784        ----a-w-        c:\windows\system32\invagent.dll
2015-03-23 03:06 . 2015-04-15 15:54        331264        ----a-w-        c:\windows\system32\devinv.dll
2015-03-23 03:06 . 2015-04-15 15:54        860160        ----a-w-        c:\windows\system32\appraiser.dll
2015-03-23 03:06 . 2015-04-15 15:54        26112        ----a-w-        c:\windows\system32\acmigration.dll
2015-03-23 03:06 . 2015-04-15 15:54        202752        ----a-w-        c:\windows\system32\aepdu.dll
2015-03-23 03:06 . 2015-04-15 15:54        159744        ----a-w-        c:\windows\system32\aepic.dll
2015-03-23 02:59 . 2015-04-15 15:54        896000        ----a-w-        c:\windows\system32\aeinv.dll
2015-03-16 13:27 . 2015-03-16 13:27        15192        ----a-w-        c:\windows\system32\drivers\GdPhyMem.sys
2015-03-16 13:26 . 2015-03-16 13:26        29528        ----a-w-        c:\windows\system32\drivers\GRD.sys
2015-03-16 12:56 . 2015-03-16 12:56        53248        ----a-w-        c:\windows\system32\drivers\gdwfpcd32.sys
2015-03-16 12:56 . 2015-03-16 12:56        56832        ----a-w-        c:\windows\system32\drivers\PktIcpt.sys
2015-03-16 12:53 . 2015-03-16 12:53        50176        ----a-w-        c:\windows\system32\drivers\HookCentre.sys
2015-03-16 12:53 . 2015-03-16 12:53        101504        ----a-w-        c:\windows\system32\drivers\MiniIcpt.sys
2015-03-16 12:53 . 2015-03-16 12:53        44544        ----a-w-        c:\windows\system32\drivers\GDBehave.sys
2015-03-10 03:08 . 2015-04-15 15:51        1237504        ----a-w-        c:\windows\system32\msxml3.dll
2015-03-10 03:05 . 2015-04-15 15:51        2048        ----a-w-        c:\windows\system32\msxml3r.dll
2015-03-05 04:06 . 2015-04-15 15:53        305152        ----a-w-        c:\windows\system32\gdi32.dll
2015-03-04 04:16 . 2015-04-15 15:54        249784        ----a-w-        c:\windows\system32\clfs.sys
2015-03-04 04:10 . 2015-04-15 15:54        58880        ----a-w-        c:\windows\system32\clfsw32.dll
2015-03-04 04:10 . 2015-05-13 05:36        470528        ----a-w-        c:\windows\apppatch\AcSpecfc.dll
2015-03-04 04:10 . 2015-05-13 05:36        2178560        ----a-w-        c:\windows\apppatch\AcGenral.dll
2015-03-04 04:06 . 2015-05-13 05:36        2560        ----a-w-        c:\windows\apppatch\AcRes.dll
2015-02-25 03:03 . 2015-04-15 15:51        514560        ----a-w-        c:\windows\system32\drivers\http.sys
2015-02-20 04:13 . 2015-03-14 10:09        26624        ----a-w-        c:\windows\system32\lpk.dll
2015-02-20 04:13 . 2015-03-14 10:09        70656        ----a-w-        c:\windows\system32\fontsub.dll
2015-02-20 04:13 . 2015-03-14 10:09        10240        ----a-w-        c:\windows\system32\dciman32.dll
2015-02-20 04:13 . 2015-03-14 10:09        34304        ----a-w-        c:\windows\system32\atmlib.dll
2015-02-20 03:09 . 2015-03-14 10:09        299008        ----a-w-        c:\windows\system32\atmfd.dll
2010-03-31 08:09 . 2015-04-23 12:46        10437264        ----a-w-        c:\program files\mozilla firefox\plugins\PDFNetC.dll
2010-04-08 11:35 . 2015-04-23 12:46        9822960        ----a-r-        c:\program files\mozilla firefox\plugins\ScorchAxPlugin.dll
2010-04-08 12:36 . 2015-04-23 12:46        107760        ----a-w-        c:\program files\mozilla firefox\plugins\ScorchPDFWrapper.dll
2006-05-03 10:06        163328        --sha-r-        c:\windows\System32\flvDX.dll
2007-02-21 11:47        31232        --sha-r-        c:\windows\System32\msfDX.dll
2008-03-16 13:30        216064        --sha-r-        c:\windows\System32\nbDX.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12        152544        ----a-w-        c:\users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12        152544        ----a-w-        c:\users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12        152544        ----a-w-        c:\users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MyDriveConnect.exe"="c:\program files\MyDrive Connect\TomTom MyDrive Connect.exe" [2015-04-28 1905032]
"iCloudServices"="c:\program files\Common Files\Apple\Internet Services\iCloudServices.exe" [2014-10-17 43816]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GDFirewallTray"="c:\program files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe" [2013-12-19 1724728]
"G Data ASM"="c:\program files\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe" [2013-12-19 431224]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2015-04-30 334896]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-19 1022152]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"InfoCockpit"="c:\program files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE" [2009-11-16 268800]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE -b -l [2001-2-13 83360]
PHOTOfunSTUDIO 6.3 HD Lite Edition.lnk - c:\program files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe -e "c:\program files\Panasonic\PHOTOfunSTUDIO 6.3 HD Lite\PHOTOfunSTUDIO.exe" [2012-6-23 152048]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
"SoftwareSASGeneration"= 1 (0x1)
"EnableSecureUIAPath"= 1 (0x1)
.
[HKLM\~\startupfolder\C:^Users^Ernst^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\Ernst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2014-12-19 07:48        1022152        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApplePhotoStreams]
2014-11-21 12:20        43816        ----a-w-        c:\program files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-10-05 23:52        59240        ----a-w-        c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2015-02-13 03:20        60712        ----a-w-        c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2010-10-27 18:17        207424        ----a-w-        c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-06-27 16:03        152872        ----a-w-        c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVAPTray]
2009-10-29 10:31        188416        ------w-        c:\windows\System32\DVAPTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EaseUS EPM tray]
2013-03-29 15:07        2081792        ----a-w-        c:\program files\EASEUS\EaseUS Partition Master 9.2.2\bin\EpmNews.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eTMonitor]
2008-11-03 11:37        221184        ----a-w-        c:\program files\Aladdin\eToken\PKIClient\x32\PKIMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreePDF Assistant]
2009-09-05 15:29        385024        ----a-w-        c:\program files\FreePDF_XP\fpassist.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iCloudServices]
2014-10-17 14:24        43816        ----a-w-        c:\program files\Common Files\Apple\Internet Services\iCloudServices.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2015-02-13 06:55        157480        ----a-w-        c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2007-11-28 08:27        1647912        ----a-w-        c:\program files\Nero\Nero 7\Nero BackItUp\NBKeyScan.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 12:57        153136        ----a-w-        c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2014-06-04 08:08        191528        ----a-w-        c:\program files\PDF24\pdf24.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2014-10-02 13:23        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDVCPL]
2014-02-13 13:09        12017368        ----a-w-        c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2015-04-30 11:45        334896        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2010-12-11 18:17        5145824        ----a-w-        c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
2007-05-31 07:21        648072        ----a-w-        c:\windows\WindowsMobile\wmdc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wondershare Helper Compact.exe]
2014-07-09 10:03        2020704        ----a-w-        c:\program files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"EssentialPIM"="c:\program files\EssentialPIM\EssentialPIM.exe" /autorun
"LaunchList"=e:\program files\Pinnacle\Studio 11\LaunchList2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"PlantronicsBatteryStatus.exe"=c:\program files\Plantronics\PlantronicsURE\PlantronicsBatteryStatus.exe
"PlantronicsURE.exe"=c:\program files\Plantronics\PlantronicsURE\PlantronicsURE.exe
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
.
R2 WOTUpdater;WOT Updater;c:\users\Ernst\AppData\LocalLow\WOT\IE\WOTUpdater.exe [2012-01-12 18432]
R3 AKSUP;AKSUP;c:\windows\system32\drivers\aksup.sys [2008-07-29 34472]
R3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys [2013-06-02 26032]
R3 becldr3Service;BCL EasyConverter SDK 3 Loader;c:\program files\BCL Technologies\easyConverter SDK 3\Common\becldr.exe [2011-04-19 176128]
R3 DCamUSBSTK02N;Standard Camera;c:\windows\system32\DRIVERS\STK02NW2.sys [x]
R3 DCamUSBTP10;USB PC Camera;c:\windows\system32\Drivers\iP293x.sys [2008-10-30 246272]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2013-03-07 14920]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2013-03-07 9160]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-04-21 102912]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\DRIVERS\massfilter.sys [2009-04-09 7680]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 ZMHHPAudioSrv;ZOOM H Series High Performance Audio Driver Service;c:\windows\system32\drivers\zmhhpau.sys [2010-04-16 32000]
R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [2009-04-09 110592]
R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [2009-04-09 105344]
S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys [2015-03-16 44544]
S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys [2011-02-01 752128]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2012-09-04 27496]
S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [2015-03-16 101504]
S1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd32.sys [2015-03-16 53248]
S1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2015-03-16 29528]
S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [2015-03-16 50176]
S1 RrNetCapFilterDriver;RadioRip Filter Driver;c:\windows\system32\DRIVERS\RrNetCapFilterDriver.sys [2014-08-25 22184]
S2 afcdpsrv;Acronis Nonstop Backup-Dienst;c:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [2011-02-01 3246040]
S2 AVKProxy;G Data AntiVirus Proxy;c:\program files\Common Files\G Data\AVKProxy\AVKProxy.exe [2014-02-12 2244728]
S2 AVKService;G Data Scheduler;c:\program files\G Data\InternetSecurity\AVK\AVKService.exe [2013-12-19 914552]
S2 AVKWCtl;G Data Dateisystem Wächter;c:\program files\G Data\InternetSecurity\AVK\AVKWCtl.exe [2014-03-25 2159472]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 eTSrv;ETOKSRV;c:\program files\Aladdin\eToken\PKIClient\x32\eTSrv.exe [2008-11-03 7168]
S2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service;c:\program files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [2015-01-16 243880]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-11-21 1871160]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2012-07-16 2673064]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [2011-02-01 167968]
S3 GDFwSvc;G Data Personal Firewall;c:\program files\G Data\InternetSecurity\Firewall\GDFwSvc.exe [2014-01-30 2409280]
S3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys [2015-03-16 56832]
S3 GDScan;G Data Scanner;c:\program files\Common Files\G Data\GDScan\GDScan.exe [2014-02-03 700024]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 80011871
*Deregistered* - 80011871
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile        REG_MULTI_SZ          wcescomm rapimgr
LocalServiceRestricted        REG_MULTI_SZ          WcesComm RapiMgr
utcsvc        REG_MULTI_SZ          DiagTrack
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-01-24 11:30        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-05-15 c:\windows\Tasks\AbelssoftPreloader.job
- c:\program files\WashAndGo\AbelssoftPreloader.exe [2015-03-21 14:26]
.
2015-05-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-23 17:57]
.
2015-05-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-08 06:07]
.
2015-05-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-08 06:07]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
mStart Page = about:blank
uSearchAssistant = hxxp://www.google.com
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.33.2
FF - ProfilePath - c:\users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\
FF - prefs.js: browser.search.selectedEngine - mystartsearch
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/?gws_rd=ssl
.
.
------- Dateityp-Verknüpfung -------
.
inifile="%SystemRoot%\system32\NOTEPAD.EXE" %1
txtfile="%SystemRoot%\system32\NOTEPAD.EXE" %1
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(816)
c:\windows\system32\KERNELBASE.dll
c:\windows\SYSTEM32\sechost.dll
c:\windows\system32\profapi.dll
c:\windows\system32\RpcRtRemote.dll
c:\windows\system32\UXINIT.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netjoin.dll
c:\windows\system32\netutils.dll
c:\windows\system32\SspiCli.dll
c:\windows\system32\slc.dll
.
- - - - - - - > 'lsass.exe'(852)
c:\windows\system32\KERNELBASE.dll
c:\windows\system32\SspiSrv.dll
c:\windows\SYSTEM32\sechost.dll
c:\windows\system32\SspiCli.dll
c:\windows\system32\cngaudit.dll
c:\windows\system32\netjoin.dll
c:\windows\system32\negoexts.DLL
c:\windows\system32\cryptbase.dll
c:\windows\system32\CRYPTSP.dll
c:\windows\System32\wship6.dll
c:\windows\system32\logoncli.dll
c:\windows\system32\pku2u.DLL
c:\windows\system32\livessp.DLL
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\RpcRtRemote.dll
c:\windows\system32\efslsaext.dll
c:\windows\system32\efssvc.dll
c:\windows\system32\EFSCORE.dll
c:\windows\system32\EFSUTIL.dll
c:\windows\system32\profapi.dll
c:\windows\system32\slc.dll
c:\windows\system32\WTSAPI32.dll
c:\windows\System32\wshtcpip.dll
c:\windows\system32\WINNSI.DLL
c:\windows\system32\netutils.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\dssenh.dll
.
- - - - - - - > 'Explorer.exe'(12132)
c:\windows\system32\KERNELBASE.dll
c:\windows\SYSTEM32\sechost.dll
c:\windows\system32\EXPLORERFRAME.dll
c:\windows\system32\DUI70.dll
c:\windows\system32\DEVOBJ.dll
c:\windows\system32\slc.dll
c:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18834_none_72d38c5186679d48\gdiplus.dll
c:\windows\system32\SSPICLI.DLL
c:\windows\system32\PROPSYS.dll
c:\windows\system32\CRYPTBASE.dll
c:\windows\system32\profapi.dll
c:\users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
c:\windows\system32\EhStorShell.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\CRYPTSP.dll
c:\windows\system32\RpcRtRemote.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\WINBRAND.dll
c:\windows\System32\gameux.dll
c:\windows\System32\XmlLite.dll
c:\windows\system32\msiltcfg.dll
c:\windows\system32\samcli.dll
c:\windows\system32\msls31.dll
c:\program files\Common Files\microsoft shared\ink\tiptsf.dll
c:\windows\system32\DeviceCenter.dll
c:\windows\System32\ieframe.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
c:\windows\system32\SearchFolder.dll
c:\windows\System32\StructuredQuery.dll
c:\windows\system32\NetworkExplorer.dll
c:\windows\System32\DAVHLPR.dll
c:\program files\G Data\InternetSecurity\Shredder\Reisswlf.dll
c:\windows\system32\WTSAPI32.dll
c:\windows\system32\prnfldr.dll
c:\windows\system32\dxp.dll
c:\windows\system32\Syncreg.dll
c:\windows\System32\WINNSI.DLL
c:\windows\system32\wlanutil.dll
c:\windows\system32\wwanapi.dll
c:\windows\system32\wwapi.dll
c:\windows\System32\bthprops.cpl
c:\windows\System32\Actioncenter.dll
c:\windows\System32\hgcpl.dll
c:\windows\System32\provsvc.dll
c:\windows\system32\FXSRESM.DLL
.
- - - - - - - > 'csrss.exe'(664)
c:\windows\system32\KERNELBASE.dll
c:\windows\system32\sxssrv.DLL
c:\windows\system32\CRYPTBASE.dll
c:\windows\SYSTEM32\sechost.dll
.
- - - - - - - > 'csrss.exe'(740)
c:\windows\system32\KERNELBASE.dll
c:\windows\system32\sxssrv.DLL
c:\windows\system32\CRYPTBASE.dll
c:\windows\SYSTEM32\sechost.dll
.
Zeit der Fertigstellung: 2015-05-16  09:27:41
ComboFix-quarantined-files.txt  2015-05-16 07:27
.
Vor Suchlauf: 54 Verzeichnis(se), 29.289.422.848 Bytes frei
Nach Suchlauf: 55 Verzeichnis(se), 29.231.353.856 Bytes frei
.
- - End Of File - - FDAD24DE8D34A00AE692E1541CFE1C3F
A36C5E4F47E84449FF07ED3517B43A31

schrauber 16.05.2015 14:21
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

Erlu 16.05.2015 17:24
Der MBAM.log
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 16.05.2015
Suchlauf-Zeit: 15:50:55
Logdatei: mbam.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.05.16.02
Rootkit Datenbank: v2015.05.14.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Ernst

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 533283
Verstrichene Zeit: 1 Std, 0 Min, 22 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 1
PUP.Optional.FastSearch.A, HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\SOFTWARE\MOZILLA\EXTENDS, In Quarantäne, [203232622b5fe353bf3326aedb280af6],

Registrierungswerte: 13
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|DisplayName, mystartsearch, In Quarantäne, [afa33e56662484b279bbe2889f668a76]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, hxxp://www.mystartsearch.com/web/?type=ds&ts=1431531089&z=bd607f37b871b2474648360g8zbc1gew9c5g6e7bfm&from=wpc&uid=395049983_1052451_74975161&q={searchTerms}, In Quarantäne, [282acacae9a1003651e3ec7e2dd809f7]
PUP.Optional.FastStart.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|searchffv2@gmail.com, C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\extensions\searchffv2@gmail.com, In Quarantäne, [4a08dcb896f41f179ffc6c02b4510ef2]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|DisplayName, mystartsearch, In Quarantäne, [e270583c4b3f2a0c5ad9412946bf02fe]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, hxxp://www.mystartsearch.com/web/?type=ds&ts=1431531089&z=bd607f37b871b2474648360g8zbc1gew9c5g6e7bfm&from=wpc&uid=395049983_1052451_74975161&q={searchTerms}, In Quarantäne, [3e14c5cf3d4dd95ded46beacb253bb45]
PUP.Optional.Spigot.A, HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{55A9FE75-E6CD-439D-8012-65202831D22F}|URL, hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=402027&p={searchTerms}, In Quarantäne, [1a381e76f8922b0b10c39f3856ad0df3]
PUP.Optional.FastSearch.A, HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\SOFTWARE\MOZILLA\EXTENDS|appid, searchffv2@gmail.com, In Quarantäne, [203232622b5fe353bf3326aedb280af6]
PUP.Optional.Babylon.A, HKU\S-1-5-21-3539214255-4280287789-3925056074-500\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}|URL, hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=7497516100000000000000241da32dd8&tlver=1.4.19.19&affID=17161, In Quarantäne, [e2703e565832fe380662cf9850b5916f]
PUP.Optional.Babylon.A, HKU\S-1-5-21-3539214255-4280287789-3925056074-500\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}|DisplayName, Search the web (Babylon), In Quarantäne, [c191702403871521f37527409f662dd3]
PUP.Optional.SearchResults.A, HKU\S-1-5-21-3539214255-4280287789-3925056074-500\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|URL, hxxp://dts.search-results.com/sr?src=ieb&appid=119&systemid=406&sr=0&q={searchTerms}, In Quarantäne, [59f93d5773172214e1dbf7dee320b14f]
PUP.Optional.SearchQu.A, HKU\S-1-5-21-3539214255-4280287789-3925056074-500\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}|SuggestionsURL_JSON, hxxp://www.searchqu.com/suggest.php?src=ieb&appid=119&systemid=406&qu={searchTerms}&ft=json, In Quarantäne, [e76b9400701ad363a0be6cfe3ec757a9]
PUP.Optional.Conduit.A, HKU\S-1-5-21-3539214255-4280287789-3925056074-500\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{afdbddaa-5d3f-42ee-b79c-185a7020515b}|URL, hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848, In Quarantäne, [460ca3f1fc8e9e988767597fbd4643bd]
PUP.Optional.Spigot.A, HKU\S-1-5-21-3539214255-4280287789-3925056074-500\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E14A0066-F507-4D1F-82CF-0550E5007D2B}|URL, hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=616163&p={searchTerms}, In Quarantäne, [d37fa6ee2664ec4a676cdef916eda45c]

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 2
PUP.Optional.BestAdBlocker.A, C:\Program Files\bestadblocker, In Quarantäne, [1f33474d2e5cd363bf5d5d0d1aeb4fb1],
PUP.Optional.PriceMinus.A, C:\Program Files\PriceMinus, In Quarantäne, [ea686e2602885ed8ced775f773929f61],

Dateien: 4
PUP.Optional.BestAdBlocker.A, C:\Program Files\bestadblocker\sdjwve6zyuy1jj.tlb, In Quarantäne, [1f33474d2e5cd363bf5d5d0d1aeb4fb1],
PUP.Optional.BestAdBlocker.A, C:\Program Files\bestadblocker\sdjwve6zyuy1jj.dat, In Quarantäne, [1f33474d2e5cd363bf5d5d0d1aeb4fb1],
PUP.Optional.PriceMinus.A, C:\Program Files\PriceMinus\K0tUaUHoqT9vey.tlb, In Quarantäne, [ea686e2602885ed8ced775f773929f61],
PUP.Optional.PriceMinus.A, C:\Program Files\PriceMinus\K0tUaUHoqT9vey.dat, In Quarantäne, [ea686e2602885ed8ced775f773929f61],

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)
Der AdwCleaner.log
Code:
# AdwCleaner v4.204 - Bericht erstellt 16/05/2015 um 17:28:44
# Aktualisiert 12/05/2015 von Xplode
# Datenbank : 2015-05-12.2 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x86)
# Benutzername : Ernst - ELINEU
# Gestarted von : C:\Users\Ernst\Desktop\AdwCleaner_4.204.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\6739778865081373131
Ordner Gelöscht : C:\ProgramData\{f3467395-93d6-35df-f346-6739593dce56}
Ordner Gelöscht : C:\Program Files\foxtabvideoconverter
Ordner Gelöscht : C:\Program Files\PriicEEMiNus
Ordner Gelöscht : C:\Users\Ernst\AppData\Local\PC_Drivers_Headquarters
Datei Gelöscht : C:\Program Files\Mozilla Firefox\defaults\pref\itms.js

***** [ Geplante Tasks ] *****

Task Gelöscht : Bidaily Synchronize Task

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Appscion
Schlüssel Gelöscht : HKU\.DEFAULT\Software\AskToolbar

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17801


-\\ Mozilla Firefox v37.0.2 (x86 de)

[z3lqlojh.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.alias", "mystartsearch");
[z3lqlojh.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.iconURL", "hxxp://www.mystartsearch.com/favicon.ico");
[z3lqlojh.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.name", "mystartsearch");
[z3lqlojh.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.url", "hxxp://www.mystartsearch.com/web/?type=ds&ts=1431531089&z=bd607f37b871b2474648360g8zbc1gew9c5g6e7bfm&from=wpc&uid=395049983_1052451_74975161&q={searchTerm[...]
[z3lqlojh.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.selectedEngine", "mystartsearch");
[z3lqlojh.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.axAUJGleC3sBn1am.scode", "(function(){try{if(window.location.href.indexOf(\"rjr9qjkHpjkFpdg6pja6rjC4qHs\")>-1){return;}}catch(e){}try{var d=[[\"www.viracure.com\",\"onesystemcare[...]
[z3lqlojh.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.ocZTspTgsmF18qF8.scode", "(function(){try{if(window.location.href.indexOf(\"rjr9qjkHpjkFpdg6pja6rjC4qHs\")>-1){return;}}catch(e){}try{var d=[[\"www.viracure.com\",\"onesystemcare[...]
[z3lqlojh.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.enable_search1", false);
[z3lqlojh.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);

-\\ Opera v0.0.0.0


*************************

AdwCleaner[R0].txt - [2769 Bytes] - [16/05/2015 17:08:40]
AdwCleaner[S0].txt - [2770 Bytes] - [16/05/2015 17:28:44]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2829  Bytes] ##########
Der JRT.log
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.7.2 (05.15.2015:1)
OS: Windows 7 Home Premium x86
Ran by Ernst on 16.05.2015 at 17:33:31,94
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys




~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Ernst\AppData\Roaming\mozilla\firefox\profiles\z3lqlojh.default\prefs.js

user_pref(browser.search.searchengine.desc, this is my first firefox searchEngine);
user_pref(browser.search.searchengine.ptid, wpc);
user_pref(browser.search.searchengine.uid, 395049983_1052451_74975161);





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 16.05.2015 at 17:37:42,18
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
und das frische FRST

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-05-2015 02
Ran by Ernst (administrator) on ELINEU on 16-05-2015 18:09:12
Running from C:\Users\Ernst\Desktop
Loaded Profiles: Ernst (Available profiles: Ernst & UpdatusUser & Administrator & Gast)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(TomTom) C:\Program Files\MyDrive Connect\TomTom MyDrive Connect.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\tv_w32.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\GUI\GDSC.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [GDFirewallTray] => C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKLM\...\Run: [G Data ASM] => C:\Program Files\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\...\Run: [MyDriveConnect.exe] => C:\Program Files\MyDrive Connect\TomTom MyDrive Connect.exe [1905032 2015-04-28] (TomTom)
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-18\...\Run: [InfoCockpit] => C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE [268800 2009-11-16] (Deutsche Telekom AG, T-Com)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk [2015-03-26]
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 6.3 HD Lite Edition.lnk [2015-03-26]
ShortcutTarget: PHOTOfunSTUDIO 6.3 HD Lite Edition.lnk -> C:\Program Files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe (Panasonic Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000 -> {55A9FE75-E6CD-439D-8012-65202831D22F} URL =
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2012-06-14] (CANON INC.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-02] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-02] (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2012-06-14] (CANON INC.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2007-11-07] (Skype Technologies)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.33.2

FireFox:
========
FF ProfilePath: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default
FF SearchEngineOrder.2:
FF Homepage: https://www.google.de/?gws_rd=ssl
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @innoplus.de/ino3DViewer -> C:\Program Files\innoplus\3D-Viewer-innoPlus\npIno3DViewer.dll [2012-04-25] (INNOVA-engineering GmbH Dresden)
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-02] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-02] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Plugin: @Sibelius.com/Scorch Plugin,version=6.2.0.88 -> C:\Program Files\Sibelius Software\Scorch\npsibelius.dll [2013-03-11] ()
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> E:\Program Files\VideoLAN\VLC\npvlc.dll [2013-11-11] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPSibelius.dll [2010-04-08] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\PDFNetC.dll [2010-03-31] (PDFTron Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ScorchAxPlugin.dll [2010-04-08] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ScorchPDFWrapper.dll [2010-04-08] ()
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\englische-ergebnisse.xml [2012-08-12]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\gmx-suche.xml [2012-08-12]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\google-images.xml [2014-09-21]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\google-maps.xml [2014-09-21]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\lastminute.xml [2012-08-12]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\webde-suche.xml [2012-08-12]
FF HKLM\...\Firefox\Extensions: [{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}] - C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox
FF Extension: Internet Video Downloader - C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2011-01-18]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [nphjeokkkbngjpiofnfpnafjeofjomfb] - C:\Users\Ernst\AppData\LocalLow\WOT\CHROME\WOT.crx [2012-01-12]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S2 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [764552 2010-12-11] (Acronis)
S2 afcdpsrv; C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe [3246040 2011-02-01] (Acronis)
R2 AVKProxy; C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG)
R2 AVKService; C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe [2159472 2014-03-25] (G Data Software AG)
S3 becldr3Service; C:\Program Files\BCL Technologies\easyConverter SDK 3\Common\becldr.exe [176128 2011-04-19] () [File not signed]
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [851456 2015-04-27] (Microsoft Corporation)
S2 eTSrv; C:\Program Files\Aladdin\eToken\PKIClient\x32\eTSrv.exe [7168 2008-11-03] (Aladdin Knowledge Systems, Ltd.) [File not signed]
S2 FoxitCloudUpdateService; C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [243880 2015-01-16] (Foxit Software Inc.)
R3 GDFwSvc; C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe [2409280 2014-01-30] (G Data Software AG)
R3 GDScan; C:\Program Files\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG)
S2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-01-24] (Hewlett-Packard Company) [File not signed]
S2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 PCLEPCI; C:\Windows\system32\drivers\pclepci.sys [14165 2005-02-09] (Pinnacle Systems GmbH) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S2 WOTUpdater; C:\Users\Ernst\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [46976 2009-07-14] (Microsoft Corporation)
R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R3 AKSIFDH; C:\Windows\System32\DRIVERS\aksifdh.sys [48296 2008-07-29] (Aladdin Knowledge Systems, Ltd.)
S3 AKSUP; C:\Windows\System32\drivers\aksup.sys [34472 2008-07-29] (Aladdin Knowledge Systems, Ltd.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [26032 2013-06-02] (Wondershare)
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [27496 2012-09-04] (AVG Technologies)
S3 DCamUSBTP10; C:\Windows\System32\Drivers\iP293x.sys [246272 2008-10-30] (iPassion Technology Inc.) [File not signed]
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [14920 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9160 2013-03-07] () [File not signed]
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [60104 2010-07-12] (FTDI Ltd.)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [44544 2015-03-16] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [101504 2015-03-16] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [56832 2015-03-16] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd32.sys [53248 2015-03-16] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [29528 2015-03-16] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [50176 2015-03-16] (G Data Software AG)
R3 MarvinBus; C:\Windows\System32\DRIVERS\MarvinBus.sys [171520 2005-09-23] (Pinnacle Systems GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-05-16] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R1 RrNetCapFilterDriver; C:\Windows\System32\DRIVERS\RrNetCapFilterDriver.sys [22184 2014-08-25] (Audials AG)
R3 tbhsd; C:\Windows\System32\drivers\tbhsd.sys [39048 2013-11-27] (RapidSolution Software AG)
R2 tifsfilter; C:\Windows\System32\DRIVERS\tifsfilt.sys [27648 2010-04-29] (Acronis) [File not signed]
S3 ZMHHPAudioSrv; C:\Windows\System32\drivers\zmhhpau.sys [32000 2010-04-16] (ZOOM)
S3 ZTEusbnet; C:\Windows\System32\DRIVERS\ZTEusbnet.sys [110592 2009-04-09] (ZTE Corporation)
S3 ZTEusbvoice; C:\Windows\System32\DRIVERS\ZTEusbvoice.sys [105344 2009-04-09] (ZTE Incorporated)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Ernst\AppData\Local\Temp\catchme.sys [X]
S3 DCamUSBSTK02N; system32\DRIVERS\STK02NW2.sys [X]
S3 StarOpen; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-16 18:09 - 2015-05-16 18:09 - 00000000 ____D () C:\Users\Ernst\Desktop\FRST-OlderVersion
2015-05-16 17:37 - 2015-05-16 17:37 - 00000957 _____ () C:\Users\Ernst\Desktop\JRT.txt
2015-05-16 17:33 - 2015-05-16 17:33 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-ELINEU-Windows-7-Home-Premium-(32-bit).dat
2015-05-16 17:33 - 2015-05-16 17:33 - 00000000 ____D () C:\RegBackup
2015-05-16 17:08 - 2015-05-16 17:28 - 00000000 ____D () C:\AdwCleaner
2015-05-16 17:07 - 2015-05-16 17:07 - 00005754 _____ () C:\Users\Ernst\Desktop\mbam.txt
2015-05-16 15:47 - 2015-05-16 15:47 - 02719698 _____ (Thisisu) C:\Users\Ernst\Desktop\JRT.exe
2015-05-16 15:47 - 2015-05-16 15:47 - 02209792 _____ () C:\Users\Ernst\Desktop\AdwCleaner_4.204.exe
2015-05-16 15:46 - 2015-05-16 15:47 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Ernst\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-16 09:27 - 2015-05-16 09:27 - 00025726 _____ () C:\ComboFix.txt
2015-05-16 08:57 - 2015-05-16 09:28 - 00000000 ____D () C:\Qoobox
2015-05-16 08:57 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-16 08:57 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-16 08:57 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-16 08:57 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-16 08:57 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-16 08:57 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-16 08:57 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-16 08:57 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-16 08:53 - 2015-05-16 08:53 - 05623645 ____R (Swearware) C:\Users\Ernst\Desktop\ComboFix.exe
2015-05-15 14:29 - 2015-05-15 14:29 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Ernst\Desktop\tdsskiller.exe
2015-05-15 13:06 - 2015-05-15 14:28 - 00000000 ____D () C:\Users\Ernst\Desktop\mbar
2015-05-15 13:05 - 2015-05-15 13:05 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Ernst\Desktop\mbar-1.09.1.1004.exe
2015-05-15 12:10 - 2015-05-15 12:10 - 00009408 _____ () C:\Users\Ernst\Desktop\gmer.log
2015-05-15 11:11 - 2015-05-15 11:16 - 00061716 _____ () C:\Users\Ernst\Desktop\Addition.txt
2015-05-15 11:09 - 2015-05-16 18:09 - 00017805 _____ () C:\Users\Ernst\Desktop\FRST.txt
2015-05-15 11:09 - 2015-05-16 18:09 - 00000000 ____D () C:\FRST
2015-05-15 11:09 - 2015-05-15 11:09 - 00000446 _____ () C:\Users\Ernst\Desktop\defogger_disable.log
2015-05-15 11:09 - 2015-05-15 11:09 - 00000000 _____ () C:\Users\Ernst\defogger_reenable
2015-05-15 07:58 - 2015-05-15 07:58 - 00380416 _____ () C:\Users\Ernst\Desktop\Gmer-19357.exe
2015-05-15 07:56 - 2015-05-16 18:09 - 01146368 _____ (Farbar) C:\Users\Ernst\Desktop\FRST.exe
2015-05-15 07:55 - 2015-05-15 07:55 - 00050477 _____ () C:\Users\Ernst\Desktop\Defogger.exe
2015-05-14 14:45 - 2015-05-16 17:29 - 00173663 _____ () C:\Windows\WindowsUpdate.log
2015-05-14 14:43 - 2015-05-16 17:30 - 00000280 _____ () C:\Windows\setupact.log
2015-05-14 14:43 - 2015-05-14 14:43 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-14 14:42 - 2015-05-16 10:02 - 00004172 _____ () C:\Windows\PFRO.log
2015-05-14 14:42 - 2015-05-14 14:42 - 00567896 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 14:03 - 2015-05-14 14:03 - 00182064 _____ () C:\Users\Ernst\AppData\Local\GDIPFONTCACHEV1.DAT
2015-05-14 10:24 - 2015-05-14 10:24 - 00000000 ____D () C:\Program Files\Doblon
2015-05-14 03:36 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 17:30 - 2015-05-15 07:41 - 00000000 ____D () C:\Program Files\Quick Login for Google Accounts
2015-05-13 13:30 - 2015-05-13 17:12 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\MediaMonkey
2015-05-13 13:30 - 2015-05-13 13:30 - 00000000 ____D () C:\Users\Ernst\AppData\Local\MediaMonkey
2015-05-13 08:15 - 2015-05-14 10:15 - 00000000 ____D () C:\Program Files\Karaoke5
2015-05-13 07:43 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 07:43 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 07:43 - 2015-04-21 18:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 07:43 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 07:43 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 07:43 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 07:43 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 07:43 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 07:43 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 07:43 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 07:43 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 07:43 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 07:43 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 07:43 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 07:43 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 07:43 - 2015-04-21 17:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 07:43 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 07:43 - 2015-04-21 17:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 07:43 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 07:43 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 07:43 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 07:43 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 07:43 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 07:43 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 07:43 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 07:43 - 2015-04-21 17:26 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 07:43 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 07:43 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 07:43 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 07:43 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 07:43 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 07:43 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 07:42 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-05-13 07:42 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 07:42 - 2015-04-27 21:11 - 00137664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 07:42 - 2015-04-27 21:11 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 07:42 - 2015-04-27 21:08 - 01307648 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00851456 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 07:42 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 07:42 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 07:42 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 07:42 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 07:42 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 07:42 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 07:42 - 2015-04-27 20:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 07:42 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 07:42 - 2015-04-20 04:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 07:42 - 2015-04-20 04:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 07:42 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 07:41 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 07:41 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 07:41 - 2015-04-13 05:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 07:36 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 07:36 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 07:36 - 2015-03-04 06:10 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 07:36 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 07:32 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 07:32 - 2015-04-08 05:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 07:32 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-12 14:41 - 2015-05-12 14:45 - 00000000 ____D () C:\Users\Ernst\Desktop\2015-05-12
2015-05-10 18:11 - 2015-05-10 18:11 - 00003549 _____ () C:\Users\Ernst\Documents\chrofreizeitfulda2015.nra
2015-05-10 08:46 - 2015-05-10 08:51 - 00000000 ____D () C:\Users\Ernst\Desktop\2015-05-10
2015-05-07 14:31 - 2015-05-07 14:31 - 00000000 ____D () C:\Users\Ernst\.chili
2015-05-03 10:27 - 2015-05-03 10:29 - 218207212 _____ () C:\Users\Ernst\Downloads\Med7v801(2).exe
2015-05-02 20:26 - 2015-05-02 20:26 - 23308160 _____ (TomTom International B.V.) C:\Users\Ernst\Downloads\InstallMyDriveConnect.exe
2015-04-30 20:40 - 2015-04-30 20:40 - 00000000 ____D () C:\med7BDT
2015-04-30 13:31 - 2015-04-30 13:31 - 28995288 _____ (DVDVideoSoft Ltd. ) C:\Users\Ernst\Downloads\FreeAudioCDToMP3Converter.exe
2015-04-25 09:33 - 2015-04-25 09:35 - 219637741 _____ () C:\Users\Ernst\Downloads\Med7v801(1).exe
2015-04-23 14:45 - 2015-05-14 11:48 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-22 07:45 - 2015-04-22 07:46 - 39074536 _____ (Microsoft Corporation) C:\Users\Ernst\Downloads\FileFormatConverters.exe
2015-04-18 07:20 - 2015-04-18 07:23 - 219637741 _____ () C:\Users\Ernst\Downloads\Med7v801.exe
2015-04-18 07:01 - 2015-04-18 07:10 - 816849717 _____ () C:\Users\Ernst\Downloads\MMI_PHARMINDEX_2015_Q2_20150315_17.1.0.exe
2015-04-16 16:43 - 2015-04-16 16:43 - 00001016 _____ () C:\Users\Ernst\Desktop\MMI PHARMINDEX.lnk
2015-04-16 03:09 - 2015-05-14 03:34 - 00000000 ____D () C:\Windows\system32\MRT

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-16 17:57 - 2012-09-23 10:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-16 17:41 - 2009-07-14 06:34 - 00023168 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-16 17:41 - 2009-07-14 06:34 - 00023168 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-16 17:30 - 2015-03-21 11:14 - 00000266 _____ () C:\Windows\Tasks\AbelssoftPreloader.job
2015-05-16 17:30 - 2011-01-08 10:44 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-16 17:30 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-16 16:30 - 2011-01-08 10:44 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-16 15:50 - 2015-03-10 21:44 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-16 15:49 - 2015-03-10 21:43 - 00001058 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-05-16 15:49 - 2015-03-10 21:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-16 15:49 - 2015-03-10 21:43 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-05-16 09:23 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2015-05-16 08:56 - 2015-03-06 13:41 - 00000000 ____D () C:\Windows\erdnt
2015-05-15 14:28 - 2015-03-06 15:14 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-15 14:05 - 2010-01-16 14:43 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-15 13:11 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\security
2015-05-15 11:09 - 2010-01-16 14:40 - 00000000 ____D () C:\Users\Ernst
2015-05-14 22:03 - 2014-10-01 14:23 - 00000000 ____D () C:\Windows\rescache
2015-05-14 14:41 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-05-14 14:24 - 2009-07-14 10:56 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-14 13:55 - 2013-09-14 12:45 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-14 12:01 - 2015-04-02 18:31 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2015-05-14 12:01 - 2013-11-04 14:46 - 00000000 ____D () C:\Users\Ernst\AppData\Local\Help
2015-05-14 12:01 - 2011-08-22 16:37 - 00000000 ____D () C:\ProgramData\tmp
2015-05-14 12:01 - 2010-05-06 13:32 - 00000000 ____D () C:\temp
2015-05-14 12:01 - 2010-03-16 23:02 - 00000000 ____D () C:\Program Files\iPhoto Plus 4
2015-05-14 12:01 - 2010-02-07 11:43 - 00000000 ____D () C:\med7net
2015-05-14 12:01 - 2010-02-07 11:42 - 00000000 ____D () C:\Med7
2015-05-14 11:49 - 2014-01-27 15:35 - 00000000 ____D () C:\Program Files\PDF24
2015-05-14 11:49 - 2013-08-25 09:33 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\TeamViewer
2015-05-14 11:49 - 2010-01-18 17:53 - 00000000 ____D () C:\Program Files\K-Lite Codec Pack
2015-05-14 11:49 - 2010-01-16 14:45 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-05-14 11:48 - 2015-02-01 10:50 - 00000000 ____D () C:\ProgramData\install_clap
2015-05-14 11:48 - 2013-11-04 09:19 - 00000000 ____D () C:\Users\Ernst\AppData\Local\NETGEARGenie
2015-05-14 11:48 - 2011-01-23 11:06 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\vlc
2015-05-14 11:47 - 2014-06-29 13:35 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\MusicNet
2015-05-14 11:47 - 2011-07-09 19:56 - 00000000 ____D () C:\Windows\Minidump
2015-05-14 11:47 - 2010-01-18 18:06 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\Media Player Classic
2015-05-14 04:08 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-05-14 03:55 - 2012-08-30 18:58 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-14 03:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-14 03:15 - 2010-12-08 23:11 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-14 03:08 - 2012-08-30 18:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 13:17 - 2010-01-17 15:09 - 00000349 _____ () C:\Users\Public\Documents\PCLECHAL.INI
2015-05-12 14:55 - 2013-11-09 19:20 - 00000000 ____D () C:\Users\Ernst\AppData\Local\FRITZ!
2015-05-10 18:14 - 2010-06-08 20:37 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\Audacity
2015-05-10 17:07 - 2014-09-15 15:57 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft
2015-05-10 17:07 - 2013-09-06 18:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-05-10 17:07 - 2013-09-06 18:49 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\DVDVideoSoft
2015-05-10 17:07 - 2013-09-06 18:49 - 00000000 ____D () C:\Program Files\DVDVideoSoft
2015-05-02 20:58 - 2010-02-05 19:46 - 00000000 ____D () C:\Program Files\Java
2015-05-02 20:56 - 2015-03-18 18:50 - 00096352 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-05-02 20:27 - 2014-12-30 14:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2015-05-02 20:27 - 2014-12-30 14:13 - 00000000 ____D () C:\Program Files\MyDrive Connect
2015-05-02 11:06 - 2015-01-23 18:56 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\Steganos
2015-05-02 10:26 - 2010-02-09 14:39 - 00000024 _____ () C:\ProgramData\__FileUploader.log
2015-05-01 09:58 - 2010-09-07 14:11 - 00000000 ____D () C:\Users\Ernst\Documents\DVDVideoSoft
2015-05-01 09:54 - 2010-11-27 22:01 - 00001971 _____ () C:\Users\Ernst\Documents\GNMIDI.ini
2015-04-30 13:32 - 2014-09-15 15:57 - 00001197 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2015-04-25 09:24 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-25 09:23 - 2012-05-06 18:05 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-22 07:48 - 2010-01-19 14:28 - 00000000 ____D () C:\Program Files\Microsoft Office
2015-04-22 07:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2015-04-18 10:56 - 2014-10-23 13:17 - 00001656 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Med7 Arztpraxisprogramm.lnk
2015-04-18 10:36 - 2010-02-07 11:40 - 00000000 ____D () C:\Windows\Downloaded Installations
2015-04-16 04:44 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\AppCompat
2015-04-16 03:40 - 2014-12-12 04:33 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-16 03:40 - 2014-05-07 03:20 - 00000000 ___SD () C:\Windows\system32\CompatTel

==================== Files in the root of some directories =======

2010-11-13 18:16 - 2010-11-13 18:16 - 0000604 ____H () C:\Program Files\STFT Notifier
2014-05-08 14:45 - 2014-05-08 14:45 - 0000000 _____ () C:\Users\Ernst\AppData\Roaming\gdfw.log
2014-05-08 14:45 - 2015-03-16 14:53 - 0003116 _____ () C:\Users\Ernst\AppData\Roaming\gdscan.log
2010-01-16 20:02 - 2010-01-15 23:42 - 4302944 _____ () C:\Users\Ernst\AppData\Roaming\IMAG0023.AVI
2014-05-14 21:54 - 2014-05-14 22:06 - 0028268 _____ () C:\Users\Ernst\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2014-12-07 12:01 - 2014-12-07 12:03 - 0583820 _____ () C:\Users\Ernst\AppData\Roaming\Scorch_Install.log
2010-03-08 23:21 - 2010-03-08 23:31 - 0282624 _____ () C:\Users\Ernst\AppData\Local\filesync.metadata
2010-02-09 14:39 - 2015-05-02 10:26 - 0000024 _____ () C:\ProgramData\__FileUploader.log

Some content of TEMP:
====================
C:\Users\Ernst\AppData\Local\temp\Quarantine.exe
C:\Users\Ernst\AppData\Local\temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-14 21:54

==================== End Of Log ============================
--- --- ---

schrauber 17.05.2015 11:39

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Erlu 18.05.2015 17:54
Hier der ESET Log
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=71eefafd6a3fd1469c412b81b8693a7a
# engine=23888
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-05-17 08:55:35
# local_time=2015-05-17 10:55:35 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 76 299151 183527326 0 0
# scanned=404751
# found=0
# cleaned=0
# scan_time=25160
Check-up log
Code:
Results of screen317's Security Check version 1.001 
 Windows 7 Service Pack 1 x86 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
G Data InternetSecurity CBE 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Java 8 Update 45 
 Java SE Development Kit 8 Update 40
 Adobe Flash Player        17.0.0.169 
 Adobe Reader XI 
 Mozilla Firefox (Firefox,. Firefox out of Date! 
 Mozilla Thunderbird (31.6.0)
````````Process Check: objlist.exe by Laurent```````` 
 G Data InternetSecurity Firewall GDFirewallTray.exe
 G Data InternetSecurity Firewall GDFwSvc.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
und das frische FRST

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-05-2015 02
Ran by Ernst (administrator) on ELINEU on 18-05-2015 07:51:10
Running from C:\Users\Ernst\Desktop
Loaded Profiles: Ernst (Available profiles: Ernst & UpdatusUser & Administrator & Gast)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(TomTom) C:\Program Files\MyDrive Connect\TomTom MyDrive Connect.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\tv_w32.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.27.5\GoogleCrashHandler.exe
(G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(G Data Software AG) C:\Program Files\G Data\InternetSecurity\GUI\GDSC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [GDFirewallTray] => C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKLM\...\Run: [G Data ASM] => C:\Program Files\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\...\Run: [MyDriveConnect.exe] => C:\Program Files\MyDrive Connect\TomTom MyDrive Connect.exe [1905032 2015-04-28] (TomTom)
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-18\...\Run: [InfoCockpit] => C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE [268800 2009-11-16] (Deutsche Telekom AG, T-Com)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk [2015-03-26]
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 6.3 HD Lite Edition.lnk [2015-03-26]
ShortcutTarget: PHOTOfunSTUDIO 6.3 HD Lite Edition.lnk -> C:\Program Files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe (Panasonic Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Ernst\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3539214255-4280287789-3925056074-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKU\S-1-5-21-3539214255-4280287789-3925056074-1000 -> {55A9FE75-E6CD-439D-8012-65202831D22F} URL =
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2012-06-14] (CANON INC.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-02] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-02] (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2012-06-14] (CANON INC.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2007-11-07] (Skype Technologies)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.33.2

FireFox:
========
FF ProfilePath: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default
FF SearchEngineOrder.2:
FF Homepage: https://www.google.de/?gws_rd=ssl
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @innoplus.de/ino3DViewer -> C:\Program Files\innoplus\3D-Viewer-innoPlus\npIno3DViewer.dll [2012-04-25] (INNOVA-engineering GmbH Dresden)
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-02] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-02] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Plugin: @Sibelius.com/Scorch Plugin,version=6.2.0.88 -> C:\Program Files\Sibelius Software\Scorch\npsibelius.dll [2013-03-11] ()
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> E:\Program Files\VideoLAN\VLC\npvlc.dll [2013-11-11] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2015-02-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPSibelius.dll [2010-04-08] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\PDFNetC.dll [2010-03-31] (PDFTron Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ScorchAxPlugin.dll [2010-04-08] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ScorchPDFWrapper.dll [2010-04-08] ()
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\englische-ergebnisse.xml [2012-08-12]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\gmx-suche.xml [2012-08-12]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\google-images.xml [2014-09-21]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\google-maps.xml [2014-09-21]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\lastminute.xml [2012-08-12]
FF SearchPlugin: C:\Users\Ernst\AppData\Roaming\Mozilla\Firefox\Profiles\z3lqlojh.default\searchplugins\webde-suche.xml [2012-08-12]
FF HKLM\...\Firefox\Extensions: [{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}] - C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox
FF Extension: Internet Video Downloader - C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2011-01-18]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [nphjeokkkbngjpiofnfpnafjeofjomfb] - C:\Users\Ernst\AppData\LocalLow\WOT\CHROME\WOT.crx [2012-01-12]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S2 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [764552 2010-12-11] (Acronis)
S2 afcdpsrv; C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe [3246040 2011-02-01] (Acronis)
R2 AVKProxy; C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG)
R2 AVKService; C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe [2159472 2014-03-25] (G Data Software AG)
S3 becldr3Service; C:\Program Files\BCL Technologies\easyConverter SDK 3\Common\becldr.exe [176128 2011-04-19] () [File not signed]
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [851456 2015-04-27] (Microsoft Corporation)
S2 eTSrv; C:\Program Files\Aladdin\eToken\PKIClient\x32\eTSrv.exe [7168 2008-11-03] (Aladdin Knowledge Systems, Ltd.) [File not signed]
S2 FoxitCloudUpdateService; C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [243880 2015-01-16] (Foxit Software Inc.)
R3 GDFwSvc; C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe [2409280 2014-01-30] (G Data Software AG)
R3 GDScan; C:\Program Files\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG)
S2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-01-24] (Hewlett-Packard Company) [File not signed]
S2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 PCLEPCI; C:\Windows\system32\drivers\pclepci.sys [14165 2005-02-09] (Pinnacle Systems GmbH) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S2 WOTUpdater; C:\Users\Ernst\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [46976 2009-07-14] (Microsoft Corporation)
R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R3 AKSIFDH; C:\Windows\System32\DRIVERS\aksifdh.sys [48296 2008-07-29] (Aladdin Knowledge Systems, Ltd.)
S3 AKSUP; C:\Windows\System32\drivers\aksup.sys [34472 2008-07-29] (Aladdin Knowledge Systems, Ltd.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [26032 2013-06-02] (Wondershare)
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [27496 2012-09-04] (AVG Technologies)
S3 DCamUSBTP10; C:\Windows\System32\Drivers\iP293x.sys [246272 2008-10-30] (iPassion Technology Inc.) [File not signed]
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [14920 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9160 2013-03-07] () [File not signed]
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [60104 2010-07-12] (FTDI Ltd.)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [44544 2015-03-16] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [101504 2015-03-16] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [56832 2015-03-16] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd32.sys [53248 2015-03-16] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [29528 2015-03-16] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [50176 2015-03-16] (G Data Software AG)
R3 MarvinBus; C:\Windows\System32\DRIVERS\MarvinBus.sys [171520 2005-09-23] (Pinnacle Systems GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-05-16] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R1 RrNetCapFilterDriver; C:\Windows\System32\DRIVERS\RrNetCapFilterDriver.sys [22184 2014-08-25] (Audials AG)
R3 tbhsd; C:\Windows\System32\drivers\tbhsd.sys [39048 2013-11-27] (RapidSolution Software AG)
R2 tifsfilter; C:\Windows\System32\DRIVERS\tifsfilt.sys [27648 2010-04-29] (Acronis) [File not signed]
S3 ZMHHPAudioSrv; C:\Windows\System32\drivers\zmhhpau.sys [32000 2010-04-16] (ZOOM)
S3 ZTEusbnet; C:\Windows\System32\DRIVERS\ZTEusbnet.sys [110592 2009-04-09] (ZTE Corporation)
S3 ZTEusbvoice; C:\Windows\System32\DRIVERS\ZTEusbvoice.sys [105344 2009-04-09] (ZTE Incorporated)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Ernst\AppData\Local\Temp\catchme.sys [X]
S3 DCamUSBSTK02N; system32\DRIVERS\STK02NW2.sys [X]
S3 StarOpen; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-18 07:17 - 2015-05-18 07:18 - 00852630 _____ () C:\Users\Ernst\Desktop\SecurityCheck.exe
2015-05-17 15:52 - 2015-05-17 15:52 - 00000000 ____D () C:\Program Files\ESET
2015-05-17 15:50 - 2015-05-17 15:50 - 02347384 _____ (ESET) C:\Users\Ernst\Desktop\esetsmartinstaller_deu.exe
2015-05-16 18:09 - 2015-05-16 18:09 - 00000000 ____D () C:\Users\Ernst\Desktop\FRST-OlderVersion
2015-05-16 17:37 - 2015-05-16 17:37 - 00000957 _____ () C:\Users\Ernst\Desktop\JRT.txt
2015-05-16 17:33 - 2015-05-16 17:33 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-ELINEU-Windows-7-Home-Premium-(32-bit).dat
2015-05-16 17:33 - 2015-05-16 17:33 - 00000000 ____D () C:\RegBackup
2015-05-16 17:08 - 2015-05-16 17:28 - 00000000 ____D () C:\AdwCleaner
2015-05-16 17:07 - 2015-05-16 17:07 - 00005754 _____ () C:\Users\Ernst\Desktop\mbam.txt
2015-05-16 15:47 - 2015-05-16 15:47 - 02719698 _____ (Thisisu) C:\Users\Ernst\Desktop\JRT.exe
2015-05-16 15:47 - 2015-05-16 15:47 - 02209792 _____ () C:\Users\Ernst\Desktop\AdwCleaner_4.204.exe
2015-05-16 15:46 - 2015-05-16 15:47 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Ernst\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-16 09:27 - 2015-05-16 09:27 - 00025726 _____ () C:\ComboFix.txt
2015-05-16 08:57 - 2015-05-16 09:28 - 00000000 ____D () C:\Qoobox
2015-05-16 08:57 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-16 08:57 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-16 08:57 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-16 08:57 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-16 08:57 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-16 08:57 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-16 08:57 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-16 08:57 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-16 08:53 - 2015-05-16 08:53 - 05623645 ____R (Swearware) C:\Users\Ernst\Desktop\ComboFix.exe
2015-05-15 14:29 - 2015-05-15 14:29 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Ernst\Desktop\tdsskiller.exe
2015-05-15 13:06 - 2015-05-15 14:28 - 00000000 ____D () C:\Users\Ernst\Desktop\mbar
2015-05-15 13:05 - 2015-05-15 13:05 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Ernst\Desktop\mbar-1.09.1.1004.exe
2015-05-15 12:10 - 2015-05-15 12:10 - 00009408 _____ () C:\Users\Ernst\Desktop\gmer.log
2015-05-15 11:11 - 2015-05-15 11:16 - 00061716 _____ () C:\Users\Ernst\Desktop\Addition.txt
2015-05-15 11:09 - 2015-05-18 07:51 - 00018007 _____ () C:\Users\Ernst\Desktop\FRST.txt
2015-05-15 11:09 - 2015-05-18 07:51 - 00000000 ____D () C:\FRST
2015-05-15 11:09 - 2015-05-15 11:09 - 00000446 _____ () C:\Users\Ernst\Desktop\defogger_disable.log
2015-05-15 11:09 - 2015-05-15 11:09 - 00000000 _____ () C:\Users\Ernst\defogger_reenable
2015-05-15 07:58 - 2015-05-15 07:58 - 00380416 _____ () C:\Users\Ernst\Desktop\Gmer-19357.exe
2015-05-15 07:56 - 2015-05-16 18:09 - 01146368 _____ (Farbar) C:\Users\Ernst\Desktop\FRST.exe
2015-05-15 07:55 - 2015-05-15 07:55 - 00050477 _____ () C:\Users\Ernst\Desktop\Defogger.exe
2015-05-14 14:45 - 2015-05-18 06:21 - 00230373 _____ () C:\Windows\WindowsUpdate.log
2015-05-14 14:43 - 2015-05-16 17:30 - 00000280 _____ () C:\Windows\setupact.log
2015-05-14 14:43 - 2015-05-14 14:43 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-14 14:42 - 2015-05-16 10:02 - 00004172 _____ () C:\Windows\PFRO.log
2015-05-14 14:42 - 2015-05-14 14:42 - 00567896 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 14:03 - 2015-05-14 14:03 - 00182064 _____ () C:\Users\Ernst\AppData\Local\GDIPFONTCACHEV1.DAT
2015-05-14 10:24 - 2015-05-14 10:24 - 00000000 ____D () C:\Program Files\Doblon
2015-05-14 03:36 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 17:30 - 2015-05-15 07:41 - 00000000 ____D () C:\Program Files\Quick Login for Google Accounts
2015-05-13 13:30 - 2015-05-13 17:12 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\MediaMonkey
2015-05-13 13:30 - 2015-05-13 13:30 - 00000000 ____D () C:\Users\Ernst\AppData\Local\MediaMonkey
2015-05-13 08:15 - 2015-05-14 10:15 - 00000000 ____D () C:\Program Files\Karaoke5
2015-05-13 07:43 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 07:43 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 07:43 - 2015-04-21 18:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 07:43 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 07:43 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 07:43 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 07:43 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 07:43 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 07:43 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 07:43 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 07:43 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 07:43 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 07:43 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 07:43 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 07:43 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 07:43 - 2015-04-21 17:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 07:43 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 07:43 - 2015-04-21 17:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 07:43 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 07:43 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 07:43 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 07:43 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 07:43 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 07:43 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 07:43 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 07:43 - 2015-04-21 17:26 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 07:43 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 07:43 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 07:43 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 07:43 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 07:43 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 07:43 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 07:42 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-05-13 07:42 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 07:42 - 2015-04-27 21:11 - 00137664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 07:42 - 2015-04-27 21:11 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 07:42 - 2015-04-27 21:08 - 01307648 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00851456 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 07:42 - 2015-04-27 21:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 07:42 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 07:42 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 07:42 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 07:42 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 07:42 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 07:42 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 07:42 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 07:42 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 07:42 - 2015-04-27 20:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 07:42 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 07:42 - 2015-04-20 04:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 07:42 - 2015-04-20 04:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 07:42 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 07:41 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 07:41 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 07:41 - 2015-04-13 05:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 07:36 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 07:36 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 07:36 - 2015-03-04 06:10 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 07:36 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 07:32 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 07:32 - 2015-04-08 05:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 07:32 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-12 14:41 - 2015-05-12 14:45 - 00000000 ____D () C:\Users\Ernst\Desktop\2015-05-12
2015-05-10 18:11 - 2015-05-10 18:11 - 00003549 _____ () C:\Users\Ernst\Documents\chrofreizeitfulda2015.nra
2015-05-10 08:46 - 2015-05-10 08:51 - 00000000 ____D () C:\Users\Ernst\Desktop\2015-05-10
2015-05-07 14:31 - 2015-05-07 14:31 - 00000000 ____D () C:\Users\Ernst\.chili
2015-05-03 10:27 - 2015-05-03 10:29 - 218207212 _____ () C:\Users\Ernst\Downloads\Med7v801(2).exe
2015-05-02 20:26 - 2015-05-02 20:26 - 23308160 _____ (TomTom International B.V.) C:\Users\Ernst\Downloads\InstallMyDriveConnect.exe
2015-04-30 20:40 - 2015-04-30 20:40 - 00000000 ____D () C:\med7BDT
2015-04-30 13:31 - 2015-04-30 13:31 - 28995288 _____ (DVDVideoSoft Ltd. ) C:\Users\Ernst\Downloads\FreeAudioCDToMP3Converter.exe
2015-04-25 09:33 - 2015-04-25 09:35 - 219637741 _____ () C:\Users\Ernst\Downloads\Med7v801(1).exe
2015-04-23 14:45 - 2015-05-14 11:48 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-22 07:45 - 2015-04-22 07:46 - 39074536 _____ (Microsoft Corporation) C:\Users\Ernst\Downloads\FileFormatConverters.exe
2015-04-18 07:20 - 2015-04-18 07:23 - 219637741 _____ () C:\Users\Ernst\Downloads\Med7v801.exe
2015-04-18 07:01 - 2015-04-18 07:10 - 816849717 _____ () C:\Users\Ernst\Downloads\MMI_PHARMINDEX_2015_Q2_20150315_17.1.0.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-18 07:30 - 2011-01-08 10:44 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-18 06:57 - 2012-09-23 10:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-18 03:30 - 2011-01-08 10:44 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-17 19:01 - 2010-06-08 20:37 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\Audacity
2015-05-17 14:52 - 2010-01-16 14:43 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-16 17:41 - 2009-07-14 06:34 - 00023168 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-16 17:41 - 2009-07-14 06:34 - 00023168 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-16 17:30 - 2015-03-21 11:14 - 00000266 _____ () C:\Windows\Tasks\AbelssoftPreloader.job
2015-05-16 17:30 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-16 15:50 - 2015-03-10 21:44 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-16 15:49 - 2015-03-10 21:43 - 00001058 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-05-16 15:49 - 2015-03-10 21:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-16 15:49 - 2015-03-10 21:43 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-05-16 09:23 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2015-05-16 08:56 - 2015-03-06 13:41 - 00000000 ____D () C:\Windows\erdnt
2015-05-15 14:28 - 2015-03-06 15:14 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-15 13:11 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\security
2015-05-15 11:09 - 2010-01-16 14:40 - 00000000 ____D () C:\Users\Ernst
2015-05-14 22:03 - 2014-10-01 14:23 - 00000000 ____D () C:\Windows\rescache
2015-05-14 14:41 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-05-14 14:24 - 2009-07-14 10:56 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-14 13:55 - 2013-09-14 12:45 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-14 12:01 - 2015-04-02 18:31 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2015-05-14 12:01 - 2013-11-04 14:46 - 00000000 ____D () C:\Users\Ernst\AppData\Local\Help
2015-05-14 12:01 - 2011-08-22 16:37 - 00000000 ____D () C:\ProgramData\tmp
2015-05-14 12:01 - 2010-05-06 13:32 - 00000000 ____D () C:\temp
2015-05-14 12:01 - 2010-03-16 23:02 - 00000000 ____D () C:\Program Files\iPhoto Plus 4
2015-05-14 12:01 - 2010-02-07 11:43 - 00000000 ____D () C:\med7net
2015-05-14 12:01 - 2010-02-07 11:42 - 00000000 ____D () C:\Med7
2015-05-14 11:49 - 2014-01-27 15:35 - 00000000 ____D () C:\Program Files\PDF24
2015-05-14 11:49 - 2013-08-25 09:33 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\TeamViewer
2015-05-14 11:49 - 2010-01-18 17:53 - 00000000 ____D () C:\Program Files\K-Lite Codec Pack
2015-05-14 11:49 - 2010-01-16 14:45 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-05-14 11:48 - 2015-02-01 10:50 - 00000000 ____D () C:\ProgramData\install_clap
2015-05-14 11:48 - 2013-11-04 09:19 - 00000000 ____D () C:\Users\Ernst\AppData\Local\NETGEARGenie
2015-05-14 11:48 - 2011-01-23 11:06 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\vlc
2015-05-14 11:47 - 2014-06-29 13:35 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\MusicNet
2015-05-14 11:47 - 2011-07-09 19:56 - 00000000 ____D () C:\Windows\Minidump
2015-05-14 11:47 - 2010-01-18 18:06 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\Media Player Classic
2015-05-14 04:08 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-05-14 03:55 - 2012-08-30 18:58 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-14 03:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-14 03:34 - 2015-04-16 03:09 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-14 03:15 - 2010-12-08 23:11 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-14 03:08 - 2012-08-30 18:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 13:17 - 2010-01-17 15:09 - 00000349 _____ () C:\Users\Public\Documents\PCLECHAL.INI
2015-05-12 14:55 - 2013-11-09 19:20 - 00000000 ____D () C:\Users\Ernst\AppData\Local\FRITZ!
2015-05-10 17:07 - 2014-09-15 15:57 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft
2015-05-10 17:07 - 2013-09-06 18:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-05-10 17:07 - 2013-09-06 18:49 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\DVDVideoSoft
2015-05-10 17:07 - 2013-09-06 18:49 - 00000000 ____D () C:\Program Files\DVDVideoSoft
2015-05-02 20:58 - 2010-02-05 19:46 - 00000000 ____D () C:\Program Files\Java
2015-05-02 20:56 - 2015-03-18 18:50 - 00096352 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-05-02 20:27 - 2014-12-30 14:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2015-05-02 20:27 - 2014-12-30 14:13 - 00000000 ____D () C:\Program Files\MyDrive Connect
2015-05-02 11:06 - 2015-01-23 18:56 - 00000000 ____D () C:\Users\Ernst\AppData\Roaming\Steganos
2015-05-02 10:26 - 2010-02-09 14:39 - 00000024 _____ () C:\ProgramData\__FileUploader.log
2015-05-01 09:58 - 2010-09-07 14:11 - 00000000 ____D () C:\Users\Ernst\Documents\DVDVideoSoft
2015-05-01 09:54 - 2010-11-27 22:01 - 00001971 _____ () C:\Users\Ernst\Documents\GNMIDI.ini
2015-04-30 13:32 - 2014-09-15 15:57 - 00001197 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2015-04-25 09:24 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-25 09:23 - 2012-05-06 18:05 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-22 07:48 - 2010-01-19 14:28 - 00000000 ____D () C:\Program Files\Microsoft Office
2015-04-22 07:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2015-04-18 10:56 - 2014-10-23 13:17 - 00001656 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Med7 Arztpraxisprogramm.lnk
2015-04-18 10:36 - 2010-02-07 11:40 - 00000000 ____D () C:\Windows\Downloaded Installations

==================== Files in the root of some directories =======

2010-11-13 18:16 - 2010-11-13 18:16 - 0000604 ____H () C:\Program Files\STFT Notifier
2014-05-08 14:45 - 2014-05-08 14:45 - 0000000 _____ () C:\Users\Ernst\AppData\Roaming\gdfw.log
2014-05-08 14:45 - 2015-03-16 14:53 - 0003116 _____ () C:\Users\Ernst\AppData\Roaming\gdscan.log
2010-01-16 20:02 - 2010-01-15 23:42 - 4302944 _____ () C:\Users\Ernst\AppData\Roaming\IMAG0023.AVI
2014-05-14 21:54 - 2014-05-14 22:06 - 0028268 _____ () C:\Users\Ernst\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2014-12-07 12:01 - 2014-12-07 12:03 - 0583820 _____ () C:\Users\Ernst\AppData\Roaming\Scorch_Install.log
2010-03-08 23:21 - 2010-03-08 23:31 - 0282624 _____ () C:\Users\Ernst\AppData\Local\filesync.metadata
2010-02-09 14:39 - 2015-05-02 10:26 - 0000024 _____ () C:\ProgramData\__FileUploader.log

Some content of TEMP:
====================
C:\Users\Ernst\AppData\Local\temp\Quarantine.exe
C:\Users\Ernst\AppData\Local\temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-14 21:54

==================== End Of Log ============================
--- --- ---

--- --- ---

FRAGE: Hatte mein Rechner eine Infektion abbekommen oder war es "falscher Alarm"?
Ansonsten habe ich keine Probleme (z.ZT.)
Vielen Dank für die Hilfe!
Erlu

FRAGE: Hatte mein Rechner eine Infektion abbekommen oder war es "falscher Alarm"?

schrauber 19.05.2015 07:21
Wir haben nur en bissl Adware entfernt :)


Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
http://deeprybka.trojaner-board.de/b.../combofix2.pngCombofix deinstallieren .
  • Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  • Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
  • Klicke auf OK.
    Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
  • Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte http://filepony.de/icon/tiny/delfix.pngDelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:

http://deeprybka.trojaner-board.de/b...ast/schild.pngAbsicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
 Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:
http://filepony.de/icon/emsisoft_anti_malware.png
Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
http://filepony.de/icon/noscript.png NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
http://filepony.de/icon/malwarebytes_anti_exploit.pngMalwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie http://filepony.de/images/microbanner.gif.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwarecleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Erlu 19.05.2015 13:16
Danke!

schrauber 20.05.2015 06:40
Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 22:28 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131