| |
| |||||||
Log-Analyse und Auswertung: TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer FunktionWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
17.02.2013, 21:33
| #1 |
 |  TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion Hallo, bisher habe ich mir noch durch dieses tolle Board und Google selbst helfen können, doch nun bin ich an einem Punkt wo ich nicht mehr weiter weiß außer das System zu plätten. Folgendes Szenario: Mein Schwiegervater hat einen Link in einer E-Mail von einem Bekannten geöffnet. Die Website auf die er geleitet wurde war leider scheinbar präpariert. Ihm ist es auch sofort aufgefallen, allerdings eben zu spät. Die kostenlose Version von Avira Antivir hat nach einem Komplettscan zwei Malwares gefunden. Einmal einen TR.Necurs.A im Java Ordner (zu der Zeit Version Java 6 Update 9 ), der wohl durch eine Sicherheitslücke im veralteten Java als Drive-by Download dort gelandet ist. Entdeckt heute morgen (So, 17.02.2013) um 11:07 nach knapp 72 minütigem Scan von Avira. Ebenfalls entdeckt zur gleichen Zeit eine Datei mit zufälligem Namen .exe als TR.Gen. Ich bin heute um 18 Uhr eingetroffen und habe das System begutachtet. Beide Funde waren in Quarantäne. Auffällig war sofort, dass die Avira Echtzeitscanner nicht liefen und sich auch nicht aktivieren ließen. Bei dem System handelt es sich um ein Windows XP SP3 (legale Kopie mit aktuellen Updates bis ca Februar 2013) Ich habe dann angefangen die Sicherheitslücken zu schließen. Das alte Java deinstalliert und Java 6 Update 39 installiert. Flash Player update gemacht. Ich wollte dann Adobe Reader updaten, weil da noch eine Version 9 drauf war, dies war aber nicht möglich. Auch eine Neuinstallation vom Adobe Reader hat nicht funktioniert. Die Installation nach dem Ausführen vom Acrobat IT Tools Cleaner auch nicht. Ist aber vielleicht ein anderes Problem, will es nur der Vollständigkeit halber erwähnen. Im Anschluss habe ich das funktionsunfähige Avira Antivir deinstalliert, neugestartet und McAfee installiert. Dieser Scanner hat ebenfalls nicht funktioniert. Also den auch wieder deinstalliert, neustart, und Avast installiert. Dann erneut den PC gestartet. Gleiches Problem, Scanner funktionieren nicht, Updates der Virendefinitionen oder Programm gehen auch nicht, Reparatur auch nicht. Den Avast Dienst manuell über die Verwaltung starten ging ebenfalls nicht. Folgender Error:  Windows Updates sind deaktiviert, obwohl sie in der Systemsteuerung bei Windows Update aktiviert sind. Sicherheitscenter meldet aber deaktiviert. Manuell nach Updates suchen (bei XP über den IE) funktioniert ebenfalls nicht. Windows Firewall wird bei jedem Systemstart wieder deaktiviert. Habe dann in der Registry nach seltsamen Starteinträgen gesucht, Hijackthis laufen lassen und den Report zur Onlineauswertung auf der Homepage gegeben. Leider bin ich auf nichts gestoßen. Die Dateien bzw. Registryeinträge, die laut Google von TR.Necurs.A angelegt werden sollten, finde ich ebenfalls nicht, wie z. B. hier beschrieben hxxp://blog.yoocare.com/remove-trojanwin64necurs-a-virus-permanently-manual-removal Ich habe dann die drei Schritte aus der Anleitung befolgt und poste euch nun hier die Ergebnisse des Scans. Direkt vorweg, leider hat der Scan mit GMER nicht recht funktioniert. Es kamen mehrere Errors und dann meinte er, er hätte nichts gefunden, und hat mir auch kein Logfile angezeigt. Netzwerkverbindungen waren deaktiviert und Prozesse auch soweit Möglich beendet. Ich hoffe ihr könnt mir und meinem Schwiegervater weiterhelfen. Auf dem System sind natürlich wichtige Daten wie Word und PDF Dokumente, E-Mails und Bilder, und leider existiert kein Backup. Aufgrund der vermuteten Infektion habe ich allerdings vorerst von einem Überspielen der Daten auf einen externen Datenträger abgeraten. OTL.txt:OTL Logfile: Code:
ATTFilter OTL logfile created on: 17.02.2013 19:57:30 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Alfred\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy 3,25 Gb Total Physical Memory | 2,68 Gb Available Physical Memory | 82,57% Memory free 4,58 Gb Paging File | 4,11 Gb Available in Paging File | 89,84% Paging File free Paging file location(s): C:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 216,87 Gb Total Space | 23,74 Gb Free Space | 10,95% Space Free | Partition Type: NTFS Drive D: | 16,00 Gb Total Space | 12,15 Gb Free Space | 75,90% Space Free | Partition Type: NTFS Computer Name: HP1 | User Name: Alfred | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.02.17 19:55:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Alfred\Desktop\OTL.exe PRC - [2013.01.26 03:35:08 | 001,248,208 | ---- | M] (Google Inc.) -- C:\Programme\Google\Chrome\Application\chrome.exe PRC - [2013.01.20 20:29:18 | 028,539,272 | ---- | M] (Dropbox, Inc.) -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Dropbox\bin\Dropbox.exe PRC - [2012.10.30 23:50:59 | 004,297,136 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe PRC - [2010.04.05 11:55:01 | 000,116,104 | ---- | M] () -- C:\Programme\Canon\IJPLM\ijplmsvc.exe PRC - [2010.02.18 11:38:40 | 000,684,680 | ---- | M] (SPAMfighter) -- C:\Programme\Common Files\Common Toolkit Suite\FighterSuiteService.exe PRC - [2010.02.03 12:57:56 | 000,389,120 | R--- | M] (Teleca) -- C:\Programme\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe PRC - [2009.12.11 13:50:34 | 000,557,056 | R--- | M] (Teleca AB) -- C:\Programme\Gemeinsame Dateien\Teleca Shared\Generic.exe PRC - [2009.11.19 15:19:48 | 000,598,016 | R--- | M] (Teleca Sweden AB) -- C:\Programme\HTC\HTC Sync\Application Launcher\Application Launcher.exe PRC - [2009.09.29 11:29:00 | 000,356,352 | R--- | M] (Teleca Sweden AB) -- C:\Programme\HTC\HTC Sync\Mobile Phone Monitor\dbgout.exe PRC - [2009.09.29 11:28:26 | 001,011,712 | R--- | M] (Teleca Sweden AB) -- C:\Programme\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe PRC - [2009.09.29 11:03:26 | 000,253,952 | R--- | M] (TODO: <Company name>) -- C:\Programme\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe PRC - [2009.09.29 11:03:02 | 000,462,848 | R--- | M] (Teleca AB) -- C:\Programme\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe PRC - [2009.08.27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) -- C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\FABS.exe PRC - [2009.08.19 21:54:13 | 000,271,744 | ---- | M] (IncrediMail, Ltd.) -- C:\Programme\IncrediMail\Bin\IncMail.exe PRC - [2009.08.19 21:54:13 | 000,210,304 | ---- | M] (IncrediMail, Ltd.) -- C:\Programme\IncrediMail\Bin\ImApp.exe PRC - [2009.06.03 08:25:16 | 000,106,496 | R--- | M] (Popwire AB) -- C:\Programme\Gemeinsame Dateien\Teleca Shared\logger.exe PRC - [2009.04.14 11:14:26 | 000,139,264 | ---- | M] (Teleca Sweden AB) -- C:\Programme\Gemeinsame Dateien\Teleca Shared\CapabilityManager.exe PRC - [2008.10.03 22:58:58 | 000,962,480 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe PRC - [2008.10.03 22:55:12 | 004,378,000 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe PRC - [2008.10.03 21:40:00 | 000,165,144 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe PRC - [2008.10.03 21:39:54 | 000,554,264 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe PRC - [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2008.04.07 07:10:52 | 000,576,024 | ---- | M] (PDF Complete Inc) -- C:\Programme\PDF Complete\pdfsvc.exe PRC - [2007.08.09 08:27:52 | 000,073,728 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe PRC - [2007.01.31 13:55:42 | 000,096,370 | ---- | M] (Canon Inc.) -- C:\Programme\Canon\CAL\CALMAIN.exe PRC - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) -- C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe PRC - [2006.09.25 08:12:20 | 000,045,056 | ---- | M] (ATI Technologies Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\CLI.exe PRC - [2006.07.10 10:53:08 | 000,872,448 | ---- | M] () -- C:\WINDOWS\SMINST\Scheduler.exe ========== Modules (No Company Name) ========== MOD - [2013.01.10 22:11:30 | 003,391,488 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_e7cef47e\mscorlib.dll MOD - [2013.01.10 22:11:28 | 000,843,776 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_f6d7c91e\system.drawing.dll MOD - [2013.01.10 22:11:19 | 002,088,960 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_72ede471\system.xml.dll MOD - [2013.01.10 22:11:13 | 003,035,136 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_2717e290\system.windows.forms.dll MOD - [2013.01.10 22:11:03 | 001,966,080 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_e2bf0d85\system.dll MOD - [2013.01.10 22:10:53 | 001,269,760 | ---- | M] () -- c:\windows\assembly\gac\system.web\1.0.5000.0__b03f5f7f11d50a3a\system.web.dll MOD - [2013.01.10 22:10:53 | 001,232,896 | ---- | M] () -- c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll MOD - [2013.01.10 22:10:52 | 000,471,040 | ---- | M] () -- c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll MOD - [2013.01.10 22:10:50 | 002,064,384 | ---- | M] () -- c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll MOD - [2010.04.05 11:55:01 | 000,116,104 | ---- | M] () -- C:\Programme\Canon\IJPLM\ijplmsvc.exe MOD - [2010.02.10 17:08:38 | 000,237,361 | R--- | M] () -- C:\Programme\HTC\HTC Sync\Mobile Phone Monitor\fsync.dll MOD - [2010.02.10 17:08:38 | 000,237,361 | R--- | M] () -- C:\Programme\HTC\HTC Sync\ClientInitiatedStarter\fsync.dll MOD - [2009.09.29 11:24:24 | 000,139,264 | R--- | M] () -- C:\Programme\HTC\HTC Sync\Mobile Phone Monitor\tcpsock_object.dll MOD - [2009.08.19 21:54:14 | 000,230,784 | ---- | M] () -- C:\Programme\IncrediMail\Bin\ImLookExU.dll MOD - [2009.08.19 21:54:14 | 000,071,040 | ---- | M] () -- C:\Programme\IncrediMail\Bin\wlessfp1.dll MOD - [2009.08.19 21:54:13 | 000,116,096 | ---- | M] () -- C:\Programme\IncrediMail\Bin\ImComUtlU.dll MOD - [2009.08.19 21:54:13 | 000,079,232 | ---- | M] () -- C:\Programme\IncrediMail\Bin\ImAppRU.dll MOD - [2009.03.25 02:24:28 | 001,339,392 | ---- | M] () -- c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll MOD - [2009.03.25 02:24:28 | 000,372,736 | ---- | M] () -- c:\windows\assembly\gac\system.management\1.0.5000.0__b03f5f7f11d50a3a\system.management.dll MOD - [2009.03.25 02:24:27 | 000,323,584 | ---- | M] () -- c:\windows\assembly\gac\system.runtime.remoting\1.0.5000.0__b77a5c561934e089\system.runtime.remoting.dll MOD - [2009.03.25 02:23:40 | 000,233,472 | ---- | M] () -- c:\windows\assembly\gac\mscorlib.resources\1.0.5000.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2009.03.25 02:23:40 | 000,180,224 | ---- | M] () -- c:\windows\assembly\gac\system.windows.forms.resources\1.0.5000.0_de_b77a5c561934e089\system.windows.forms.resources.dll MOD - [2008.04.14 03:22:16 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll MOD - [2007.01.11 16:33:20 | 000,106,496 | R--- | M] () -- C:\Programme\Gemeinsame Dateien\Teleca Shared\boost_log-vc80-mt-1_33.dll MOD - [2006.07.10 10:53:08 | 000,872,448 | ---- | M] () -- C:\WINDOWS\SMINST\Scheduler.exe ========== Services (SafeList) ========== SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ) SRV - File not found [Auto | Stopped] -- -- (0208231241116309mcinstcleanup) SRV - [2013.02.17 18:47:23 | 000,251,248 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.02.01 12:26:44 | 000,061,696 | ---- | M] () [Unknown (-1) | Unknown] -- C:\WINDOWS\System32\drivers\cb010bd02561def3.sys -- (cb010bd02561def3) SRV - [2013.02.01 12:26:37 | 000,074,240 | ---- | M] () [Auto | Running] -- C:\WINDOWS\Installer\{2A781366-67FF-1FE0-3C30-7D941BF2EEAB}\syshost.exe -- (syshost32) SRV - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Stopped] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus) SRV - [2010.04.05 11:55:01 | 000,116,104 | ---- | M] () [Auto | Running] -- C:\Programme\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC) SRV - [2010.02.18 11:38:40 | 000,684,680 | ---- | M] (SPAMfighter) [Auto | Running] -- C:\Programme\Common Files\Common Toolkit Suite\FighterSuiteService.exe -- (Common Toolkit Service) SRV - [2009.11.08 10:49:57 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2009.08.27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\FABS.exe -- (Fabs) SRV - [2008.10.03 21:39:54 | 000,554,264 | ---- | M] (Acronis) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc) SRV - [2008.08.07 11:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) SRV - [2008.04.07 07:10:52 | 000,576,024 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Programme\PDF Complete\pdfsvc.exe -- (pdfcDispatcher) SRV - [2007.08.09 08:27:52 | 000,073,728 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12) SRV - [2007.01.31 13:55:42 | 000,096,370 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Programme\Canon\CAL\CALMAIN.exe -- (CCALib8) SRV - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr) SRV - [2006.12.14 16:00:00 | 000,544,768 | ---- | M] (Magix AG) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService) SRV - [2003.07.28 11:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - [2013.02.01 12:26:44 | 000,061,696 | ---- | M] () [Unknown (-1) | Unknown (-1) | Unknown] -- C:\WINDOWS\System32\drivers\cb010bd02561def3.sys -- (cb010bd02561def3) DRV - [2012.10.30 23:51:58 | 000,738,504 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx) DRV - [2012.10.30 23:51:58 | 000,361,032 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2012.10.30 23:51:58 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2012.10.30 23:51:58 | 000,035,928 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (AswRdr) DRV - [2012.10.30 23:51:57 | 000,097,608 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2012.10.30 23:51:56 | 000,025,256 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2012.10.30 23:51:56 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2012.07.04 15:05:05 | 000,139,784 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\rdpwd.sys -- (RDPWD) DRV - [2011.08.17 14:49:54 | 000,138,496 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\afd.sys -- (AFD) DRV - [2011.07.15 14:29:31 | 000,456,320 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\System32\DRIVERS\mrxsmb.sys -- (MRxSmb) DRV - [2011.07.08 15:02:00 | 000,010,496 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\ndistapi.sys -- (NdisTapi) DRV - [2011.04.21 14:37:43 | 000,105,472 | ---- | M] () [File_System | Boot | Running] -- C:\WINDOWS\System32\drivers\mup.sys -- (Mup) DRV - [2011.02.17 14:18:03 | 000,357,888 | ---- | M] () [File_System | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\srv.sys -- (Srv) DRV - [2010.11.02 16:17:02 | 000,040,960 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\ndproxy.sys -- (NDProxy) DRV - [2009.11.10 10:43:53 | 000,585,280 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\emBDA.sys -- (USB28xxBGA) DRV - [2009.11.10 10:43:53 | 000,549,952 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\emOEM.sys -- (USB28xxOEM) DRV - [2009.11.08 10:39:20 | 000,721,904 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd) DRV - [2009.10.20 17:20:16 | 000,265,728 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\HTTP.sys -- (HTTP) DRV - [2009.09.13 14:50:42 | 000,971,168 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\tdrpm140.sys -- (tdrpman140) DRV - [2009.09.13 14:50:38 | 000,540,000 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\timntr.sys -- (timounter) DRV - [2009.09.13 14:50:38 | 000,044,704 | ---- | M] () [File_System | Auto | Running] -- C:\WINDOWS\System32\DRIVERS\tifsfilt.sys -- (tifsfilter) DRV - [2009.09.13 14:50:34 | 000,134,272 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\snman380.sys -- (snapman380) DRV - [2009.06.24 12:18:41 | 000,092,928 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\ksecdd.sys -- (KSecDD) DRV - [2009.06.10 15:49:32 | 000,024,576 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\ANDROIDUSB.sys -- (HTCAND32) DRV - [2008.07.11 14:44:00 | 000,191,872 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\System32\drivers\fslx.sys -- (FSLX) DRV - [2008.06.20 12:51:12 | 000,361,600 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\DRIVERS\tcpip.sys -- (Tcpip) DRV - [2008.04.25 12:36:53 | 000,091,776 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\ndiswan.sys -- (NdisWan) DRV - [2008.04.25 12:36:51 | 000,182,912 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\ndis.sys -- (NDIS) DRV - [2008.04.14 03:23:26 | 000,040,840 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\DRIVERS\termdd.sys -- (TermDD) DRV - [2008.04.14 03:23:26 | 000,021,896 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\tdtcp.sys -- (TDTCP) DRV - [2008.04.14 03:23:26 | 000,012,040 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\tdpipe.sys -- (TDPIPE) DRV - [2008.04.14 03:02:33 | 000,073,472 | ---- | M] () [File_System | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\sr.sys -- (sr) DRV - [2008.04.14 03:02:16 | 000,120,576 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\pcmcia.sys -- (Pcmcia) DRV - [2008.04.14 03:02:13 | 000,068,224 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\pci.sys -- (PCI) DRV - [2008.04.14 03:02:10 | 000,080,384 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\parport.sys -- (Parport) DRV - [2008.04.14 03:02:08 | 000,046,848 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\System32\DRIVERS\p3.sys -- (P3) DRV - [2008.04.14 02:58:36 | 000,025,216 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\DRIVERS\kbdclass.sys -- (Kbdclass) DRV - [2008.04.14 02:58:18 | 000,154,112 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\dmio.sys -- (dmio) DRV - [2008.04.14 02:58:13 | 000,800,384 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\dmboot.sys -- (dmboot) DRV - [2008.04.14 02:58:03 | 000,037,632 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\isapnp.sys -- (isapnp) DRV - [2008.04.14 02:57:20 | 000,040,448 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\DRIVERS\intelppm.sys -- (intelppm) DRV - [2008.04.14 02:57:19 | 000,005,504 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\intelide.sys -- (IntelIde) DRV - [2008.04.14 02:55:34 | 000,052,992 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\DRIVERS\i8042prt.sys -- (i8042prt) DRV - [2008.04.14 02:54:59 | 000,065,536 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\System32\DRIVERS\serial.sys -- (Serial) DRV - [2008.04.14 02:52:51 | 000,057,728 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\DRIVERS\redbook.sys -- (redbook) DRV - [2008.04.14 02:52:51 | 000,044,672 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\fips.sys -- (Fips) DRV - [2008.04.14 02:52:02 | 000,053,760 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\volsnap.sys -- (VolSnap) DRV - [2008.04.14 02:49:36 | 000,023,552 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\DRIVERS\mouclass.sys -- (Mouclass) DRV - [2008.04.14 02:49:32 | 000,030,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\modem.sys -- (Modem) DRV - [2008.04.14 02:49:03 | 000,188,800 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ACPI.sys -- (ACPI) DRV - [2008.04.14 00:16:24 | 000,015,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\MPE.sys -- (MPE) DRV - [2008.04.14 00:15:14 | 000,060,032 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\usbaudio.sys -- (usbaudio) DRV - [2008.04.13 20:46:26 | 000,085,248 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\NABTSFEC.sys -- (NABTSFEC) DRV - [2008.04.13 20:46:24 | 000,019,200 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\WSTCODEC.SYS -- (WSTCODEC) DRV - [2008.04.13 20:46:24 | 000,017,024 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\CCDECODE.sys -- (CCDECODE) DRV - [2008.04.13 20:46:24 | 000,011,136 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\SLIP.sys -- (SLIP) DRV - [2008.04.13 20:46:22 | 000,015,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\StreamIP.sys -- (streamip) DRV - [2008.04.13 20:46:22 | 000,010,880 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\NdisIP.sys -- (NdisIP) DRV - [2008.04.13 20:46:20 | 000,048,128 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\61883.sys -- (61883) DRV - [2008.04.13 20:46:20 | 000,038,912 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\avc.sys -- (Avc) DRV - [2008.04.13 20:46:10 | 000,051,200 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\msdv.sys -- (MSDV) DRV - [2008.04.13 20:39:50 | 000,005,504 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\MSTEE.sys -- (MSTEE) DRV - [2008.04.13 20:28:39 | 000,175,744 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\System32\DRIVERS\rdbss.sys -- (Rdbss) DRV - [2008.04.13 20:21:00 | 000,162,816 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\DRIVERS\netbt.sys -- (NetBT) DRV - [2008.04.13 20:19:48 | 000,048,384 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\raspptp.sys -- (PptpMiniport) DRV - [2008.04.13 20:19:43 | 000,051,328 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\rasl2tp.sys -- (Rasl2tp) DRV - [2008.04.13 20:19:42 | 000,075,264 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\DRIVERS\ipsec.sys -- (IPSec) DRV - [2008.04.13 20:17:18 | 000,083,072 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\wdmaud.sys -- (wdmaud) DRV - [2008.04.13 20:15:55 | 000,060,800 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\sysaudio.sys -- (sysaudio) DRV - [2008.04.13 20:15:53 | 000,574,976 | ---- | M] () [File_System | Disabled | Running] -- C:\WINDOWS\System32\drivers\ntfs.sys -- (Ntfs) DRV - [2008.04.13 20:14:29 | 000,143,744 | ---- | M] () [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\fastfat.sys -- (Fastfat) DRV - [2008.04.13 20:14:21 | 000,063,744 | ---- | M] () [File_System | Disabled | Running] -- C:\WINDOWS\System32\drivers\cdfs.sys -- (Cdfs) DRV - [2008.04.13 19:57:32 | 000,041,472 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\raspppoe.sys -- (RasPppoe) DRV - [2008.04.13 19:57:27 | 000,014,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\asyncmac.sys -- (AsyncMac) DRV - [2008.04.13 19:57:21 | 000,034,560 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\wanarp.sys -- (Wanarp) DRV - [2008.04.13 19:57:15 | 000,152,832 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\ipnat.sys -- (IpNat) DRV - [2008.04.13 19:57:07 | 000,020,864 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\ipinip.sys -- (IpInIp) DRV - [2008.04.13 19:56:49 | 000,012,800 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\usb8023x.sys -- (usb_rndisx) DRV - [2008.04.13 19:56:38 | 000,069,120 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\psched.sys -- (PSched) DRV - [2008.04.13 19:56:32 | 000,035,072 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\msgpc.sys -- (Gpc) DRV - [2008.04.13 19:56:02 | 000,034,688 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\System32\DRIVERS\netbios.sys -- (NetBIOS) DRV - [2008.04.13 19:55:58 | 000,014,592 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\ndisuio.sys -- (Ndisuio) DRV - [2008.04.13 19:54:28 | 000,011,264 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\irenum.sys -- (IRENUM) DRV - [2008.04.13 19:53:34 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\ip6fw.sys -- (Ip6Fw) DRV - [2008.04.13 19:51:25 | 000,061,824 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\nic1394.sys -- (NIC1394) DRV - [2008.04.13 19:51:25 | 000,060,800 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\arp1394.sys -- (Arp1394) DRV - [2008.04.13 19:51:25 | 000,059,904 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\atmarpc.sys -- (Atmarpc) DRV - [2008.04.13 19:47:38 | 000,025,856 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\usbprint.sys -- (usbprint) DRV - [2008.04.13 19:46:18 | 000,061,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ohci1394.sys -- (ohci1394) DRV - [2008.04.13 19:45:40 | 000,032,128 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\usbccgp.sys -- (usbccgp) DRV - [2008.04.13 19:45:38 | 000,026,368 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS -- (USBSTOR) DRV - [2008.04.13 19:45:37 | 000,059,520 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\usbhub.sys -- (usbhub) DRV - [2008.04.13 19:45:35 | 000,030,208 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\usbehci.sys -- (usbehci) DRV - [2008.04.13 19:45:35 | 000,020,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\usbuhci.sys -- (usbuhci) DRV - [2008.04.13 19:45:34 | 000,015,104 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\usbscan.sys -- (usbscan) DRV - [2008.04.13 19:45:13 | 000,002,944 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\drmkaud.sys -- (drmkaud) DRV - [2008.04.13 19:45:09 | 000,172,416 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\kmixer.sys -- (kmixer) DRV - [2008.04.13 19:45:09 | 000,056,576 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\swmidi.sys -- (swmidi) DRV - [2008.04.13 19:45:07 | 000,006,272 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\splitter.sys -- (splitter) DRV - [2008.04.13 19:45:01 | 000,052,864 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\DMusic.sys -- (DMusic) DRV - [2008.04.13 19:44:40 | 000,020,992 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\vga.sys -- (VgaSave) DRV - [2008.04.13 19:40:58 | 000,042,112 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\DRIVERS\imapi.sys -- (Imapi) DRV - [2008.04.13 19:40:49 | 000,019,712 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\partmgr.sys -- (PartMgr) DRV - [2008.04.13 19:40:48 | 000,011,392 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\sfloppy.sys -- (Sfloppy) DRV - [2008.04.13 19:40:47 | 000,036,352 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\disk.sys -- (Disk) DRV - [2008.04.13 19:40:46 | 000,062,976 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\DRIVERS\cdrom.sys -- (Cdrom) DRV - [2008.04.13 19:40:30 | 000,096,512 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\atapi.sys -- (atapi) DRV - [2008.04.13 19:40:25 | 000,027,392 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\fdc.sys -- (Fdc) DRV - [2008.04.13 19:40:25 | 000,020,480 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\flpydisk.sys -- (Flpydisk) DRV - [2008.04.13 19:40:12 | 000,015,744 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\serenum.sys -- (serenum) DRV - [2008.04.13 19:39:53 | 000,004,352 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\swenum.sys -- (swenum) DRV - [2008.04.13 19:39:52 | 000,007,552 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\MSKSSRV.sys -- (MSKSSRV) DRV - [2008.04.13 19:39:51 | 000,004,992 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\MSPQM.sys -- (MSPQM) DRV - [2008.04.13 19:39:50 | 000,005,376 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\MSPCLOCK.sys -- (MSPCLOCK) DRV - [2008.04.13 19:39:46 | 000,042,368 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\mountmgr.sys -- (MountMgr) DRV - [2008.04.13 19:36:46 | 000,015,488 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\mssmbios.sys -- (mssmbios) DRV - [2008.04.13 19:32:59 | 000,129,792 | ---- | M] () [File_System | Boot | Running] -- C:\WINDOWS\System32\drivers\fltmgr.sys -- (FltMgr) DRV - [2008.04.13 19:32:51 | 000,196,224 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\rdpdr.sys -- (rdpdr) DRV - [2008.04.13 19:32:44 | 000,180,608 | ---- | M] () [File_System | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\mrxdav.sys -- (MRxDAV) DRV - [2008.04.13 19:32:39 | 000,030,848 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\System32\drivers\npfs.sys -- (Npfs) DRV - [2008.04.13 19:32:39 | 000,019,072 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\System32\drivers\msfs.sys -- (Msfs) DRV - [2008.04.13 19:32:36 | 000,066,048 | ---- | M] () [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\udfs.sys -- (Udfs) DRV - [2008.04.13 17:39:23 | 000,142,592 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\aec.sys -- (aec) DRV - [2008.01.19 09:45:28 | 000,503,144 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\wdf01000.sys -- (Wdf01000) DRV - [2008.01.03 23:10:16 | 000,105,856 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\Rtenicxp.sys -- (RTLE8023xp) DRV - [2007.11.06 18:23:56 | 004,622,848 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) DRV - [2007.07.27 11:46:06 | 000,251,680 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\acehlp10.sys -- (acehlp10) DRV - [2007.07.27 09:13:08 | 000,330,144 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\acedrv10.sys -- (acedrv10) DRV - [2007.06.29 11:46:12 | 000,253,824 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\GrabsterSeries.X86.SYS -- (GrabsterSeries.X86) DRV - [2006.11.22 04:25:10 | 002,829,824 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag) DRV - [2006.09.28 19:00:34 | 000,082,944 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wudfrd.sys -- (WudfRd) DRV - [2006.09.28 18:55:50 | 000,077,568 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\WudfPf.sys -- (WudfPf) DRV - [2006.02.28 03:00:00 | 000,126,336 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ftdisk.sys -- (Ftdisk) DRV - [2006.02.28 03:00:00 | 000,032,896 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys -- (IpFilterDriver) DRV - [2006.02.28 03:00:00 | 000,032,512 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - [2006.02.28 03:00:00 | 000,018,688 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\cdaudio.sys -- (Cdaudio) DRV - [2006.02.28 03:00:00 | 000,016,512 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\raspti.sys -- (Raspti) DRV - [2006.02.28 03:00:00 | 000,013,952 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\cbidf2k.sys -- (cbidf2k) DRV - [2006.02.28 03:00:00 | 000,012,416 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - [2006.02.28 03:00:00 | 000,012,160 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\acpiec.sys -- (ACPIEC) DRV - [2006.02.28 03:00:00 | 000,012,032 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\ws2ifsl.sys -- (WS2IFSL) DRV - [2006.02.28 03:00:00 | 000,008,832 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\DRIVERS\rasacd.sys -- (RasAcd) DRV - [2006.02.28 03:00:00 | 000,007,936 | ---- | M] () [Recognizer | System | Unknown] -- C:\WINDOWS\System32\drivers\fs_rec.sys -- (Fs_Rec) DRV - [2006.02.28 03:00:00 | 000,007,040 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\parvdm.sys -- (ParVdm) DRV - [2006.02.28 03:00:00 | 000,005,888 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\dmload.sys -- (dmload) DRV - [2006.02.28 03:00:00 | 000,004,224 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\DRIVERS\RDPCDD.sys -- (RDPCDD) DRV - [2006.02.28 03:00:00 | 000,004,224 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\mnmdd.sys -- (mnmdd) DRV - [2006.02.28 03:00:00 | 000,004,224 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\beep.sys -- (Beep) DRV - [2006.02.28 03:00:00 | 000,002,944 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\null.sys -- (Null) DRV - [2004.08.03 17:29:50 | 000,019,455 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wVchNTxx.sys -- (iAimFP4) DRV - [2004.08.03 17:29:48 | 000,012,063 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wSiINTxx.sys -- (iAimFP3) DRV - [2004.08.03 17:29:46 | 000,025,471 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wATV10nt.sys -- (iAimTV5) DRV - [2004.08.03 17:29:46 | 000,023,615 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wCh7xxNT.sys -- (iAimTV4) DRV - [2004.08.03 17:29:46 | 000,022,271 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wATV06nt.sys -- (iAimTV6) DRV - [2004.08.03 17:29:44 | 000,033,599 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wATV04nt.sys -- (iAimTV3) DRV - [2004.08.03 17:29:44 | 000,019,551 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wATV02NT.sys -- (iAimTV1) DRV - [2004.08.03 17:29:42 | 000,029,311 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wATV01nt.sys -- (iAimTV0) DRV - [2004.08.03 17:29:42 | 000,011,871 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wADV09nt.sys -- (iAimFP7) DRV - [2004.08.03 17:29:40 | 000,011,807 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wADV07nt.sys -- (iAimFP5) DRV - [2004.08.03 17:29:40 | 000,011,295 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wADV08nt.sys -- (iAimFP6) DRV - [2004.08.03 17:29:38 | 000,161,020 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\i81xnt5.sys -- (i81x) DRV - [2004.08.03 17:29:38 | 000,012,415 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wADV01nt.sys -- (iAimFP0) DRV - [2004.08.03 17:29:38 | 000,012,127 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wADV02NT.sys -- (iAimFP1) DRV - [2004.08.03 17:29:38 | 000,011,775 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wADV05NT.sys -- (iAimFP2) DRV - [2002.04.04 06:32:06 | 000,028,416 | R--- | M] () [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\symmpi.sys -- (Symmpi) DRV - [2001.08.18 04:30:42 | 000,003,328 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\pciide.sys -- (PCIIde) DRV - [2001.08.18 03:34:52 | 000,007,040 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\serscan.sys -- (StillCam) DRV - [2001.08.17 08:59:44 | 000,003,072 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\audstub.sys -- (audstub) DRV - [2001.08.17 08:07:44 | 000,020,192 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\dpti2o.sys -- (dpti2o) DRV - [2001.08.17 08:07:38 | 000,056,960 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\aic78xx.sys -- (aic78xx) DRV - [2001.08.17 08:07:36 | 000,055,168 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\aic78u2.sys -- (aic78u2) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/ IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz= IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredimail.com/?search={searchTerms}&loc=search_box_im2_test_v2 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: toolbar@gmx.net:2.3.4 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_149.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Programme\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_39: C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Programme\AVAST Software\Avast\WebRep\FF [2013.02.17 19:33:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.04.20 20:56:36 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.20 20:56:52 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Mozilla\Extensions [2012.12.19 16:12:36 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Mozilla\Firefox\Profiles\f57uyh6m.default\extensions [2012.12.19 16:12:36 | 000,500,206 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Mozilla\Firefox\Profiles\f57uyh6m.default\extensions\toolbar@gmx.net.xpi [2013.02.17 18:01:45 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2013.02.17 18:01:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} [2012.04.20 20:56:33 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions [2012.04.20 20:56:33 | 000,000,000 | ---D | M] (GMX Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@gmx.net [2012.03.13 05:38:06 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2012.03.13 06:23:34 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.03.13 06:06:36 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2012.03.13 06:23:34 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2012.03.13 06:23:34 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2012.03.13 06:23:34 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2012.03.13 06:23:34 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter} CHR - plugin: Shockwave Flash (Enabled) = C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Programme\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Programme\Google\Chrome\Application\24.0.1312.57\pdf.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programme\Windows Media Player\npdsplay.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll CHR - plugin: Zylom Plugin (Enabled) = C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll CHR - plugin: CANON iMAGE GATEWAY Album Plugin Utility (Enabled) = C:\Programme\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL CHR - plugin: Google Earth Plugin (Enabled) = C:\Programme\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Programme\Google\Update\1.3.21.135\npGoogleUpdate3.dll CHR - plugin: Java(TM) Platform SE 6 U39 (Enabled) = C:\Programme\Java\jre6\bin\plugin2\npjp2.dll CHR - plugin: McAfee Security Scanner + (Enabled) = C:\Programme\McAfee Security Scan\3.0.318\npMcAfeeMss.dll CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Programme\Microsoft\Office Live\npOLW.dll CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_149.dll CHR - plugin: Java Deployment Toolkit 6.0.390.4 (Enabled) = C:\WINDOWS\system32\npdeployJava1.dll CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - Extension: Google Docs = C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\ CHR - Extension: Google Drive = C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: YouTube = C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: avast! WebRep = C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1474_0\ CHR - Extension: Google Mail = C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2009.10.06 18:04:22 | 000,000,850 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 192.168.2.104 HP0019BBEEC37E O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Phone\IEPlugin\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Programme\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.) O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found. O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O3 - HKLM\..\Toolbar: (TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Programme\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH) O3 - HKCU\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis) O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis) O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe () O4 - HKLM..\Run: [avast] C:\Programme\AVAST Software\Avast\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Programme\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.) O4 - HKLM..\Run: [Mobile Connectivity Suite] C:\Programme\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB) O4 - HKLM..\Run: [PDF Complete] C:\Programme\PDF Complete\pdfsty.exe (PDF Complete Inc) O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe () O4 - HKLM..\Run: [Reminder] C:\WINDOWS\CREATOR\Remind_XP.exe () O4 - HKLM..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe () O4 - HKLM..\Run: [SetRefresh] C:\Programme\Compaq\SetRefresh\SetRefresh.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [sfagent] C:\Programme\Fighters\SPAMfighter\sfagent.exe File not found O4 - HKLM..\Run: [TrayServer] C:\Programme\MAGIX\Filme_auf_DVD_7_TerraTec_Edition\Trayserver.exe (MAGIX AG) O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis) O4 - HKCU..\Run: [IncrediMail] C:\Programme\IncrediMail\bin\IncMail.exe (IncrediMail, Ltd.) O4 - Startup: C:\Dokumente und Einstellungen\Alfred\Startmenü\Programme\Autostart\Dropbox.lnk = C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre6\bin\npjpi160_39.dll (Sun Microsystems, Inc.) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Phone\IEPlugin\SkypeIEPlugin.dll (Skype Technologies S.A.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1361122250093 (WUWebControl Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1348472493337 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab (Java Plug-in 1.6.0_39) O16 - DPF: {CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab (Java Plug-in 1.6.0_39) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab (Java Plug-in 1.6.0_39) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8D31EAAD-9AEE-47D2-884A-A1A169760D1C}: DhcpNameServer = 10.0.0.138 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: O24 - Desktop BackupWallPaper: O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004.04.30 17:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ] O33 - MountPoints2\{3bf99ece-7f9e-11de-b1d1-00237d2bed5d}\Shell\AutoRun\command - "" = F:\StartPortableApps.exe O33 - MountPoints2\{f123713c-572e-11de-b1ab-00237d2bed5d}\Shell\AutoRun\command - "" = F:\StartPortableApps.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.02.17 19:55:56 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Alfred\Desktop\OTL.exe [2013.02.17 19:43:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42} [2013.02.17 19:43:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Anwendungsdaten\PackageAware [2013.02.17 19:34:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\avast! Free Antivirus [2013.02.17 19:33:59 | 000,361,032 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys [2013.02.17 19:33:59 | 000,021,256 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys [2013.02.17 19:33:55 | 000,035,928 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys [2013.02.17 19:33:54 | 000,738,504 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys [2013.02.17 19:33:54 | 000,054,232 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys [2013.02.17 19:33:52 | 000,097,608 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys [2013.02.17 19:33:52 | 000,089,752 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys [2013.02.17 19:33:52 | 000,025,256 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys [2013.02.17 19:33:25 | 000,041,224 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr [2013.02.17 19:33:24 | 000,227,648 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe [2013.02.17 19:33:07 | 000,000,000 | ---D | C] -- C:\Programme\AVAST Software [2013.02.17 19:33:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVAST Software [2013.02.17 18:02:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun [2013.02.07 20:46:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\McAfee [9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.02.17 19:55:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Alfred\Desktop\OTL.exe [2013.02.17 19:55:41 | 000,000,020 | ---- | M] () -- C:\Dokumente und Einstellungen\Alfred\defogger_reenable [2013.02.17 19:40:27 | 000,000,308 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job [2013.02.17 19:40:19 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2013.02.17 19:39:27 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2013.02.17 19:39:22 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2013.02.17 19:39:18 | 3488,862,208 | -HS- | M] () -- C:\hiberfil.sys [2013.02.17 19:34:00 | 000,001,653 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\avast! Free Antivirus.lnk [2013.02.17 19:33:53 | 000,003,001 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT [2013.02.17 19:10:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2013.02.17 19:04:37 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2013.02.17 18:43:50 | 000,000,139 | ---- | M] () -- C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2013.02.17 17:52:35 | 1084,900,352 | ---- | M] () -- C:\Eigene Dateien\090503_Outlook Datendatei.pst [2013.02.17 16:05:26 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{C6622BC6-1194-4577-A417-65EC0B73B642}.job [2013.02.03 18:06:50 | 000,001,777 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk [2013.02.01 12:26:44 | 000,061,696 | ---- | M] () -- C:\WINDOWS\System32\drivers\cb010bd02561def3.sys [2013.01.30 20:13:13 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2013.01.27 08:04:38 | 000,001,039 | ---- | M] () -- C:\Dokumente und Einstellungen\Alfred\Startmenü\Programme\Autostart\Dropbox.lnk [9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.02.17 19:55:38 | 000,000,020 | ---- | C] () -- C:\Dokumente und Einstellungen\Alfred\defogger_reenable [2013.02.17 19:34:00 | 000,001,653 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\avast! Free Antivirus.lnk [2013.02.17 19:33:53 | 000,000,308 | -H-- | C] () -- C:\WINDOWS\tasks\avast! Emergency Update.job [2013.02.17 18:43:50 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2013.02.01 12:26:44 | 000,061,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\cb010bd02561def3.sys [2013.01.30 18:14:31 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2012.02.15 07:16:52 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2011.10.26 21:59:22 | 000,137,928 | ---- | C] () -- C:\WINDOWS\System32\drivers\avipbb.sys [2011.10.26 21:59:22 | 000,036,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\avkmgr.sys [2011.10.02 01:58:57 | 000,000,000 | ---- | C] () -- C:\WINDOWS\DbgOut.INI [2011.09.18 20:35:08 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\drivers\ANDROIDUSB.sys [2011.09.17 15:56:23 | 001,636,120 | ---- | C] () -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\mdbu.bin ========== ZeroAccess Check ========== [2009.03.25 02:23:05 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2009.03.03 00:10:15 | 001,499,136 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 03:22:32 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2009.10.26 07:47:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Acronis [2012.12.21 13:38:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Canon [2011.09.21 20:52:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Canon Easy-WebPrint EX [2010.11.26 11:40:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Common Toolkit Suite [2009.11.08 10:44:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\DAEMON Tools Lite [2013.02.17 19:40:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Dropbox [2012.07.24 09:01:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Fighters [2012.09.21 15:42:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\InterVideo [2009.05.04 20:48:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\MAGIX [2009.05.01 03:24:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\SampleView [2011.09.18 20:42:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Teleca [2009.12.26 18:13:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\TerraTec [2011.10.26 19:05:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\TuneUp Software [2009.06.19 23:39:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Zylom [2009.09.13 14:57:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis [2013.02.17 19:33:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVAST Software [2009.08.04 15:17:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avery [2009.05.08 17:53:31 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ [2011.09.21 20:59:47 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonEPP [2011.09.21 21:46:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJ [2012.08.11 09:50:52 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEGV [2011.09.21 21:55:28 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEPPEX [2011.09.21 20:59:47 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEPPEX2 [2011.09.21 20:52:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJMSetup [2011.09.21 20:59:46 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJMyPrinter [2013.02.07 21:13:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJPLM [2011.09.21 21:44:53 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan [2011.09.21 20:59:48 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJSolutionMenuEX [2011.09.21 20:43:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJWSpt [2010.11.27 00:03:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Common Toolkit Suite [2009.11.08 10:43:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite [2012.07.24 09:01:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Fighters [2011.09.17 14:10:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HappyFoto-Designer [2011.09.18 20:35:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HTC [2009.08.19 21:55:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IM [2009.08.19 21:54:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IncrediMail [2010.11.28 12:51:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX [2010.07.24 16:25:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PhotoStitch [2011.09.18 20:35:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Teleca [2009.12.26 18:13:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TerraTec [2011.10.26 19:05:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software [2009.06.19 23:39:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom [2011.10.26 19:04:23 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{32364CEA-7855-4A3C-B674-53D8E9B97936} [2013.02.17 19:43:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42} [2013.02.17 19:43:33 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~0 ========== Purity Check ========== < End of report > Extras.txt:OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 17.02.2013 19:57:30 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Alfred\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
3,25 Gb Total Physical Memory | 2,68 Gb Available Physical Memory | 82,57% Memory free
4,58 Gb Paging File | 4,11 Gb Available in Paging File | 89,84% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 216,87 Gb Total Space | 23,74 Gb Free Space | 10,95% Space Free | Partition Type: NTFS
Drive D: | 16,00 Gb Total Space | 12,15 Gb Free Space | 75,90% Space Free | Partition Type: NTFS
Computer Name: HP1 | User Name: Alfred | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = ChromeHTML] -- C:\Programme\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Digital Photo Professional] -- C:\Programme\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Programme\McAfee\Managed VirusScan\Agent\myAgtSvc.exe" = C:\Programme\McAfee\Managed VirusScan\Agent\myAgtSvc.exe:*:Enabled:Managed Services Agent
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\WINDOWS\SMINST\Scheduler.exe" = C:\WINDOWS\SMINST\Scheduler.exe:*:Enabled:Scheduler -- ()
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Programme\IncrediMail\Bin\IncMail.exe" = C:\Programme\IncrediMail\Bin\IncMail.exe:*:Enabled:IncrediMail -- (IncrediMail, Ltd.)
"C:\Programme\IncrediMail\Bin\ImApp.exe" = C:\Programme\IncrediMail\Bin\ImApp.exe:*:Enabled:IncrediMail -- (IncrediMail, Ltd.)
"C:\Programme\IncrediMail\Bin\ImpCnt.exe" = C:\Programme\IncrediMail\Bin\ImpCnt.exe:*:Enabled:IncrediMail -- (IncrediMail, Ltd.)
"C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Temp\7zS4463\setup\HPZnet01.exe" = C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Temp\7zS4463\setup\HPZnet01.exe:*:Enabled:hpznet01.exe
"C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Temp\7zS4463\setup\hponicifs01.exe" = C:\Dokumente und Einstellungen\Alfred\Lokale Einstellungen\Temp\7zS4463\setup\hponicifs01.exe:*:Enabled:hponicifs01.exe
"C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe
"C:\Programme\HP\Digital Imaging\bin\hpqste08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe
"C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe
"C:\Programme\HP\Digital Imaging\bin\hposfx08.exe" = C:\Programme\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe
"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe
"C:\Programme\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Programme\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe
"C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe
"C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe
"C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe
"C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe
"C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Programme\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe
"C:\Programme\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Programme\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe
"C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe
"C:\Programme\HP\Digital Imaging\bin\hpqnrs08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe
"C:\WINDOWS\system32\spoolsv.exe" = C:\WINDOWS\system32\spoolsv.exe:*:Enabled:Spooler SubSystem App -- (Microsoft Corporation)
"C:\Programme\Bonjour\mDNSResponder.exe" = C:\Programme\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour -- (Apple Computer, Inc.)
"C:\Programme\TerraTec\TerraTec Home Cinema\InstTool.exe" = C:\Programme\TerraTec\TerraTec Home Cinema\InstTool.exe:*:Enabled:TerraTec Home Cinema Classic (Setup) -- (TerraTec Electronic GmbH)
"C:\Programme\TerraTec\TerraTec Home Cinema\CinergyDvr.exe" = C:\Programme\TerraTec\TerraTec Home Cinema\CinergyDvr.exe:*:Enabled:TerraTec Home Cinema Classic -- (TerraTec Electronic GmbH)
"C:\Programme\TerraTec\TerraTec Home Cinema\tvtvSetup\tvtv_Wizard.exe" = C:\Programme\TerraTec\TerraTec Home Cinema\tvtvSetup\tvtv_Wizard.exe:*:Enabled:TerraTec Home Cinema Classic (tvtv Setup) -- (TerraTec Electronic GmbH)
"C:\Programme\TerraTec\TerraTec Home Cinema\VersionCheck\VersionCheck.exe" = C:\Programme\TerraTec\TerraTec Home Cinema\VersionCheck\VersionCheck.exe:*:Enabled:TerraTec Home Cinema Classic (Auto Update) -- (TerraTec Electronic GmbH)
"C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Dropbox\bin\Dropbox.exe" = C:\Dokumente und Einstellungen\Alfred\Anwendungsdaten\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox -- (Dropbox, Inc.)
"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\Skype\Phone\Skype.exe" = C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{069730C2-755A-485B-A205-27A1AAFA836A}" = InstantShareAlert
"{0742B739-DCA3-4A21-AADD-B7CBF49C2058}" = Adobe Premiere Pro CS3 Third Party Content
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0A3D355B-4FCC-41AF-8C61-A2BA15D26237}" = Adobe After Effects CS3
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG6100_series" = Canon MG6100 series MP Drivers
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{185D0A67-E066-44AE-926D-F6305813301C}" = Adobe After Effects CS3 Presets
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216039FF}" = Java(TM) 6 Update 39
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder
"{37C8899D-FD70-481F-94AA-1F1B08765E22}" = Acronis*True*Image*Home
"{3D5E5C0A-5B36-4F98-99A7-287F7DBDCE03}" = Skype Plugin Manager
"{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}" = ATI HYDRAVISION
"{3F9F7336-6DF8-476F-ABF6-C70A17FAF619}" = HP Backup and Recovery Manager
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F41AD68-89F2-4262-A32C-2F70B01FCE9E}" = Fotostory 3 für Windows
"{50F102CA-4BE2-41A9-9810-5BB05EB91B9A}" = Adobe Premiere Pro CS3 Functional Content
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{5373C190-2C97-4086-B0F6-E7774B2CF25A}" = Adobe Encore CS3
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{580EC579-E476-469F-9EBF-F82D696FC67A}" = iClone SE
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{60B87ADA-167E-4239-AD64-40992C8D220F}" = Adobe After Effects CS3 Third Party Content
"{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}" = TerraTec Home Cinema
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{69333A04-5134-40A5-A055-9166A7AA1EC8}" =
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{6E46EDB6-E608-493B-AAE1-774DCDC524A8}" = ATI Catalyst Control Center
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7162AC2C-733F-4127-ACAD-C5F0F27D123D}" = Adobe Creative Suite 3 Master Collection
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7ACFB90E-8FD0-4397-AD3A-5195412623A3}" = Adobe Help Viewer CS3
"{7D8DBB7C-1C55-4950-A107-043C164F379A}" = Altiris Software Virtualization Agent
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}" = Adobe Video Profiles
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{909B62B0-8ACA-4061-A83B-09CAEF609619}" = MSXML 6.0 Parser
"{91110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{98B8052E-1E55-41D4-9A03-E2F718825D38}" = HTC Sync
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B095F52-3E7C-4B90-9839-81C0C66177CA}" = IncrediMail
"{9BA4F9C5-7CB4-492C-9B97-89E36AFA0AB9}" = Adobe Setup
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6CDBEB9-2DF5-4455-A647-F3DF0441D5C3}" = Adobe Premiere Pro CS3
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B4E96960-5F6B-48B9-A5BD-6A5A9BB4F027}" = Avery Wizard 3.1
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BB3AB664-D92B-4CB5-8B3E-D841841F4E68}" = Canon Camera WIA Driver
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{C941F1F1-25B3-4DF5-83E6-888C51A1AAB6}" = AVIVO Codecs
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F18DB86D-BC16-4E01-BCCE-63F62B931D82}" = InterVideo Register Manager
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F82C6574-AD88-4B40-A432-970BC77F1BD2}" = DesignPro 5
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_8bb24e071e5922899698c2105557bd2" = Add or Remove Adobe Creative Suite 3 Master Collection
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"ATI Display Driver" = ATI Display Driver
"avast" = avast! Free Antivirus
"CAL" = Canon Camera Access Library
"CameraWindowDVC5" = Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"Canon MG6100 series Benutzerregistrierung" = Canon MG6100 series Benutzerregistrierung
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"CSCLIB" = Canon Camera Support Core Library
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"DPP" = Canon Utilities Digital Photo Professional 3.3
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-PhotoPrint Pro" = Canon Easy-PhotoPrint Pro
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"EOS Utility" = Canon Utilities EOS Utility
"Google Chrome" = Google Chrome
"HappyFoto-Designer_is1" = HappyFoto-Designer 2.7
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"ie8" = Windows Internet Explorer 8
"IncrediMail" = IncrediMail 2.0
"InstallShield_{BB3AB664-D92B-4CB5-8B3E-D841841F4E68}" = Canon EOS 5D WIA-Treiber
"InstallShield_{F82C6574-AD88-4B40-A432-970BC77F1BD2}" = DesignPro 5
"MAGIX Filme auf DVD TerraTec Edition D" = MAGIX Filme auf DVD TerraTec Edition 7.0.3.8 (D)
"MAGIX Foto Manager 2008 D" = MAGIX Foto Manager 2008 5.0.0.255 (D)
"MAGIX Fotobuch" = MAGIX Fotobuch 3.2
"MAGIX Online Druck Service D" = MAGIX Online Druck Service
"MAGIX PC Visit D" = MAGIX PC Visit
"MAGIX Screenshare D" = MAGIX Screenshare
"MAGIX Video deluxe 2008 PLUS D" = MAGIX Video deluxe 2008 PLUS 7.5.0.20 (D)
"MAGIX Xtreme Foto Designer 6 D" = MAGIX Xtreme Foto Designer 6 6.0.22.0 (D)
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Mufin MusicFinder Base D" = Mufin MusicFinder Base 1.0.1.229 (D)
"MyCamera" = Canon Utilities MyCamera
"Original Data Security Tools" = Canon Utilities Original Data Security Tools
"PDF Complete" = PDF Complete
"PhotoStitch" = Canon Utilities PhotoStitch
"Picture Style Editor" = Canon Utilities Picture Style Editor
"ProtectDisc Driver 10" = ProtectDisc Helper Driver 10
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"Skype_is1" = Skype 3.0
"ToolBand.SkypeIEToolbarToolbar" = Skype add-on for IE
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WFTK" = Canon Utilities WFT-E1/E2/E3 Utility
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 17.02.2013 13:54:59 | Computer Name = HP1 | Source = Avira Antivirus | ID = 4122
Description =
Error - 17.02.2013 13:55:29 | Computer Name = HP1 | Source = Avira Antivirus | ID = 4122
Description =
Error - 17.02.2013 13:57:41 | Computer Name = HP1 | Source = Avira Antivirus | ID = 4122
Description =
Error - 17.02.2013 14:03:48 | Computer Name = HP1 | Source = Avira Antivirus | ID = 4122
Description =
Error - 17.02.2013 14:19:35 | Computer Name = HP1 | Source = Avira Antivirus | ID = 4122
Description =
Error - 17.02.2013 14:19:54 | Computer Name = HP1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung avguard.exe, Version 12.3.0.15, fehlgeschlagenes
Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x00019af2.
Error - 17.02.2013 14:23:32 | Computer Name = HP1 | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
Error - 17.02.2013 14:23:50 | Computer Name = HP1 | Source = Avira Antivirus | ID = 4122
Description =
Error - 17.02.2013 14:28:00 | Computer Name = HP1 | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
Error - 17.02.2013 14:39:47 | Computer Name = HP1 | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
[ System Events ]
Error - 17.02.2013 14:41:33 | Computer Name = HP1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "aswMon2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error - 17.02.2013 14:41:33 | Computer Name = HP1 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "avast! Antivirus" ist vom Dienst "aswMon2" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%31
Error - 17.02.2013 14:42:11 | Computer Name = HP1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "aswMon2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error - 17.02.2013 14:42:11 | Computer Name = HP1 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "avast! Antivirus" ist vom Dienst "aswMon2" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%31
Error - 17.02.2013 14:45:57 | Computer Name = HP1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "aswMon2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error - 17.02.2013 14:45:57 | Computer Name = HP1 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "avast! Antivirus" ist vom Dienst "aswMon2" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%31
Error - 17.02.2013 14:46:23 | Computer Name = HP1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "aswMon2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error - 17.02.2013 14:46:23 | Computer Name = HP1 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "avast! Antivirus" ist vom Dienst "aswMon2" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%31
Error - 17.02.2013 14:46:34 | Computer Name = HP1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "aswMon2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error - 17.02.2013 14:46:34 | Computer Name = HP1 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "avast! Antivirus" ist vom Dienst "aswMon2" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%31
< End of report >
Gmer Errors: Beim Starten von Gmer:  In GMER noch während das Programm startet:   Geändert von kabuto1 (17.02.2013 um 21:40 Uhr) Grund: Link hatte nicht funktioniert |
|
17.02.2013, 22:18
| #2 | |||||||
| /// TB-Ausbilder   | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion Hallo kabuto1 und
__________________ Mein Name ist Leo und ich werde dich durch die Bereinigung deines Rechners begleiten. Eine Bereinigung beinhaltet nebst dem Entfernen von Malware auch das Schliessen von Sicherheitslücken und sollte gründlich durchgeführt werden. Sie erfolgt deshalb in mehreren Schritten und bedeutet einigen Aufwand für dich. Beachte: Das Verschwinden der offensichtlichen Symptome bedeutet nicht, dass das System schon sauber ist. Arbeite daher in deinem eigenen Interesse solange mit, bis du das OK bekommst, dass alles erledigt ist.  Hinweise zum Ablauf
Zitat:
Zitat:
Zitat:
Zitat:
 Zitat:
Zitat:
Code:
ATTFilter SRV - [2013.02.01 12:26:44 | 000,061,696 | ---- | M] () [Unknown (-1) | Unknown] -- C:\WINDOWS\System32\drivers\cb010bd02561def3.sys -- (cb010bd02561def3)
SRV - [2013.02.01 12:26:37 | 000,074,240 | ---- | M] () [Auto | Running] -- C:\WINDOWS\Installer\{2A781366-67FF-1FE0-3C30-7D941BF2EEAB}\syshost.exe -- (syshost32)
Zitat:
Aber jetzt ist vielleicht wirklich nicht der günstigste Moment, um vom laufenden System aus Daten zu sichern. Du kannst zur Sicherheit (bevor wir hier anfangen) zuerst über eine Live-CD die persönlichen Daten (Fotos, Dokumente, etc.; keine Programme oder Ähnliches!) auf einen externen Datenträger kopieren, wenn dir die Sache zu heiss ist: http://www.trojaner-board.de/82533-d...ted-magic.html Das wäre vielleicht sinnvoll. Danach: Mach ab jetzt bitte nichts mehr auf eigene Faust, sondern arbeite jeweils nur die Anleitungen ab. Schritt 1 Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinen Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers. Bitte poste in deiner nächsten Antwort:
__________________ Geändert von aharonov (17.02.2013 um 22:46 Uhr) |
|
18.02.2013, 19:08
| #3 |
| | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion Liebes Team,
__________________Mein Schwiegersohn ist leider erst in einer Woche wieder da. Haben Daten gesichert und ich hab jetzt mbar gestartet - leider gleich mit folgender Meldung LG Alfred --------------------------- Could not load DDA driver --------------------------- DDA driver was not installed which may be caused by rootkit activity. Do you want to reboot the computer to install DDA driver (Scan will continue after reboot)? --------------------------- &Yes &No --------------------------- |
|
18.02.2013, 19:11
| #4 |
| /// TB-Ausbilder | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion Hallo Alfred, dann wähle hier bitte Yes.
__________________ cheers, Leo |
|
18.02.2013, 19:38
| #5 |
| | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion Hallo Leo, nach YES startet PC nur im Recovery Modus geht dann nur mit "Start mit letzter funktionierender Konfiguration" - dh Treiber ist da nicht dabei LG Alfred |
|
18.02.2013, 20:54
| #6 |
| /// TB-Ausbilder | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion Hallo Alfred, versuchen wir mal etwas anderes. Lade das folgende Tool herunter und führe es dann im abgesicherten Modus aus: Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts löschen, sondern nur einen Scan-Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop.
__________________ --> TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion |
|
18.02.2013, 21:46
| #7 |
| | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion Hallo Leo, hat zwar gemeckert " fehlender Treiber" aber scan war dann doch möglich. Bin noch im abgesicherten Modus LG Alfred das ist der log: 21:30:16.0046 0520 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42 21:30:16.0421 0520 ============================================================ 21:30:16.0421 0520 Current date / time: 2013/02/18 21:30:16.0421 21:30:16.0421 0520 SystemInfo: 21:30:16.0421 0520 21:30:16.0421 0520 OS Version: 5.1.2600 ServicePack: 3.0 21:30:16.0421 0520 Product type: Workstation 21:30:16.0421 0520 ComputerName: HP1 21:30:16.0421 0520 UserName: Alfred 21:30:16.0421 0520 Windows directory: C:\WINDOWS 21:30:16.0421 0520 System windows directory: C:\WINDOWS 21:30:16.0421 0520 Processor architecture: Intel x86 21:30:16.0421 0520 Number of processors: 2 21:30:16.0421 0520 Page size: 0x1000 21:30:16.0421 0520 Boot type: Safe boot with network 21:30:16.0421 0520 ============================================================ 21:30:30.0859 0520 !crdlk 21:30:30.0906 0520 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'A' 21:30:30.0937 0520 ============================================================ 21:30:30.0937 0520 \Device\Harddisk0\DR0: 21:30:30.0937 0520 MBR partitions: 21:30:30.0937 0520 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1B1BB2D7 21:30:30.0937 0520 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1B1BF1D7, BlocksNum 0x20014E9 21:30:30.0937 0520 ============================================================ 21:30:30.0984 0520 C: <-> \Device\Harddisk0\DR0\Partition1 21:30:31.0015 0520 D: <-> \Device\Harddisk0\DR0\Partition2 21:30:31.0109 0520 ============================================================ 21:30:31.0109 0520 Initialize success 21:30:31.0109 0520 ============================================================ 21:30:40.0265 0844 ============================================================ 21:30:40.0265 0844 Scan started 21:30:40.0265 0844 Mode: Manual; 21:30:40.0265 0844 ============================================================ 21:30:41.0171 0844 ================ Scan system memory ======================== 21:30:41.0171 0844 System memory - ok 21:30:41.0171 0844 ================ Scan services ============================= 21:30:41.0375 0844 [ 914A9709FC3BF419AD2F85547F2A4832 ] 61883 C:\WINDOWS\system32\DRIVERS\61883.sys 21:30:41.0375 0844 61883 - ok 21:30:41.0437 0844 [ 149A8F7ADF9742554DC323E290551E3E ] Aavmker4 C:\WINDOWS\system32\drivers\Aavmker4.sys 21:30:41.0484 0844 Aavmker4 - ok 21:30:41.0656 0844 Abiosdsk - ok 21:30:41.0718 0844 abp480n5 - ok 21:30:41.0796 0844 [ 0F2D66D5F08EBE2F77BB904288DCF6F0 ] ac97intc C:\WINDOWS\system32\drivers\ac97intc.sys 21:30:41.0812 0844 ac97intc - ok 21:30:41.0859 0844 [ 553BA53445795CBC0D4F9FA37EB855A6 ] acedrv10 C:\WINDOWS\system32\drivers\acedrv10.sys 21:30:41.0859 0844 acedrv10 - ok 21:30:41.0875 0844 [ 8CE00B6A46962A1808B19CD1DAE5170C ] acehlp10 C:\WINDOWS\system32\drivers\acehlp10.sys 21:30:41.0875 0844 acehlp10 - ok 21:30:41.0937 0844 [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 21:30:41.0937 0844 ACPI - ok 21:30:41.0968 0844 [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys 21:30:41.0968 0844 ACPIEC - ok 21:30:42.0078 0844 [ 744ED7AABA941C0E3B7668F5CA4E345F ] AcrSch2Svc C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe 21:30:42.0093 0844 AcrSch2Svc - ok 21:30:42.0203 0844 [ 563CDCFEEAEF97163E206AF71A61AA6E ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 21:30:42.0234 0844 AdobeFlashPlayerUpdateSvc - ok 21:30:42.0250 0844 [ 9A11864873DA202C996558B2106B0BBC ] adpu160m C:\WINDOWS\system32\DRIVERS\adpu160m.sys 21:30:42.0265 0844 adpu160m - ok 21:30:42.0265 0844 [ 0EA9B1F0C6C90A509C8603775366ADB7 ] adpu320 C:\WINDOWS\system32\DRIVERS\adpu320.sys 21:30:42.0265 0844 adpu320 - ok 21:30:42.0296 0844 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys 21:30:42.0296 0844 aec - ok 21:30:42.0343 0844 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys 21:30:42.0343 0844 AFD - ok 21:30:42.0343 0844 Aha154x - ok 21:30:42.0359 0844 [ 19DD0FB48B0C18892F70E2E7D61A1529 ] aic78u2 C:\WINDOWS\system32\DRIVERS\aic78u2.sys 21:30:42.0359 0844 aic78u2 - ok 21:30:42.0375 0844 [ B7FE594A7468AA0132DEB03FB8E34326 ] aic78xx C:\WINDOWS\system32\DRIVERS\aic78xx.sys 21:30:42.0375 0844 aic78xx - ok 21:30:42.0406 0844 [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter C:\WINDOWS\system32\alrsvc.dll 21:30:42.0406 0844 Alerter - ok 21:30:42.0437 0844 [ 190CD73D4984F94D823F9444980513E5 ] ALG C:\WINDOWS\System32\alg.exe 21:30:42.0437 0844 ALG - ok 21:30:42.0437 0844 AliIde - ok 21:30:42.0453 0844 amsint - ok 21:30:42.0500 0844 [ D45960BE52C3C610D361977057F98C54 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll 21:30:42.0500 0844 AppMgmt - ok 21:30:42.0546 0844 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys 21:30:42.0546 0844 Arp1394 - ok 21:30:42.0562 0844 asc - ok 21:30:42.0562 0844 asc3350p - ok 21:30:42.0578 0844 asc3550 - ok 21:30:42.0718 0844 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 21:30:42.0750 0844 aspnet_state - ok 21:30:42.0781 0844 [ DE6ED95AEF259979B2830450072A627B ] aswFsBlk C:\WINDOWS\system32\drivers\aswFsBlk.sys 21:30:42.0796 0844 aswFsBlk - ok 21:30:42.0843 0844 [ 84F0BE324EE111338589F448C3E8BAB2 ] aswMon2 C:\WINDOWS\system32\drivers\aswMon2.sys 21:30:42.0859 0844 aswMon2 - ok 21:30:42.0859 0844 [ 7C9F0A2AB17D52261A9252A2EB320884 ] AswRdr C:\WINDOWS\system32\drivers\AswRdr.sys 21:30:42.0875 0844 AswRdr - ok 21:30:42.0890 0844 [ B32E9AD44A1DBB3E8095E80F8DF32B03 ] aswSnx C:\WINDOWS\system32\drivers\aswSnx.sys 21:30:42.0906 0844 aswSnx - ok 21:30:42.0968 0844 [ 67B558895695545FB0568B7541F3BCA7 ] aswSP C:\WINDOWS\system32\drivers\aswSP.sys 21:30:42.0968 0844 aswSP - ok 21:30:43.0031 0844 [ E3E73B2B73A4DFADFDDF557192C4B08A ] aswTdi C:\WINDOWS\system32\drivers\aswTdi.sys 21:30:43.0031 0844 aswTdi - ok 21:30:43.0046 0844 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 21:30:43.0046 0844 AsyncMac - ok 21:30:43.0062 0844 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 21:30:43.0062 0844 atapi - ok 21:30:43.0062 0844 Atdisk - ok 21:30:43.0125 0844 [ F57801F641E6DF9F4FD4B29D6DEB422C ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe 21:30:43.0140 0844 Ati HotKey Poller - ok 21:30:43.0156 0844 [ 9459F0247D8911CFDF1DC509517AF5B6 ] ATI Smart C:\WINDOWS\system32\ati2sgag.exe 21:30:43.0156 0844 ATI Smart - ok 21:30:43.0218 0844 [ BF94A12F9D86B28FECF00B24B7129013 ] ati2mtag C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 21:30:43.0281 0844 ati2mtag - ok 21:30:43.0312 0844 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 21:30:43.0312 0844 Atmarpc - ok 21:30:43.0359 0844 [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 21:30:43.0359 0844 AudioSrv - ok 21:30:43.0421 0844 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 21:30:43.0421 0844 audstub - ok 21:30:43.0500 0844 [ 8FA553E9AE69808D99C164733A0F9590 ] avast! Antivirus C:\Programme\AVAST Software\Avast\AvastSvc.exe 21:30:43.0500 0844 avast! Antivirus - ok 21:30:43.0546 0844 [ F8E6956A614F15A0860474C5E2A7DE6B ] Avc C:\WINDOWS\system32\DRIVERS\avc.sys 21:30:43.0546 0844 Avc - ok 21:30:43.0578 0844 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 21:30:43.0578 0844 Beep - ok 21:30:43.0640 0844 [ D6F603772A789BB3228F310D650B8BD1 ] BITS C:\WINDOWS\system32\qmgr.dll 21:30:43.0796 0844 BITS - ok 21:30:43.0843 0844 [ 73686FE0B2E0469F89FD2075BE724704 ] Bonjour Service C:\Programme\Bonjour\mDNSResponder.exe 21:30:43.0843 0844 Bonjour Service - ok 21:30:43.0890 0844 [ B71549F23736ADF83A571061C47777FD ] Browser C:\WINDOWS\System32\browser.dll 21:30:43.0906 0844 Browser - ok 21:30:43.0906 0844 Suspicious service (NoAccess): cb010bd02561def3 21:30:43.0937 0844 [ 9AD522490D5F302918CACF4460540DC4 ] cb010bd02561def3 C:\WINDOWS\System32\Drivers\cb010bd02561def3.sys 21:30:43.0937 0844 Suspicious file (NoAccess): C:\WINDOWS\System32\Drivers\cb010bd02561def3.sys. md5: 9AD522490D5F302918CACF4460540DC4 21:30:44.0546 0844 cb010bd02561def3 ( Rootkit.Win32.Necurs.gen ) - infected 21:30:44.0546 0844 cb010bd02561def3 - detected Rootkit.Win32.Necurs.gen (0) 21:30:44.0609 0844 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 21:30:44.0609 0844 cbidf2k - ok 21:30:44.0750 0844 [ 8EF654045E518AC00E52E7A1E2D3AD70 ] CCALib8 C:\Programme\Canon\CAL\CALMAIN.exe 21:30:44.0750 0844 CCALib8 - ok 21:30:44.0796 0844 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 21:30:44.0796 0844 CCDECODE - ok 21:30:44.0796 0844 cd20xrnt - ok 21:30:44.0828 0844 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 21:30:44.0828 0844 Cdaudio - ok 21:30:44.0890 0844 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 21:30:44.0890 0844 Cdfs - ok 21:30:44.0906 0844 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 21:30:44.0906 0844 Cdrom - ok 21:30:44.0921 0844 Changer - ok 21:30:44.0968 0844 [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc C:\WINDOWS\system32\cisvc.exe 21:30:44.0968 0844 CiSvc - ok 21:30:44.0984 0844 [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 21:30:45.0000 0844 ClipSrv - ok 21:30:45.0031 0844 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 21:30:45.0171 0844 clr_optimization_v2.0.50727_32 - ok 21:30:45.0218 0844 CmdIde - ok 21:30:45.0312 0844 [ 38208B45E08C7CD5234E7E2491307F56 ] Common Toolkit Service C:\Programme\Common Files\Common Toolkit Suite\FighterSuiteService.exe 21:30:45.0328 0844 Common Toolkit Service - ok 21:30:45.0328 0844 COMSysApp - ok 21:30:45.0359 0844 Cpqarray - ok 21:30:45.0390 0844 [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 21:30:45.0390 0844 CryptSvc - ok 21:30:45.0406 0844 dac2w2k - ok 21:30:45.0421 0844 dac960nt - ok 21:30:45.0484 0844 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 21:30:45.0500 0844 DcomLaunch - ok 21:30:45.0531 0844 [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 21:30:45.0531 0844 Dhcp - ok 21:30:45.0562 0844 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 21:30:45.0562 0844 Disk - ok 21:30:45.0578 0844 dmadmin - ok 21:30:45.0625 0844 [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 21:30:45.0656 0844 dmboot - ok 21:30:45.0656 0844 [ 53720AB12B48719D00E327DA470A619A ] dmio C:\WINDOWS\system32\drivers\dmio.sys 21:30:45.0656 0844 dmio - ok 21:30:45.0687 0844 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 21:30:45.0687 0844 dmload - ok 21:30:45.0734 0844 [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver C:\WINDOWS\System32\dmserver.dll 21:30:45.0734 0844 dmserver - ok 21:30:45.0750 0844 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 21:30:45.0750 0844 DMusic - ok 21:30:45.0796 0844 [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 21:30:45.0812 0844 Dnscache - ok 21:30:45.0875 0844 [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll 21:30:45.0875 0844 Dot3svc - ok 21:30:45.0890 0844 [ 40F3B93B4E5B0126F2F5C0A7A5E22660 ] dpti2o C:\WINDOWS\system32\DRIVERS\dpti2o.sys 21:30:45.0890 0844 dpti2o - ok 21:30:45.0937 0844 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 21:30:45.0937 0844 drmkaud - ok 21:30:45.0984 0844 [ A6DE5342417FEC3C0AA8EFEBB899C431 ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys 21:30:45.0984 0844 E100B - ok 21:30:46.0031 0844 [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost C:\WINDOWS\System32\eapsvc.dll 21:30:46.0031 0844 EapHost - ok 21:30:46.0078 0844 [ 877C18558D70587AA7823A1A308AC96B ] ERSvc C:\WINDOWS\System32\ersvc.dll 21:30:46.0078 0844 ERSvc - ok 21:30:46.0140 0844 [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog C:\WINDOWS\system32\services.exe 21:30:46.0140 0844 Eventlog - ok 21:30:46.0203 0844 [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem C:\WINDOWS\system32\es.dll 21:30:46.0203 0844 EventSystem - ok 21:30:46.0281 0844 Fabs - ok 21:30:46.0343 0844 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 21:30:46.0343 0844 Fastfat - ok 21:30:46.0406 0844 [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 21:30:46.0406 0844 FastUserSwitchingCompatibility - ok 21:30:46.0437 0844 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys 21:30:46.0437 0844 Fdc - ok 21:30:46.0453 0844 [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips C:\WINDOWS\system32\drivers\Fips.sys 21:30:46.0453 0844 Fips - ok 21:30:46.0562 0844 [ FFF1130F7C9FA01D093A1EDFC5CCE8FC ] FirebirdServerMAGIXInstance C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\fbserver.exe 21:30:46.0671 0844 FirebirdServerMAGIXInstance - ok 21:30:46.0734 0844 [ 227846995AFEEFA70D328BF5334A86A5 ] FLEXnet Licensing Service C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 21:30:46.0750 0844 FLEXnet Licensing Service - ok 21:30:46.0781 0844 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys 21:30:46.0781 0844 Flpydisk - ok 21:30:46.0828 0844 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys 21:30:46.0828 0844 FltMgr - ok 21:30:46.0890 0844 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 21:30:46.0906 0844 FontCache3.0.0.0 - ok 21:30:46.0921 0844 [ 037B3AB349BE884BB8CB9C5356E34717 ] FSLX C:\WINDOWS\system32\drivers\fslx.sys 21:30:46.0937 0844 FSLX - ok 21:30:46.0968 0844 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 21:30:46.0968 0844 Fs_Rec - ok 21:30:46.0984 0844 [ 8F1955CE42E1484714B542F341647778 ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 21:30:46.0984 0844 Ftdisk - ok 21:30:47.0031 0844 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 21:30:47.0031 0844 Gpc - ok 21:30:47.0093 0844 [ 00A1FDF812AE26730BC94F08047CA2A0 ] GrabsterSeries.X86 C:\WINDOWS\system32\DRIVERS\GrabsterSeries.X86.SYS 21:30:47.0093 0844 GrabsterSeries.X86 - ok 21:30:47.0234 0844 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Programme\Google\Update\GoogleUpdate.exe 21:30:47.0250 0844 gupdate - ok 21:30:47.0250 0844 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Programme\Google\Update\GoogleUpdate.exe 21:30:47.0250 0844 gupdatem - ok 21:30:47.0328 0844 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe 21:30:47.0328 0844 gusvc - ok 21:30:47.0375 0844 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 21:30:47.0375 0844 HDAudBus - ok 21:30:47.0484 0844 [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 21:30:47.0484 0844 helpsvc - ok 21:30:47.0500 0844 HidServ - ok 21:30:47.0562 0844 [ ED29F14101523A6E0E808107405D452C ] hkmsvc C:\WINDOWS\System32\kmsvc.dll 21:30:47.0562 0844 hkmsvc - ok 21:30:47.0656 0844 [ C5F00D15AA15CB7F55A027FF75E44BB7 ] HP Port Resolver C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE 21:30:47.0687 0844 HP Port Resolver - ok 21:30:47.0703 0844 [ C5A288E4CEEF5A26D105117BAA3763AB ] HP Status Server C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE 21:30:47.0703 0844 HP Status Server - ok 21:30:47.0718 0844 hpn - ok 21:30:47.0796 0844 [ 30CA91E657CEDE2F95359D6EF186F650 ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys 21:30:47.0796 0844 HPZid412 - ok 21:30:47.0812 0844 [ EFD31AFA752AA7C7BBB57BCBE2B01C78 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 21:30:47.0812 0844 HPZipr12 - ok 21:30:47.0828 0844 [ 7AC43C38CA8FD7ED0B0A4466F753E06E ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys 21:30:47.0828 0844 HPZius12 - ok 21:30:47.0875 0844 [ CBD09ED9CF6822177EE85AEA4D8816A2 ] HTCAND32 C:\WINDOWS\system32\Drivers\ANDROIDUSB.sys 21:30:47.0875 0844 HTCAND32 - ok 21:30:47.0937 0844 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 21:30:47.0937 0844 HTTP - ok 21:30:48.0000 0844 [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 21:30:48.0000 0844 HTTPFilter - ok 21:30:48.0015 0844 i2omgmt - ok 21:30:48.0031 0844 i2omp - ok 21:30:48.0062 0844 [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 21:30:48.0062 0844 i8042prt - ok 21:30:48.0109 0844 [ 06B7EF73BA5F302EECC294CDF7E19702 ] i81x C:\WINDOWS\system32\DRIVERS\i81xnt5.sys 21:30:48.0109 0844 i81x - ok 21:30:48.0140 0844 [ 7B5B44EFE5EB9DADFB8EE29700885D23 ] iAimFP0 C:\WINDOWS\system32\DRIVERS\wADV01nt.sys 21:30:48.0140 0844 iAimFP0 - ok 21:30:48.0156 0844 [ EB1F6BAB6C22EDE0BA551B527475F7E9 ] iAimFP1 C:\WINDOWS\system32\DRIVERS\wADV02NT.sys 21:30:48.0156 0844 iAimFP1 - ok 21:30:48.0156 0844 [ 03CE989D846C1AA81145CB22FCB86D06 ] iAimFP2 C:\WINDOWS\system32\DRIVERS\wADV05NT.sys 21:30:48.0156 0844 iAimFP2 - ok 21:30:48.0171 0844 [ 525849B4469DE021D5D61B4DB9BE3A9D ] iAimFP3 C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys 21:30:48.0171 0844 iAimFP3 - ok 21:30:48.0187 0844 [ 589C2BCDB5BD602BF7B63D210407EF8C ] iAimFP4 C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys 21:30:48.0187 0844 iAimFP4 - ok 21:30:48.0203 0844 [ 0308AEF61941E4AF478FA1A0F83812F5 ] iAimFP5 C:\WINDOWS\system32\DRIVERS\wADV07nt.sys 21:30:48.0203 0844 iAimFP5 - ok 21:30:48.0218 0844 [ 714038A8AA5DE08E12062202CD7EAEB5 ] iAimFP6 C:\WINDOWS\system32\DRIVERS\wADV08nt.sys 21:30:48.0218 0844 iAimFP6 - ok 21:30:48.0218 0844 [ 7BB3AA595E4507A788DE1CDC63F4C8C4 ] iAimFP7 C:\WINDOWS\system32\DRIVERS\wADV09nt.sys 21:30:48.0218 0844 iAimFP7 - ok 21:30:48.0234 0844 [ D83BDD5C059667A2F647A6BE5703A4D2 ] iAimTV0 C:\WINDOWS\system32\DRIVERS\wATV01nt.sys 21:30:48.0234 0844 iAimTV0 - ok 21:30:48.0250 0844 [ ED968D23354DAA0D7C621580C012A1F6 ] iAimTV1 C:\WINDOWS\system32\DRIVERS\wATV02NT.sys 21:30:48.0250 0844 iAimTV1 - ok 21:30:48.0250 0844 [ D738273F218A224C1DDAC04203F27A84 ] iAimTV3 C:\WINDOWS\system32\DRIVERS\wATV04nt.sys 21:30:48.0265 0844 iAimTV3 - ok 21:30:48.0265 0844 [ 0052D118995CBAB152DAABE6106D1442 ] iAimTV4 C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys 21:30:48.0265 0844 iAimTV4 - ok 21:30:48.0281 0844 [ 791CC45DE6E50445BE72E8AD6401FF45 ] iAimTV5 C:\WINDOWS\system32\DRIVERS\wATV10nt.sys 21:30:48.0281 0844 iAimTV5 - ok 21:30:48.0296 0844 [ 352FA0E98BC461CE1CE5D41F64DB558D ] iAimTV6 C:\WINDOWS\system32\DRIVERS\wATV06nt.sys 21:30:48.0296 0844 iAimTV6 - ok 21:30:48.0421 0844 [ C4018896856A1A1F1F3A0A6EE7206551 ] ialm C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 21:30:48.0531 0844 ialm - ok 21:30:48.0656 0844 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 21:30:48.0671 0844 idsvc - ok 21:30:48.0765 0844 [ AD5DF6F4FBBC798636EDC66BFEC7D0DE ] IJPLMSVC C:\Programme\Canon\IJPLM\IJPLMSVC.EXE 21:30:48.0765 0844 IJPLMSVC - ok 21:30:48.0781 0844 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys 21:30:48.0781 0844 Imapi - ok 21:30:48.0828 0844 [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService C:\WINDOWS\system32\imapi.exe 21:30:48.0828 0844 ImapiService - ok 21:30:48.0843 0844 ini910u - ok 21:30:48.0984 0844 [ E5C925B50154D102734AB446ADE781F4 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys 21:30:49.0078 0844 IntcAzAudAddService - ok 21:30:49.0125 0844 [ 69C4E3C9E67A1F103B94E14FDD5F3213 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys 21:30:49.0125 0844 IntelIde - ok 21:30:49.0171 0844 [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys 21:30:49.0171 0844 intelppm - ok 21:30:49.0203 0844 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys 21:30:49.0203 0844 Ip6Fw - ok 21:30:49.0234 0844 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 21:30:49.0234 0844 IpFilterDriver - ok 21:30:49.0250 0844 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 21:30:49.0250 0844 IpInIp - ok 21:30:49.0296 0844 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 21:30:49.0296 0844 IpNat - ok 21:30:49.0312 0844 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 21:30:49.0312 0844 IPSec - ok 21:30:49.0343 0844 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 21:30:49.0343 0844 IRENUM - ok 21:30:49.0390 0844 [ 6DFB88F64135C525433E87648BDA30DE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 21:30:49.0390 0844 isapnp - ok 21:30:49.0453 0844 [ 213822072085B5BBAD9AF30AB577D817 ] IviRegMgr C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe 21:30:49.0453 0844 IviRegMgr - ok 21:30:49.0562 0844 [ A0D14B7538FA3AE9CB771B9E99CECF43 ] JavaQuickStarterService C:\Programme\Java\jre6\bin\jqs.exe 21:30:49.0562 0844 JavaQuickStarterService - ok 21:30:49.0578 0844 [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 21:30:49.0578 0844 Kbdclass - ok 21:30:49.0609 0844 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 21:30:49.0609 0844 kmixer - ok 21:30:49.0671 0844 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 21:30:49.0671 0844 KSecDD - ok 21:30:49.0734 0844 [ 2BBDCB79900990F0716DFCB714E72DE7 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll 21:30:49.0734 0844 lanmanserver - ok 21:30:49.0796 0844 [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 21:30:49.0796 0844 lanmanworkstation - ok 21:30:49.0812 0844 lbrtfdc - ok 21:30:49.0859 0844 [ 636714B7D43C8D0C80449123FD266920 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 21:30:49.0859 0844 LmHosts - ok 21:30:49.0906 0844 [ 4A5FFDF0FE830C448830BD4B02B02B4B ] mbamchameleon C:\WINDOWS\system32\drivers\mbamchameleon.sys 21:30:49.0906 0844 mbamchameleon - ok 21:30:49.0937 0844 [ B7550A7107281D170CE85524B1488C98 ] Messenger C:\WINDOWS\System32\msgsvc.dll 21:30:49.0937 0844 Messenger - ok 21:30:49.0968 0844 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys 21:30:49.0968 0844 mnmdd - ok 21:30:50.0015 0844 [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe 21:30:50.0031 0844 mnmsrvc - ok 21:30:50.0046 0844 [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 21:30:50.0062 0844 Modem - ok 21:30:50.0093 0844 [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 21:30:50.0093 0844 Mouclass - ok 21:30:50.0109 0844 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 21:30:50.0109 0844 MountMgr - ok 21:30:50.0140 0844 [ C0F8E0C2C3C0437CF37C6781896DC3EC ] MPE C:\WINDOWS\system32\DRIVERS\MPE.sys 21:30:50.0156 0844 MPE - ok 21:30:50.0156 0844 mraid35x - ok 21:30:50.0171 0844 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 21:30:50.0171 0844 MRxDAV - ok 21:30:50.0218 0844 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 21:30:50.0218 0844 MRxSmb - ok 21:30:50.0265 0844 [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC C:\WINDOWS\system32\msdtc.exe 21:30:50.0265 0844 MSDTC - ok 21:30:50.0359 0844 [ 1477849772712BAC69C144DCF2C9CE81 ] MSDV C:\WINDOWS\system32\DRIVERS\msdv.sys 21:30:50.0359 0844 MSDV - ok 21:30:50.0375 0844 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 21:30:50.0375 0844 Msfs - ok 21:30:50.0375 0844 MSIServer - ok 21:30:50.0390 0844 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 21:30:50.0390 0844 MSKSSRV - ok 21:30:50.0406 0844 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 21:30:50.0406 0844 MSPCLOCK - ok 21:30:50.0453 0844 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 21:30:50.0453 0844 MSPQM - ok 21:30:50.0500 0844 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 21:30:50.0500 0844 mssmbios - ok 21:30:50.0546 0844 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys 21:30:50.0546 0844 MSTEE - ok 21:30:50.0609 0844 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 21:30:50.0609 0844 Mup - ok 21:30:50.0640 0844 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 21:30:50.0640 0844 NABTSFEC - ok 21:30:50.0687 0844 [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent C:\WINDOWS\System32\qagentrt.dll 21:30:50.0687 0844 napagent - ok 21:30:50.0734 0844 [ B5B1080D35974C0E718D64280761BCD5 ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 21:30:50.0734 0844 NDIS - ok 21:30:50.0765 0844 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys 21:30:50.0765 0844 NdisIP - ok 21:30:50.0812 0844 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 21:30:50.0812 0844 NdisTapi - ok 21:30:50.0875 0844 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 21:30:50.0875 0844 Ndisuio - ok 21:30:50.0921 0844 [ B053A8411045FD0664B389A090CB2BBC ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 21:30:50.0921 0844 NdisWan - ok 21:30:50.0953 0844 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 21:30:50.0968 0844 NDProxy - ok 21:30:50.0984 0844 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 21:30:50.0984 0844 NetBIOS - ok 21:30:51.0046 0844 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 21:30:51.0046 0844 NetBT - ok 21:30:51.0109 0844 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE C:\WINDOWS\system32\netdde.exe 21:30:51.0109 0844 NetDDE - ok 21:30:51.0125 0844 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 21:30:51.0125 0844 NetDDEdsdm - ok 21:30:51.0171 0844 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon C:\WINDOWS\system32\lsass.exe 21:30:51.0171 0844 Netlogon - ok 21:30:51.0203 0844 [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman C:\WINDOWS\System32\netman.dll 21:30:51.0203 0844 Netman - ok 21:30:51.0250 0844 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 21:30:51.0250 0844 NetTcpPortSharing - ok 21:30:51.0296 0844 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys 21:30:51.0312 0844 NIC1394 - ok 21:30:51.0343 0844 [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla C:\WINDOWS\System32\mswsock.dll 21:30:51.0359 0844 Nla - ok 21:30:51.0359 0844 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 21:30:51.0359 0844 Npfs - ok 21:30:51.0406 0844 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 21:30:51.0406 0844 Ntfs - ok 21:30:51.0437 0844 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp C:\WINDOWS\system32\lsass.exe 21:30:51.0453 0844 NtLmSsp - ok 21:30:51.0500 0844 [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 21:30:51.0515 0844 NtmsSvc - ok 21:30:51.0546 0844 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 21:30:51.0562 0844 Null - ok 21:30:51.0593 0844 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 21:30:51.0593 0844 NwlnkFlt - ok 21:30:51.0593 0844 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 21:30:51.0593 0844 NwlnkFwd - ok 21:30:51.0640 0844 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys 21:30:51.0640 0844 ohci1394 - ok 21:30:51.0750 0844 [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE 21:30:51.0750 0844 ose - ok 21:30:51.0765 0844 [ A7AF0C0860F1C43FC6581BA8A99EABEF ] P3 C:\WINDOWS\system32\DRIVERS\p3.sys 21:30:51.0765 0844 P3 - ok 21:30:51.0812 0844 [ F84785660305B9B903FB3BCA8BA29837 ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys 21:30:51.0812 0844 Parport - ok 21:30:51.0843 0844 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 21:30:51.0843 0844 PartMgr - ok 21:30:51.0890 0844 [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 21:30:51.0890 0844 ParVdm - ok 21:30:51.0984 0844 [ 2A42DDAEAAE7743C55A3FA68A7AD9538 ] PCA C:\WINDOWS\SMINST\PCAngel.exe 21:30:51.0984 0844 PCA - ok 21:30:52.0000 0844 [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 21:30:52.0000 0844 PCI - ok 21:30:52.0015 0844 PCIDump - ok 21:30:52.0046 0844 [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys 21:30:52.0046 0844 PCIIde - ok 21:30:52.0093 0844 [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys 21:30:52.0093 0844 Pcmcia - ok 21:30:52.0093 0844 PDCOMP - ok 21:30:52.0156 0844 pdfcDispatcher - ok 21:30:52.0156 0844 PDFRAME - ok 21:30:52.0171 0844 PDRELI - ok 21:30:52.0187 0844 PDRFRAME - ok 21:30:52.0187 0844 perc2 - ok 21:30:52.0203 0844 perc2hib - ok 21:30:52.0265 0844 [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay C:\WINDOWS\system32\services.exe 21:30:52.0265 0844 PlugPlay - ok 21:30:52.0328 0844 [ 2D091A99624FB9E7EEF0A86D872EC0C3 ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe 21:30:52.0328 0844 Pml Driver HPZ12 - ok 21:30:52.0343 0844 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 21:30:52.0343 0844 PolicyAgent - ok 21:30:52.0390 0844 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 21:30:52.0390 0844 PptpMiniport - ok 21:30:52.0406 0844 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 21:30:52.0406 0844 ProtectedStorage - ok 21:30:52.0406 0844 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 21:30:52.0406 0844 PSched - ok 21:30:52.0453 0844 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 21:30:52.0453 0844 Ptilink - ok 21:30:52.0468 0844 ql1080 - ok 21:30:52.0484 0844 Ql10wnt - ok 21:30:52.0500 0844 ql12160 - ok 21:30:52.0500 0844 ql1240 - ok 21:30:52.0515 0844 ql1280 - ok 21:30:52.0546 0844 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 21:30:52.0546 0844 RasAcd - ok 21:30:52.0593 0844 [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto C:\WINDOWS\System32\rasauto.dll 21:30:52.0593 0844 RasAuto - ok 21:30:52.0609 0844 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 21:30:52.0609 0844 Rasl2tp - ok 21:30:52.0656 0844 [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan C:\WINDOWS\System32\rasmans.dll 21:30:52.0656 0844 RasMan - ok 21:30:52.0671 0844 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 21:30:52.0671 0844 RasPppoe - ok 21:30:52.0703 0844 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 21:30:52.0703 0844 Raspti - ok 21:30:52.0750 0844 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 21:30:52.0750 0844 Rdbss - ok 21:30:52.0765 0844 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 21:30:52.0765 0844 RDPCDD - ok 21:30:52.0828 0844 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys 21:30:52.0828 0844 rdpdr - ok 21:30:52.0875 0844 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 21:30:52.0875 0844 RDPWD - ok 21:30:52.0921 0844 [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 21:30:52.0921 0844 RDSessMgr - ok 21:30:52.0953 0844 [ ED761D453856F795A7FE056E42C36365 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 21:30:52.0953 0844 redbook - ok 21:30:53.0015 0844 [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 21:30:53.0015 0844 RemoteAccess - ok 21:30:53.0078 0844 [ E4CD1F3D84E1C2CA0B8CF7501E201593 ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll 21:30:53.0078 0844 RemoteRegistry - ok 21:30:53.0125 0844 [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator C:\WINDOWS\system32\locator.exe 21:30:53.0125 0844 RpcLocator - ok 21:30:53.0171 0844 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs C:\WINDOWS\system32\rpcss.dll 21:30:53.0171 0844 RpcSs - ok 21:30:53.0234 0844 [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP C:\WINDOWS\system32\rsvp.exe 21:30:53.0234 0844 RSVP - ok 21:30:53.0281 0844 [ 89619EF503F949FAE09252A8B883EE11 ] RTLE8023xp C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys 21:30:53.0281 0844 RTLE8023xp - ok 21:30:53.0296 0844 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs C:\WINDOWS\system32\lsass.exe 21:30:53.0296 0844 SamSs - ok 21:30:53.0359 0844 [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 21:30:53.0359 0844 SCardSvr - ok 21:30:53.0406 0844 [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule C:\WINDOWS\system32\schedsvc.dll 21:30:53.0406 0844 Schedule - ok 21:30:53.0453 0844 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 21:30:53.0453 0844 Secdrv - ok 21:30:53.0500 0844 [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon C:\WINDOWS\System32\seclogon.dll 21:30:53.0500 0844 seclogon - ok 21:30:53.0562 0844 [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS C:\WINDOWS\system32\sens.dll 21:30:53.0562 0844 SENS - ok 21:30:53.0593 0844 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys 21:30:53.0593 0844 serenum - ok 21:30:53.0640 0844 [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys 21:30:53.0640 0844 Serial - ok 21:30:53.0671 0844 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\DRIVERS\sfloppy.sys 21:30:53.0671 0844 Sfloppy - ok 21:30:53.0734 0844 [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 21:30:53.0750 0844 SharedAccess - ok 21:30:53.0765 0844 [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 21:30:53.0765 0844 ShellHWDetection - ok 21:30:53.0781 0844 Simbad - ok 21:30:53.0812 0844 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys 21:30:53.0812 0844 SLIP - ok 21:30:53.0859 0844 [ 5CE1CF27620B144E212D407CDB14D339 ] snapman380 C:\WINDOWS\system32\DRIVERS\snman380.sys 21:30:53.0859 0844 snapman380 - ok 21:30:53.0875 0844 Sparrow - ok 21:30:53.0921 0844 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 21:30:53.0921 0844 splitter - ok 21:30:53.0968 0844 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe 21:30:53.0984 0844 Spooler - ok 21:30:54.0046 0844 [ D15DA1BA189770D93EEA2D7E18F95AF9 ] sptd C:\WINDOWS\System32\Drivers\sptd.sys 21:30:54.0062 0844 sptd - ok 21:30:54.0093 0844 [ 50FA898F8C032796D3B1B9951BB5A90F ] sr C:\WINDOWS\system32\DRIVERS\sr.sys 21:30:54.0093 0844 sr - ok 21:30:54.0140 0844 [ FE77A85495065F3AD59C5C65B6C54182 ] srservice C:\WINDOWS\system32\srsvc.dll 21:30:54.0140 0844 srservice - ok 21:30:54.0187 0844 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 21:30:54.0187 0844 Srv - ok 21:30:54.0218 0844 [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 21:30:54.0218 0844 SSDPSRV - ok 21:30:54.0265 0844 [ A2DBCC4C8860449DF1AB758EA28B4DE0 ] StillCam C:\WINDOWS\system32\DRIVERS\serscan.sys 21:30:54.0265 0844 StillCam - ok 21:30:54.0296 0844 [ BC2C5985611C5356B24AEB370953DED9 ] stisvc C:\WINDOWS\system32\wiaservc.dll 21:30:54.0312 0844 stisvc - ok 21:30:54.0328 0844 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys 21:30:54.0328 0844 streamip - ok 21:30:54.0359 0844 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 21:30:54.0359 0844 swenum - ok 21:30:54.0421 0844 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 21:30:54.0421 0844 swmidi - ok 21:30:54.0437 0844 SwPrv - ok 21:30:54.0468 0844 [ 1FF3217614018630D0A6758630FC698C ] symc810 C:\WINDOWS\system32\DRIVERS\symc810.sys 21:30:54.0468 0844 symc810 - ok 21:30:54.0484 0844 [ 070E001D95CF725186EF8B20335F933C ] symc8xx C:\WINDOWS\system32\DRIVERS\symc8xx.sys 21:30:54.0484 0844 symc8xx - ok 21:30:54.0484 0844 [ F2B7E8416F508368AC6730E2AE1C614F ] Symmpi C:\WINDOWS\system32\DRIVERS\symmpi.sys 21:30:54.0484 0844 Symmpi - ok 21:30:54.0500 0844 [ 80AC1C4ABBE2DF3B738BF15517A51F2C ] sym_hi C:\WINDOWS\system32\DRIVERS\sym_hi.sys 21:30:54.0500 0844 sym_hi - ok 21:30:54.0515 0844 [ BF4FAB949A382A8E105F46EBB4937058 ] sym_u3 C:\WINDOWS\system32\DRIVERS\sym_u3.sys 21:30:54.0515 0844 sym_u3 - ok 21:30:54.0562 0844 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 21:30:54.0562 0844 sysaudio - ok 21:30:54.0656 0844 [ B3D5BBE04293DEEC1812F2CB5D08C230 ] syshost32 C:\WINDOWS\Installer\{2A781366-67FF-1FE0-3C30-7D941BF2EEAB}\syshost.exe 21:30:54.0671 0844 syshost32 - ok 21:30:54.0703 0844 [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 21:30:54.0703 0844 SysmonLog - ok 21:30:54.0765 0844 [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 21:30:54.0828 0844 TapiSrv - ok 21:30:54.0953 0844 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 21:30:54.0953 0844 Tcpip - ok 21:30:55.0000 0844 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 21:30:55.0000 0844 TDPIPE - ok 21:30:55.0062 0844 [ 9855C40DE1DE32AAA4E290A361CDA0F3 ] tdrpman140 C:\WINDOWS\system32\DRIVERS\tdrpm140.sys 21:30:55.0093 0844 tdrpman140 - ok 21:30:55.0125 0844 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 21:30:55.0125 0844 TDTCP - ok 21:30:55.0156 0844 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 21:30:55.0156 0844 TermDD - ok 21:30:55.0218 0844 [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService C:\WINDOWS\System32\termsrv.dll 21:30:55.0218 0844 TermService - ok 21:30:55.0234 0844 [ 2DB7D303C36DDD055215052F118E8E75 ] Themes C:\WINDOWS\System32\shsvcs.dll 21:30:55.0250 0844 Themes - ok 21:30:55.0296 0844 [ 6DCB8DDB481CD3C40FA68593723B4D89 ] tifsfilter C:\WINDOWS\system32\DRIVERS\tifsfilt.sys 21:30:55.0296 0844 tifsfilter - ok 21:30:55.0312 0844 [ 394FC70B88B7958FA85798BBC76D140A ] timounter C:\WINDOWS\system32\DRIVERS\timntr.sys 21:30:55.0328 0844 timounter - ok 21:30:55.0375 0844 [ 03681A1CE77F51586903869A5AB1DEAB ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe 21:30:55.0375 0844 TlntSvr - ok 21:30:55.0390 0844 TosIde - ok 21:30:55.0437 0844 [ 626504572B175867F30F3215C04B3E2F ] TrkWks C:\WINDOWS\system32\trkwks.dll 21:30:55.0437 0844 TrkWks - ok 21:30:55.0468 0844 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 21:30:55.0468 0844 Udfs - ok 21:30:55.0484 0844 ultra - ok 21:30:55.0531 0844 [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost C:\WINDOWS\System32\upnphost.dll 21:30:55.0531 0844 upnphost - ok 21:30:55.0625 0844 [ 7CE0FE34FD8FB7F52D1E503B0C1E4FA9 ] UPnPService C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe 21:30:55.0640 0844 UPnPService - ok 21:30:55.0671 0844 [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS C:\WINDOWS\System32\ups.exe 21:30:55.0671 0844 UPS - ok 21:30:55.0718 0844 [ 8E9DCCB2BA19C959A8C3A344445BB954 ] USB28xxBGA C:\WINDOWS\system32\DRIVERS\emBDA.sys 21:30:55.0734 0844 USB28xxBGA - ok 21:30:55.0781 0844 [ DA617CA98704142F10938089DD0738A4 ] USB28xxOEM C:\WINDOWS\system32\DRIVERS\emOEM.sys 21:30:55.0781 0844 USB28xxOEM - ok 21:30:55.0828 0844 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys 21:30:55.0828 0844 usbaudio - ok 21:30:55.0875 0844 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 21:30:55.0875 0844 usbccgp - ok 21:30:55.0937 0844 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 21:30:55.0937 0844 usbehci - ok 21:30:56.0000 0844 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 21:30:56.0000 0844 usbhub - ok 21:30:56.0046 0844 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys 21:30:56.0046 0844 usbprint - ok 21:30:56.0109 0844 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 21:30:56.0109 0844 usbscan - ok 21:30:56.0125 0844 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 21:30:56.0125 0844 USBSTOR - ok 21:30:56.0140 0844 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys 21:30:56.0140 0844 usbuhci - ok 21:30:56.0187 0844 [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys 21:30:56.0187 0844 usb_rndisx - ok 21:30:56.0203 0844 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 21:30:56.0203 0844 VgaSave - ok 21:30:56.0234 0844 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys 21:30:56.0234 0844 ViaIde - ok 21:30:56.0281 0844 [ A5A712F4E880874A477AF790B5186E1D ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 21:30:56.0281 0844 VolSnap - ok 21:30:56.0343 0844 [ 68F106273BE29E7B7EF8266977268E78 ] VSS C:\WINDOWS\System32\vssvc.exe 21:30:56.0359 0844 VSS - ok 21:30:56.0421 0844 [ 7B353059E665F8B7AD2BBEAEF597CF45 ] W32Time C:\WINDOWS\system32\w32time.dll 21:30:56.0421 0844 W32Time - ok 21:30:56.0484 0844 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 21:30:56.0484 0844 Wanarp - ok 21:30:56.0531 0844 [ 4769596D7CC0F5FA447D2BABC239672A ] Wdf01000 C:\WINDOWS\system32\Drivers\wdf01000.sys 21:30:56.0531 0844 Wdf01000 - ok 21:30:56.0546 0844 WDICA - ok 21:30:56.0593 0844 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 21:30:56.0593 0844 wdmaud - ok 21:30:56.0656 0844 [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient C:\WINDOWS\System32\webclnt.dll 21:30:56.0656 0844 WebClient - ok 21:30:56.0765 0844 [ 6F3F3973D97714CC5F906A19FE883729 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 21:30:56.0765 0844 winmgmt - ok 21:30:56.0828 0844 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll 21:30:56.0828 0844 WmdmPmSN - ok 21:30:56.0890 0844 [ FFA4D901D46D07A5BAB2D8307FBB51A6 ] Wmi C:\WINDOWS\System32\advapi32.dll 21:30:56.0921 0844 Wmi - ok 21:30:56.0968 0844 [ 93908111BA57A6E60EC2FA2DE202105C ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe 21:30:56.0968 0844 WmiApSrv - ok 21:30:57.0078 0844 [ BF05650BB7DF5E9EBDD25974E22403BB ] WMPNetworkSvc C:\Programme\Windows Media Player\WMPNetwk.exe 21:30:57.0109 0844 WMPNetworkSvc - ok 21:30:57.0156 0844 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys 21:30:57.0156 0844 WS2IFSL - ok 21:30:57.0203 0844 [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc C:\WINDOWS\system32\wscsvc.dll 21:30:57.0218 0844 wscsvc - ok 21:30:57.0250 0844 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 21:30:57.0250 0844 WSTCODEC - ok 21:30:57.0296 0844 [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv C:\WINDOWS\system32\wuauserv.dll 21:30:57.0343 0844 wuauserv - ok 21:30:57.0359 0844 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 21:30:57.0359 0844 WudfPf - ok 21:30:57.0375 0844 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys 21:30:57.0390 0844 WudfRd - ok 21:30:57.0421 0844 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 21:30:57.0421 0844 WudfSvc - ok 21:30:57.0468 0844 [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 21:30:57.0468 0844 WZCSVC - ok 21:30:57.0515 0844 [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 21:30:57.0515 0844 xmlprov - ok 21:30:57.0531 0844 ================ Scan global =============================== 21:30:57.0640 0844 [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll 21:30:57.0703 0844 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll 21:30:57.0703 0844 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll 21:30:57.0750 0844 [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe 21:30:57.0750 0844 [Global] - ok 21:30:57.0750 0844 ================ Scan MBR ================================== 21:30:57.0781 0844 [ 4F02A8D4048A138C450ED7F867EB0144 ] \Device\Harddisk0\DR0 21:30:57.0906 0844 \Device\Harddisk0\DR0 - ok 21:30:57.0906 0844 ================ Scan VBR ================================== 21:30:57.0921 0844 [ 3EABA0639E6E91DE432B5CC697D6028E ] \Device\Harddisk0\DR0\Partition1 21:30:57.0921 0844 \Device\Harddisk0\DR0\Partition1 - ok 21:30:57.0921 0844 [ 28DC951D362DC489D47EC929C961683A ] \Device\Harddisk0\DR0\Partition2 21:30:57.0921 0844 \Device\Harddisk0\DR0\Partition2 - ok 21:30:57.0921 0844 ============================================================ 21:30:57.0921 0844 Scan finished 21:30:57.0921 0844 ============================================================ 21:30:57.0937 0836 Detected object count: 1 21:30:57.0937 0836 Actual detected object count: 1 21:35:50.0328 0836 cb010bd02561def3 ( Rootkit.Win32.Necurs.gen ) - skipped by user 21:35:50.0328 0836 cb010bd02561def3 ( Rootkit.Win32.Necurs.gen ) - User select action: Skip |
|
18.02.2013, 22:04
| #8 |
| /// TB-Ausbilder | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion Ok, dann mach im abgesicherten Modus das Folgende. Starte bitte TDSSkiller.exe. Vista und Win7 User mit Rechtsklick "als Administrator ausführen".
Danach versuch im abgesicherten Modus nochmals MBAR zu starten.
__________________ cheers, Leo |
|
18.02.2013, 22:19
| #9 |
| | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion das ist das log file, starte dann mbar LG Alfred 2:08:27.0734 0240 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42 22:08:28.0062 0240 ============================================================ 22:08:28.0062 0240 Current date / time: 2013/02/18 22:08:28.0062 22:08:28.0062 0240 SystemInfo: 22:08:28.0062 0240 22:08:28.0062 0240 OS Version: 5.1.2600 ServicePack: 3.0 22:08:28.0062 0240 Product type: Workstation 22:08:28.0062 0240 ComputerName: HP1 22:08:28.0062 0240 UserName: Alfred 22:08:28.0062 0240 Windows directory: C:\WINDOWS 22:08:28.0062 0240 System windows directory: C:\WINDOWS 22:08:28.0062 0240 Processor architecture: Intel x86 22:08:28.0062 0240 Number of processors: 2 22:08:28.0062 0240 Page size: 0x1000 22:08:28.0062 0240 Boot type: Safe boot with network 22:08:28.0062 0240 ============================================================ 22:08:34.0343 0240 !crdlk 22:08:34.0468 0240 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'A' 22:08:34.0500 0240 ============================================================ 22:08:34.0500 0240 \Device\Harddisk0\DR0: 22:08:34.0515 0240 MBR partitions: 22:08:34.0515 0240 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1B1BB2D7 22:08:34.0515 0240 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1B1BF1D7, BlocksNum 0x20014E9 22:08:34.0515 0240 ============================================================ 22:08:34.0531 0240 C: <-> \Device\Harddisk0\DR0\Partition1 22:08:34.0562 0240 D: <-> \Device\Harddisk0\DR0\Partition2 22:08:34.0562 0240 ============================================================ 22:08:34.0562 0240 Initialize success 22:08:34.0562 0240 ============================================================ 22:08:39.0828 1864 ============================================================ 22:08:39.0828 1864 Scan started 22:08:39.0828 1864 Mode: Manual; 22:08:39.0828 1864 ============================================================ 22:08:40.0687 1864 ================ Scan system memory ======================== 22:08:40.0687 1864 System memory - ok 22:08:40.0687 1864 ================ Scan services ============================= 22:08:40.0890 1864 [ 914A9709FC3BF419AD2F85547F2A4832 ] 61883 C:\WINDOWS\system32\DRIVERS\61883.sys 22:08:40.0890 1864 61883 - ok 22:08:40.0953 1864 [ 149A8F7ADF9742554DC323E290551E3E ] Aavmker4 C:\WINDOWS\system32\drivers\Aavmker4.sys 22:08:40.0953 1864 Aavmker4 - ok 22:08:40.0953 1864 Abiosdsk - ok 22:08:40.0968 1864 abp480n5 - ok 22:08:41.0015 1864 [ 0F2D66D5F08EBE2F77BB904288DCF6F0 ] ac97intc C:\WINDOWS\system32\drivers\ac97intc.sys 22:08:41.0015 1864 ac97intc - ok 22:08:41.0078 1864 [ 553BA53445795CBC0D4F9FA37EB855A6 ] acedrv10 C:\WINDOWS\system32\drivers\acedrv10.sys 22:08:41.0078 1864 acedrv10 - ok 22:08:41.0093 1864 [ 8CE00B6A46962A1808B19CD1DAE5170C ] acehlp10 C:\WINDOWS\system32\drivers\acehlp10.sys 22:08:41.0093 1864 acehlp10 - ok 22:08:41.0156 1864 [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 22:08:41.0156 1864 ACPI - ok 22:08:41.0187 1864 [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys 22:08:41.0187 1864 ACPIEC - ok 22:08:41.0296 1864 [ 744ED7AABA941C0E3B7668F5CA4E345F ] AcrSch2Svc C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe 22:08:41.0296 1864 AcrSch2Svc - ok 22:08:41.0406 1864 [ 563CDCFEEAEF97163E206AF71A61AA6E ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 22:08:41.0406 1864 AdobeFlashPlayerUpdateSvc - ok 22:08:41.0453 1864 [ 9A11864873DA202C996558B2106B0BBC ] adpu160m C:\WINDOWS\system32\DRIVERS\adpu160m.sys 22:08:41.0453 1864 adpu160m - ok 22:08:41.0468 1864 [ 0EA9B1F0C6C90A509C8603775366ADB7 ] adpu320 C:\WINDOWS\system32\DRIVERS\adpu320.sys 22:08:41.0468 1864 adpu320 - ok 22:08:41.0500 1864 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys 22:08:41.0500 1864 aec - ok 22:08:41.0546 1864 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys 22:08:41.0546 1864 AFD - ok 22:08:41.0546 1864 Aha154x - ok 22:08:41.0562 1864 [ 19DD0FB48B0C18892F70E2E7D61A1529 ] aic78u2 C:\WINDOWS\system32\DRIVERS\aic78u2.sys 22:08:41.0562 1864 aic78u2 - ok 22:08:41.0578 1864 [ B7FE594A7468AA0132DEB03FB8E34326 ] aic78xx C:\WINDOWS\system32\DRIVERS\aic78xx.sys 22:08:41.0578 1864 aic78xx - ok 22:08:41.0593 1864 [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter C:\WINDOWS\system32\alrsvc.dll 22:08:41.0593 1864 Alerter - ok 22:08:41.0625 1864 [ 190CD73D4984F94D823F9444980513E5 ] ALG C:\WINDOWS\System32\alg.exe 22:08:41.0625 1864 ALG - ok 22:08:41.0640 1864 AliIde - ok 22:08:41.0656 1864 amsint - ok 22:08:41.0734 1864 [ D45960BE52C3C610D361977057F98C54 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll 22:08:41.0734 1864 AppMgmt - ok 22:08:41.0765 1864 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys 22:08:41.0765 1864 Arp1394 - ok 22:08:41.0781 1864 asc - ok 22:08:41.0796 1864 asc3350p - ok 22:08:41.0812 1864 asc3550 - ok 22:08:41.0968 1864 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 22:08:41.0968 1864 aspnet_state - ok 22:08:42.0015 1864 [ DE6ED95AEF259979B2830450072A627B ] aswFsBlk C:\WINDOWS\system32\drivers\aswFsBlk.sys 22:08:42.0015 1864 aswFsBlk - ok 22:08:42.0062 1864 [ 84F0BE324EE111338589F448C3E8BAB2 ] aswMon2 C:\WINDOWS\system32\drivers\aswMon2.sys 22:08:42.0062 1864 aswMon2 - ok 22:08:42.0140 1864 [ 7C9F0A2AB17D52261A9252A2EB320884 ] AswRdr C:\WINDOWS\system32\drivers\AswRdr.sys 22:08:42.0140 1864 AswRdr - ok 22:08:42.0156 1864 [ B32E9AD44A1DBB3E8095E80F8DF32B03 ] aswSnx C:\WINDOWS\system32\drivers\aswSnx.sys 22:08:42.0156 1864 aswSnx - ok 22:08:42.0187 1864 [ 67B558895695545FB0568B7541F3BCA7 ] aswSP C:\WINDOWS\system32\drivers\aswSP.sys 22:08:42.0187 1864 aswSP - ok 22:08:42.0234 1864 [ E3E73B2B73A4DFADFDDF557192C4B08A ] aswTdi C:\WINDOWS\system32\drivers\aswTdi.sys 22:08:42.0234 1864 aswTdi - ok 22:08:42.0250 1864 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 22:08:42.0250 1864 AsyncMac - ok 22:08:42.0265 1864 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 22:08:42.0265 1864 atapi - ok 22:08:42.0281 1864 Atdisk - ok 22:08:42.0343 1864 [ F57801F641E6DF9F4FD4B29D6DEB422C ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe 22:08:42.0343 1864 Ati HotKey Poller - ok 22:08:42.0375 1864 [ 9459F0247D8911CFDF1DC509517AF5B6 ] ATI Smart C:\WINDOWS\system32\ati2sgag.exe 22:08:42.0375 1864 ATI Smart - ok 22:08:42.0437 1864 [ BF94A12F9D86B28FECF00B24B7129013 ] ati2mtag C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 22:08:42.0453 1864 ati2mtag - ok 22:08:42.0484 1864 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 22:08:42.0484 1864 Atmarpc - ok 22:08:42.0546 1864 [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 22:08:42.0546 1864 AudioSrv - ok 22:08:42.0593 1864 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 22:08:42.0593 1864 audstub - ok 22:08:42.0687 1864 [ 8FA553E9AE69808D99C164733A0F9590 ] avast! Antivirus C:\Programme\AVAST Software\Avast\AvastSvc.exe 22:08:42.0687 1864 avast! Antivirus - ok 22:08:42.0718 1864 [ F8E6956A614F15A0860474C5E2A7DE6B ] Avc C:\WINDOWS\system32\DRIVERS\avc.sys 22:08:42.0718 1864 Avc - ok 22:08:42.0750 1864 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 22:08:42.0750 1864 Beep - ok 22:08:42.0812 1864 [ D6F603772A789BB3228F310D650B8BD1 ] BITS C:\WINDOWS\system32\qmgr.dll 22:08:42.0812 1864 BITS - ok 22:08:42.0875 1864 [ 73686FE0B2E0469F89FD2075BE724704 ] Bonjour Service C:\Programme\Bonjour\mDNSResponder.exe 22:08:42.0875 1864 Bonjour Service - ok 22:08:42.0921 1864 [ B71549F23736ADF83A571061C47777FD ] Browser C:\WINDOWS\System32\browser.dll 22:08:42.0921 1864 Browser - ok 22:08:42.0921 1864 Suspicious service (NoAccess): cb010bd02561def3 22:08:42.0968 1864 [ 9AD522490D5F302918CACF4460540DC4 ] cb010bd02561def3 C:\WINDOWS\System32\Drivers\cb010bd02561def3.sys 22:08:42.0968 1864 Suspicious file (NoAccess): C:\WINDOWS\System32\Drivers\cb010bd02561def3.sys. md5: 9AD522490D5F302918CACF4460540DC4 22:08:43.0125 1864 cb010bd02561def3 ( Rootkit.Win32.Necurs.gen ) - infected 22:08:43.0125 1864 cb010bd02561def3 - detected Rootkit.Win32.Necurs.gen (0) 22:08:43.0156 1864 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 22:08:43.0156 1864 cbidf2k - ok 22:08:43.0296 1864 [ 8EF654045E518AC00E52E7A1E2D3AD70 ] CCALib8 C:\Programme\Canon\CAL\CALMAIN.exe 22:08:43.0296 1864 CCALib8 - ok 22:08:43.0328 1864 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 22:08:43.0328 1864 CCDECODE - ok 22:08:43.0343 1864 cd20xrnt - ok 22:08:43.0390 1864 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 22:08:43.0390 1864 Cdaudio - ok 22:08:43.0437 1864 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 22:08:43.0437 1864 Cdfs - ok 22:08:43.0453 1864 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 22:08:43.0453 1864 Cdrom - ok 22:08:43.0468 1864 Changer - ok 22:08:43.0515 1864 [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc C:\WINDOWS\system32\cisvc.exe 22:08:43.0515 1864 CiSvc - ok 22:08:43.0531 1864 [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 22:08:43.0531 1864 ClipSrv - ok 22:08:43.0593 1864 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 22:08:43.0593 1864 clr_optimization_v2.0.50727_32 - ok 22:08:43.0593 1864 CmdIde - ok 22:08:43.0703 1864 [ 38208B45E08C7CD5234E7E2491307F56 ] Common Toolkit Service C:\Programme\Common Files\Common Toolkit Suite\FighterSuiteService.exe 22:08:43.0703 1864 Common Toolkit Service - ok 22:08:43.0718 1864 COMSysApp - ok 22:08:43.0734 1864 Cpqarray - ok 22:08:43.0796 1864 [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 22:08:43.0796 1864 CryptSvc - ok 22:08:43.0812 1864 dac2w2k - ok 22:08:43.0812 1864 dac960nt - ok 22:08:43.0890 1864 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 22:08:43.0890 1864 DcomLaunch - ok 22:08:43.0921 1864 [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 22:08:43.0921 1864 Dhcp - ok 22:08:43.0953 1864 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 22:08:43.0953 1864 Disk - ok 22:08:43.0968 1864 dmadmin - ok 22:08:44.0015 1864 [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 22:08:44.0015 1864 dmboot - ok 22:08:44.0031 1864 [ 53720AB12B48719D00E327DA470A619A ] dmio C:\WINDOWS\system32\drivers\dmio.sys 22:08:44.0031 1864 dmio - ok 22:08:44.0046 1864 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 22:08:44.0046 1864 dmload - ok 22:08:44.0093 1864 [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver C:\WINDOWS\System32\dmserver.dll 22:08:44.0093 1864 dmserver - ok 22:08:44.0109 1864 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 22:08:44.0109 1864 DMusic - ok 22:08:44.0156 1864 [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 22:08:44.0156 1864 Dnscache - ok 22:08:44.0203 1864 [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll 22:08:44.0203 1864 Dot3svc - ok 22:08:44.0218 1864 [ 40F3B93B4E5B0126F2F5C0A7A5E22660 ] dpti2o C:\WINDOWS\system32\DRIVERS\dpti2o.sys 22:08:44.0218 1864 dpti2o - ok 22:08:44.0265 1864 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 22:08:44.0265 1864 drmkaud - ok 22:08:44.0328 1864 [ A6DE5342417FEC3C0AA8EFEBB899C431 ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys 22:08:44.0328 1864 E100B - ok 22:08:44.0359 1864 [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost C:\WINDOWS\System32\eapsvc.dll 22:08:44.0359 1864 EapHost - ok 22:08:44.0406 1864 [ 877C18558D70587AA7823A1A308AC96B ] ERSvc C:\WINDOWS\System32\ersvc.dll 22:08:44.0406 1864 ERSvc - ok 22:08:44.0468 1864 [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog C:\WINDOWS\system32\services.exe 22:08:44.0468 1864 Eventlog - ok 22:08:44.0531 1864 [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem C:\WINDOWS\system32\es.dll 22:08:44.0531 1864 EventSystem - ok 22:08:44.0593 1864 Fabs - ok 22:08:44.0656 1864 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 22:08:44.0656 1864 Fastfat - ok 22:08:44.0734 1864 [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 22:08:44.0734 1864 FastUserSwitchingCompatibility - ok 22:08:44.0765 1864 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys 22:08:44.0765 1864 Fdc - ok 22:08:44.0781 1864 [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips C:\WINDOWS\system32\drivers\Fips.sys 22:08:44.0781 1864 Fips - ok 22:08:44.0890 1864 [ FFF1130F7C9FA01D093A1EDFC5CCE8FC ] FirebirdServerMAGIXInstance C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\fbserver.exe 22:08:44.0906 1864 FirebirdServerMAGIXInstance - ok 22:08:44.0953 1864 [ 227846995AFEEFA70D328BF5334A86A5 ] FLEXnet Licensing Service C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 22:08:44.0953 1864 FLEXnet Licensing Service - ok 22:08:44.0984 1864 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys 22:08:44.0984 1864 Flpydisk - ok 22:08:45.0015 1864 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys 22:08:45.0015 1864 FltMgr - ok 22:08:45.0093 1864 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 22:08:45.0093 1864 FontCache3.0.0.0 - ok 22:08:45.0125 1864 [ 037B3AB349BE884BB8CB9C5356E34717 ] FSLX C:\WINDOWS\system32\drivers\fslx.sys 22:08:45.0125 1864 FSLX - ok 22:08:45.0171 1864 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 22:08:45.0171 1864 Fs_Rec - ok 22:08:45.0187 1864 [ 8F1955CE42E1484714B542F341647778 ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 22:08:45.0187 1864 Ftdisk - ok 22:08:45.0234 1864 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 22:08:45.0250 1864 Gpc - ok 22:08:45.0296 1864 [ 00A1FDF812AE26730BC94F08047CA2A0 ] GrabsterSeries.X86 C:\WINDOWS\system32\DRIVERS\GrabsterSeries.X86.SYS 22:08:45.0296 1864 GrabsterSeries.X86 - ok 22:08:45.0437 1864 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Programme\Google\Update\GoogleUpdate.exe 22:08:45.0437 1864 gupdate - ok 22:08:45.0453 1864 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Programme\Google\Update\GoogleUpdate.exe 22:08:45.0453 1864 gupdatem - ok 22:08:45.0515 1864 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe 22:08:45.0515 1864 gusvc - ok 22:08:45.0578 1864 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 22:08:45.0578 1864 HDAudBus - ok 22:08:45.0687 1864 [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 22:08:45.0687 1864 helpsvc - ok 22:08:45.0703 1864 HidServ - ok 22:08:45.0750 1864 [ ED29F14101523A6E0E808107405D452C ] hkmsvc C:\WINDOWS\System32\kmsvc.dll 22:08:45.0750 1864 hkmsvc - ok 22:08:45.0859 1864 [ C5F00D15AA15CB7F55A027FF75E44BB7 ] HP Port Resolver C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE 22:08:45.0859 1864 HP Port Resolver - ok 22:08:45.0859 1864 [ C5A288E4CEEF5A26D105117BAA3763AB ] HP Status Server C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE 22:08:45.0859 1864 HP Status Server - ok 22:08:45.0875 1864 hpn - ok 22:08:45.0937 1864 [ 30CA91E657CEDE2F95359D6EF186F650 ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys 22:08:45.0937 1864 HPZid412 - ok 22:08:45.0937 1864 [ EFD31AFA752AA7C7BBB57BCBE2B01C78 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 22:08:45.0953 1864 HPZipr12 - ok 22:08:45.0953 1864 [ 7AC43C38CA8FD7ED0B0A4466F753E06E ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys 22:08:45.0953 1864 HPZius12 - ok 22:08:46.0015 1864 [ CBD09ED9CF6822177EE85AEA4D8816A2 ] HTCAND32 C:\WINDOWS\system32\Drivers\ANDROIDUSB.sys 22:08:46.0015 1864 HTCAND32 - ok 22:08:46.0078 1864 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 22:08:46.0078 1864 HTTP - ok 22:08:46.0140 1864 [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 22:08:46.0140 1864 HTTPFilter - ok 22:08:46.0140 1864 i2omgmt - ok 22:08:46.0156 1864 i2omp - ok 22:08:46.0203 1864 [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 22:08:46.0203 1864 i8042prt - ok 22:08:46.0250 1864 [ 06B7EF73BA5F302EECC294CDF7E19702 ] i81x C:\WINDOWS\system32\DRIVERS\i81xnt5.sys 22:08:46.0250 1864 i81x - ok 22:08:46.0281 1864 [ 7B5B44EFE5EB9DADFB8EE29700885D23 ] iAimFP0 C:\WINDOWS\system32\DRIVERS\wADV01nt.sys 22:08:46.0281 1864 iAimFP0 - ok 22:08:46.0296 1864 [ EB1F6BAB6C22EDE0BA551B527475F7E9 ] iAimFP1 C:\WINDOWS\system32\DRIVERS\wADV02NT.sys 22:08:46.0296 1864 iAimFP1 - ok 22:08:46.0296 1864 [ 03CE989D846C1AA81145CB22FCB86D06 ] iAimFP2 C:\WINDOWS\system32\DRIVERS\wADV05NT.sys 22:08:46.0296 1864 iAimFP2 - ok 22:08:46.0312 1864 [ 525849B4469DE021D5D61B4DB9BE3A9D ] iAimFP3 C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys 22:08:46.0312 1864 iAimFP3 - ok 22:08:46.0328 1864 [ 589C2BCDB5BD602BF7B63D210407EF8C ] iAimFP4 C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys 22:08:46.0328 1864 iAimFP4 - ok 22:08:46.0343 1864 [ 0308AEF61941E4AF478FA1A0F83812F5 ] iAimFP5 C:\WINDOWS\system32\DRIVERS\wADV07nt.sys 22:08:46.0343 1864 iAimFP5 - ok 22:08:46.0359 1864 [ 714038A8AA5DE08E12062202CD7EAEB5 ] iAimFP6 C:\WINDOWS\system32\DRIVERS\wADV08nt.sys 22:08:46.0359 1864 iAimFP6 - ok 22:08:46.0375 1864 [ 7BB3AA595E4507A788DE1CDC63F4C8C4 ] iAimFP7 C:\WINDOWS\system32\DRIVERS\wADV09nt.sys 22:08:46.0375 1864 iAimFP7 - ok 22:08:46.0375 1864 [ D83BDD5C059667A2F647A6BE5703A4D2 ] iAimTV0 C:\WINDOWS\system32\DRIVERS\wATV01nt.sys 22:08:46.0375 1864 iAimTV0 - ok 22:08:46.0390 1864 [ ED968D23354DAA0D7C621580C012A1F6 ] iAimTV1 C:\WINDOWS\system32\DRIVERS\wATV02NT.sys 22:08:46.0390 1864 iAimTV1 - ok 22:08:46.0406 1864 [ D738273F218A224C1DDAC04203F27A84 ] iAimTV3 C:\WINDOWS\system32\DRIVERS\wATV04nt.sys 22:08:46.0406 1864 iAimTV3 - ok 22:08:46.0421 1864 [ 0052D118995CBAB152DAABE6106D1442 ] iAimTV4 C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys 22:08:46.0437 1864 iAimTV4 - ok 22:08:46.0437 1864 [ 791CC45DE6E50445BE72E8AD6401FF45 ] iAimTV5 C:\WINDOWS\system32\DRIVERS\wATV10nt.sys 22:08:46.0437 1864 iAimTV5 - ok 22:08:46.0453 1864 [ 352FA0E98BC461CE1CE5D41F64DB558D ] iAimTV6 C:\WINDOWS\system32\DRIVERS\wATV06nt.sys 22:08:46.0453 1864 iAimTV6 - ok 22:08:46.0593 1864 [ C4018896856A1A1F1F3A0A6EE7206551 ] ialm C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 22:08:46.0609 1864 ialm - ok 22:08:46.0718 1864 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 22:08:46.0718 1864 idsvc - ok 22:08:46.0812 1864 [ AD5DF6F4FBBC798636EDC66BFEC7D0DE ] IJPLMSVC C:\Programme\Canon\IJPLM\IJPLMSVC.EXE 22:08:46.0812 1864 IJPLMSVC - ok 22:08:46.0843 1864 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys 22:08:46.0843 1864 Imapi - ok 22:08:46.0859 1864 [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService C:\WINDOWS\system32\imapi.exe 22:08:46.0859 1864 ImapiService - ok 22:08:46.0875 1864 ini910u - ok 22:08:47.0015 1864 [ E5C925B50154D102734AB446ADE781F4 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys 22:08:47.0031 1864 IntcAzAudAddService - ok 22:08:47.0109 1864 [ 69C4E3C9E67A1F103B94E14FDD5F3213 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys 22:08:47.0109 1864 IntelIde - ok 22:08:47.0203 1864 [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys 22:08:47.0203 1864 intelppm - ok 22:08:47.0234 1864 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys 22:08:47.0234 1864 Ip6Fw - ok 22:08:47.0265 1864 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 22:08:47.0265 1864 IpFilterDriver - ok 22:08:47.0281 1864 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 22:08:47.0281 1864 IpInIp - ok 22:08:47.0312 1864 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 22:08:47.0312 1864 IpNat - ok 22:08:47.0328 1864 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 22:08:47.0328 1864 IPSec - ok 22:08:47.0375 1864 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 22:08:47.0375 1864 IRENUM - ok 22:08:47.0421 1864 [ 6DFB88F64135C525433E87648BDA30DE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 22:08:47.0421 1864 isapnp - ok 22:08:47.0484 1864 [ 213822072085B5BBAD9AF30AB577D817 ] IviRegMgr C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe 22:08:47.0484 1864 IviRegMgr - ok 22:08:47.0593 1864 [ A0D14B7538FA3AE9CB771B9E99CECF43 ] JavaQuickStarterService C:\Programme\Java\jre6\bin\jqs.exe 22:08:47.0593 1864 JavaQuickStarterService - ok 22:08:47.0625 1864 [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 22:08:47.0625 1864 Kbdclass - ok 22:08:47.0640 1864 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 22:08:47.0640 1864 kmixer - ok 22:08:47.0703 1864 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 22:08:47.0703 1864 KSecDD - ok 22:08:47.0765 1864 [ 2BBDCB79900990F0716DFCB714E72DE7 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll 22:08:47.0765 1864 lanmanserver - ok 22:08:47.0828 1864 [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 22:08:47.0828 1864 lanmanworkstation - ok 22:08:47.0843 1864 lbrtfdc - ok 22:08:47.0906 1864 [ 636714B7D43C8D0C80449123FD266920 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 22:08:47.0906 1864 LmHosts - ok 22:08:47.0953 1864 [ 4A5FFDF0FE830C448830BD4B02B02B4B ] mbamchameleon C:\WINDOWS\system32\drivers\mbamchameleon.sys 22:08:47.0953 1864 mbamchameleon - ok 22:08:47.0968 1864 [ B7550A7107281D170CE85524B1488C98 ] Messenger C:\WINDOWS\System32\msgsvc.dll 22:08:47.0968 1864 Messenger - ok 22:08:48.0000 1864 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys 22:08:48.0000 1864 mnmdd - ok 22:08:48.0062 1864 [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe 22:08:48.0062 1864 mnmsrvc - ok 22:08:48.0093 1864 [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 22:08:48.0093 1864 Modem - ok 22:08:48.0140 1864 [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 22:08:48.0140 1864 Mouclass - ok 22:08:48.0156 1864 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 22:08:48.0156 1864 MountMgr - ok 22:08:48.0203 1864 [ C0F8E0C2C3C0437CF37C6781896DC3EC ] MPE C:\WINDOWS\system32\DRIVERS\MPE.sys 22:08:48.0203 1864 MPE - ok 22:08:48.0203 1864 mraid35x - ok 22:08:48.0218 1864 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 22:08:48.0218 1864 MRxDAV - ok 22:08:48.0265 1864 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 22:08:48.0265 1864 MRxSmb - ok 22:08:48.0328 1864 [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC C:\WINDOWS\system32\msdtc.exe 22:08:48.0328 1864 MSDTC - ok 22:08:48.0390 1864 [ 1477849772712BAC69C144DCF2C9CE81 ] MSDV C:\WINDOWS\system32\DRIVERS\msdv.sys 22:08:48.0390 1864 MSDV - ok 22:08:48.0390 1864 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 22:08:48.0390 1864 Msfs - ok 22:08:48.0406 1864 MSIServer - ok 22:08:48.0437 1864 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 22:08:48.0437 1864 MSKSSRV - ok 22:08:48.0437 1864 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 22:08:48.0437 1864 MSPCLOCK - ok 22:08:48.0468 1864 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 22:08:48.0468 1864 MSPQM - ok 22:08:48.0515 1864 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 22:08:48.0515 1864 mssmbios - ok 22:08:48.0562 1864 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys 22:08:48.0562 1864 MSTEE - ok 22:08:48.0609 1864 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 22:08:48.0609 1864 Mup - ok 22:08:48.0656 1864 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 22:08:48.0656 1864 NABTSFEC - ok 22:08:48.0687 1864 [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent C:\WINDOWS\System32\qagentrt.dll 22:08:48.0687 1864 napagent - ok 22:08:48.0750 1864 [ B5B1080D35974C0E718D64280761BCD5 ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 22:08:48.0750 1864 NDIS - ok 22:08:48.0781 1864 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys 22:08:48.0781 1864 NdisIP - ok 22:08:48.0828 1864 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 22:08:48.0828 1864 NdisTapi - ok 22:08:48.0875 1864 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 22:08:48.0875 1864 Ndisuio - ok 22:08:48.0937 1864 [ B053A8411045FD0664B389A090CB2BBC ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 22:08:48.0937 1864 NdisWan - ok 22:08:48.0968 1864 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 22:08:48.0968 1864 NDProxy - ok 22:08:49.0000 1864 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 22:08:49.0000 1864 NetBIOS - ok 22:08:49.0062 1864 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 22:08:49.0062 1864 NetBT - ok 22:08:49.0125 1864 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE C:\WINDOWS\system32\netdde.exe 22:08:49.0125 1864 NetDDE - ok 22:08:49.0140 1864 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 22:08:49.0140 1864 NetDDEdsdm - ok 22:08:49.0203 1864 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon C:\WINDOWS\system32\lsass.exe 22:08:49.0203 1864 Netlogon - ok 22:08:49.0218 1864 [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman C:\WINDOWS\System32\netman.dll 22:08:49.0218 1864 Netman - ok 22:08:49.0265 1864 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 22:08:49.0265 1864 NetTcpPortSharing - ok 22:08:49.0296 1864 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys 22:08:49.0312 1864 NIC1394 - ok 22:08:49.0343 1864 [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla C:\WINDOWS\System32\mswsock.dll 22:08:49.0343 1864 Nla - ok 22:08:49.0359 1864 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 22:08:49.0375 1864 Npfs - ok 22:08:49.0421 1864 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 22:08:49.0437 1864 Ntfs - ok 22:08:49.0484 1864 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp C:\WINDOWS\system32\lsass.exe 22:08:49.0484 1864 NtLmSsp - ok 22:08:49.0531 1864 [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 22:08:49.0531 1864 NtmsSvc - ok 22:08:49.0578 1864 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 22:08:49.0578 1864 Null - ok 22:08:49.0609 1864 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 22:08:49.0609 1864 NwlnkFlt - ok 22:08:49.0625 1864 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 22:08:49.0625 1864 NwlnkFwd - ok 22:08:49.0656 1864 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys 22:08:49.0656 1864 ohci1394 - ok 22:08:49.0765 1864 [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE 22:08:49.0765 1864 ose - ok 22:08:49.0796 1864 [ A7AF0C0860F1C43FC6581BA8A99EABEF ] P3 C:\WINDOWS\system32\DRIVERS\p3.sys 22:08:49.0796 1864 P3 - ok 22:08:49.0843 1864 [ F84785660305B9B903FB3BCA8BA29837 ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys 22:08:49.0843 1864 Parport - ok 22:08:49.0843 1864 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 22:08:49.0843 1864 PartMgr - ok 22:08:49.0906 1864 [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 22:08:49.0906 1864 ParVdm - ok 22:08:50.0000 1864 [ 2A42DDAEAAE7743C55A3FA68A7AD9538 ] PCA C:\WINDOWS\SMINST\PCAngel.exe 22:08:50.0000 1864 PCA - ok 22:08:50.0000 1864 [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 22:08:50.0000 1864 PCI - ok 22:08:50.0015 1864 PCIDump - ok 22:08:50.0031 1864 [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys 22:08:50.0031 1864 PCIIde - ok 22:08:50.0078 1864 [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys 22:08:50.0078 1864 Pcmcia - ok 22:08:50.0093 1864 PDCOMP - ok 22:08:50.0140 1864 pdfcDispatcher - ok 22:08:50.0156 1864 PDFRAME - ok 22:08:50.0171 1864 PDRELI - ok 22:08:50.0171 1864 PDRFRAME - ok 22:08:50.0187 1864 perc2 - ok 22:08:50.0203 1864 perc2hib - ok 22:08:50.0281 1864 [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay C:\WINDOWS\system32\services.exe 22:08:50.0281 1864 PlugPlay - ok 22:08:50.0328 1864 [ 2D091A99624FB9E7EEF0A86D872EC0C3 ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe 22:08:50.0328 1864 Pml Driver HPZ12 - ok 22:08:50.0343 1864 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 22:08:50.0343 1864 PolicyAgent - ok 22:08:50.0406 1864 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 22:08:50.0406 1864 PptpMiniport - ok 22:08:50.0421 1864 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 22:08:50.0421 1864 ProtectedStorage - ok 22:08:50.0437 1864 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 22:08:50.0437 1864 PSched - ok 22:08:50.0500 1864 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 22:08:50.0500 1864 Ptilink - ok 22:08:50.0500 1864 ql1080 - ok 22:08:50.0531 1864 Ql10wnt - ok 22:08:50.0562 1864 ql12160 - ok 22:08:50.0593 1864 ql1240 - ok 22:08:50.0609 1864 ql1280 - ok 22:08:50.0640 1864 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 22:08:50.0640 1864 RasAcd - ok 22:08:50.0703 1864 [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto C:\WINDOWS\System32\rasauto.dll 22:08:50.0703 1864 RasAuto - ok 22:08:50.0703 1864 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 22:08:50.0703 1864 Rasl2tp - ok 22:08:50.0781 1864 [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan C:\WINDOWS\System32\rasmans.dll 22:08:50.0781 1864 RasMan - ok 22:08:50.0781 1864 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 22:08:50.0781 1864 RasPppoe - ok 22:08:50.0843 1864 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 22:08:50.0843 1864 Raspti - ok 22:08:50.0875 1864 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 22:08:50.0875 1864 Rdbss - ok 22:08:50.0890 1864 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 22:08:50.0890 1864 RDPCDD - ok 22:08:50.0953 1864 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys 22:08:50.0953 1864 rdpdr - ok 22:08:51.0000 1864 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 22:08:51.0000 1864 RDPWD - ok 22:08:51.0031 1864 [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 22:08:51.0031 1864 RDSessMgr - ok 22:08:51.0062 1864 [ ED761D453856F795A7FE056E42C36365 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 22:08:51.0062 1864 redbook - ok 22:08:51.0125 1864 [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 22:08:51.0125 1864 RemoteAccess - ok 22:08:51.0187 1864 [ E4CD1F3D84E1C2CA0B8CF7501E201593 ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll 22:08:51.0187 1864 RemoteRegistry - ok 22:08:51.0234 1864 [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator C:\WINDOWS\system32\locator.exe 22:08:51.0234 1864 RpcLocator - ok 22:08:51.0281 1864 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs C:\WINDOWS\system32\rpcss.dll 22:08:51.0281 1864 RpcSs - ok 22:08:51.0343 1864 [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP C:\WINDOWS\system32\rsvp.exe 22:08:51.0343 1864 RSVP - ok 22:08:51.0406 1864 [ 89619EF503F949FAE09252A8B883EE11 ] RTLE8023xp C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys 22:08:51.0406 1864 RTLE8023xp - ok 22:08:51.0421 1864 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs C:\WINDOWS\system32\lsass.exe 22:08:51.0421 1864 SamSs - ok 22:08:51.0484 1864 [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 22:08:51.0484 1864 SCardSvr - ok 22:08:51.0546 1864 [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule C:\WINDOWS\system32\schedsvc.dll 22:08:51.0546 1864 Schedule - ok 22:08:51.0578 1864 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 22:08:51.0578 1864 Secdrv - ok 22:08:51.0625 1864 [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon C:\WINDOWS\System32\seclogon.dll 22:08:51.0625 1864 seclogon - ok 22:08:51.0640 1864 [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS C:\WINDOWS\system32\sens.dll 22:08:51.0640 1864 SENS - ok 22:08:51.0671 1864 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys 22:08:51.0671 1864 serenum - ok 22:08:51.0718 1864 [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys 22:08:51.0718 1864 Serial - ok 22:08:51.0750 1864 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\DRIVERS\sfloppy.sys 22:08:51.0765 1864 Sfloppy - ok 22:08:51.0828 1864 [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 22:08:51.0828 1864 SharedAccess - ok 22:08:51.0859 1864 [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 22:08:51.0859 1864 ShellHWDetection - ok 22:08:51.0875 1864 Simbad - ok 22:08:51.0921 1864 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys 22:08:51.0921 1864 SLIP - ok 22:08:51.0968 1864 [ 5CE1CF27620B144E212D407CDB14D339 ] snapman380 C:\WINDOWS\system32\DRIVERS\snman380.sys 22:08:51.0968 1864 snapman380 - ok 22:08:51.0984 1864 Sparrow - ok 22:08:52.0031 1864 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 22:08:52.0031 1864 splitter - ok 22:08:52.0093 1864 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe 22:08:52.0109 1864 Spooler - ok 22:08:52.0171 1864 [ D15DA1BA189770D93EEA2D7E18F95AF9 ] sptd C:\WINDOWS\System32\Drivers\sptd.sys 22:08:52.0171 1864 sptd - ok 22:08:52.0203 1864 [ 50FA898F8C032796D3B1B9951BB5A90F ] sr C:\WINDOWS\system32\DRIVERS\sr.sys 22:08:52.0203 1864 sr - ok 22:08:52.0250 1864 [ FE77A85495065F3AD59C5C65B6C54182 ] srservice C:\WINDOWS\system32\srsvc.dll 22:08:52.0250 1864 srservice - ok 22:08:52.0296 1864 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 22:08:52.0296 1864 Srv - ok 22:08:52.0328 1864 [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 22:08:52.0328 1864 SSDPSRV - ok 22:08:52.0375 1864 [ A2DBCC4C8860449DF1AB758EA28B4DE0 ] StillCam C:\WINDOWS\system32\DRIVERS\serscan.sys 22:08:52.0375 1864 StillCam - ok 22:08:52.0406 1864 [ BC2C5985611C5356B24AEB370953DED9 ] stisvc C:\WINDOWS\system32\wiaservc.dll 22:08:52.0421 1864 stisvc - ok 22:08:52.0437 1864 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys 22:08:52.0437 1864 streamip - ok 22:08:52.0468 1864 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 22:08:52.0468 1864 swenum - ok 22:08:52.0531 1864 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 22:08:52.0531 1864 swmidi - ok 22:08:52.0546 1864 SwPrv - ok 22:08:52.0593 1864 [ 1FF3217614018630D0A6758630FC698C ] symc810 C:\WINDOWS\system32\DRIVERS\symc810.sys 22:08:52.0593 1864 symc810 - ok 22:08:52.0609 1864 [ 070E001D95CF725186EF8B20335F933C ] symc8xx C:\WINDOWS\system32\DRIVERS\symc8xx.sys 22:08:52.0609 1864 symc8xx - ok 22:08:52.0625 1864 [ F2B7E8416F508368AC6730E2AE1C614F ] Symmpi C:\WINDOWS\system32\DRIVERS\symmpi.sys 22:08:52.0625 1864 Symmpi - ok 22:08:52.0640 1864 [ 80AC1C4ABBE2DF3B738BF15517A51F2C ] sym_hi C:\WINDOWS\system32\DRIVERS\sym_hi.sys 22:08:52.0640 1864 sym_hi - ok 22:08:52.0656 1864 [ BF4FAB949A382A8E105F46EBB4937058 ] sym_u3 C:\WINDOWS\system32\DRIVERS\sym_u3.sys 22:08:52.0656 1864 sym_u3 - ok 22:08:52.0703 1864 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 22:08:52.0703 1864 sysaudio - ok 22:08:52.0796 1864 [ B3D5BBE04293DEEC1812F2CB5D08C230 ] syshost32 C:\WINDOWS\Installer\{2A781366-67FF-1FE0-3C30-7D941BF2EEAB}\syshost.exe 22:08:52.0796 1864 syshost32 - ok 22:08:52.0843 1864 [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 22:08:52.0843 1864 SysmonLog - ok 22:08:52.0890 1864 [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 22:08:52.0890 1864 TapiSrv - ok 22:08:52.0953 1864 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 22:08:52.0953 1864 Tcpip - ok 22:08:53.0000 1864 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 22:08:53.0000 1864 TDPIPE - ok 22:08:53.0046 1864 [ 9855C40DE1DE32AAA4E290A361CDA0F3 ] tdrpman140 C:\WINDOWS\system32\DRIVERS\tdrpm140.sys 22:08:53.0062 1864 tdrpman140 - ok 22:08:53.0093 1864 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 22:08:53.0093 1864 TDTCP - ok 22:08:53.0125 1864 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 22:08:53.0125 1864 TermDD - ok 22:08:53.0187 1864 [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService C:\WINDOWS\System32\termsrv.dll 22:08:53.0187 1864 TermService - ok 22:08:53.0203 1864 [ 2DB7D303C36DDD055215052F118E8E75 ] Themes C:\WINDOWS\System32\shsvcs.dll 22:08:53.0203 1864 Themes - ok 22:08:53.0265 1864 [ 6DCB8DDB481CD3C40FA68593723B4D89 ] tifsfilter C:\WINDOWS\system32\DRIVERS\tifsfilt.sys 22:08:53.0265 1864 tifsfilter - ok 22:08:53.0281 1864 [ 394FC70B88B7958FA85798BBC76D140A ] timounter C:\WINDOWS\system32\DRIVERS\timntr.sys 22:08:53.0296 1864 timounter - ok 22:08:53.0343 1864 [ 03681A1CE77F51586903869A5AB1DEAB ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe 22:08:53.0343 1864 TlntSvr - ok 22:08:53.0359 1864 TosIde - ok 22:08:53.0453 1864 [ 626504572B175867F30F3215C04B3E2F ] TrkWks C:\WINDOWS\system32\trkwks.dll 22:08:53.0453 1864 TrkWks - ok 22:08:53.0484 1864 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 22:08:53.0484 1864 Udfs - ok 22:08:53.0500 1864 ultra - ok 22:08:53.0562 1864 [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost C:\WINDOWS\System32\upnphost.dll 22:08:53.0562 1864 upnphost - ok 22:08:53.0640 1864 [ 7CE0FE34FD8FB7F52D1E503B0C1E4FA9 ] UPnPService C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe 22:08:53.0656 1864 UPnPService - ok 22:08:53.0718 1864 [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS C:\WINDOWS\System32\ups.exe 22:08:53.0718 1864 UPS - ok 22:08:53.0765 1864 [ 8E9DCCB2BA19C959A8C3A344445BB954 ] USB28xxBGA C:\WINDOWS\system32\DRIVERS\emBDA.sys 22:08:53.0765 1864 USB28xxBGA - ok 22:08:53.0796 1864 [ DA617CA98704142F10938089DD0738A4 ] USB28xxOEM C:\WINDOWS\system32\DRIVERS\emOEM.sys 22:08:53.0796 1864 USB28xxOEM - ok 22:08:53.0843 1864 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys 22:08:53.0843 1864 usbaudio - ok 22:08:53.0890 1864 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 22:08:53.0890 1864 usbccgp - ok 22:08:53.0937 1864 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 22:08:53.0937 1864 usbehci - ok 22:08:54.0000 1864 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 22:08:54.0015 1864 usbhub - ok 22:08:54.0062 1864 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys 22:08:54.0062 1864 usbprint - ok 22:08:54.0140 1864 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 22:08:54.0140 1864 usbscan - ok 22:08:54.0156 1864 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 22:08:54.0156 1864 USBSTOR - ok 22:08:54.0156 1864 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys 22:08:54.0156 1864 usbuhci - ok 22:08:54.0203 1864 [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys 22:08:54.0203 1864 usb_rndisx - ok 22:08:54.0234 1864 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 22:08:54.0234 1864 VgaSave - ok 22:08:54.0265 1864 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys 22:08:54.0265 1864 ViaIde - ok 22:08:54.0312 1864 [ A5A712F4E880874A477AF790B5186E1D ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 22:08:54.0312 1864 VolSnap - ok 22:08:54.0390 1864 [ 68F106273BE29E7B7EF8266977268E78 ] VSS C:\WINDOWS\System32\vssvc.exe 22:08:54.0390 1864 VSS - ok 22:08:54.0421 1864 [ 7B353059E665F8B7AD2BBEAEF597CF45 ] W32Time C:\WINDOWS\system32\w32time.dll 22:08:54.0421 1864 W32Time - ok 22:08:54.0484 1864 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 22:08:54.0484 1864 Wanarp - ok 22:08:54.0531 1864 [ 4769596D7CC0F5FA447D2BABC239672A ] Wdf01000 C:\WINDOWS\system32\Drivers\wdf01000.sys 22:08:54.0531 1864 Wdf01000 - ok 22:08:54.0546 1864 WDICA - ok 22:08:54.0578 1864 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 22:08:54.0578 1864 wdmaud - ok 22:08:54.0609 1864 [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient C:\WINDOWS\System32\webclnt.dll 22:08:54.0609 1864 WebClient - ok 22:08:54.0718 1864 [ 6F3F3973D97714CC5F906A19FE883729 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 22:08:54.0718 1864 winmgmt - ok 22:08:54.0796 1864 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll 22:08:54.0796 1864 WmdmPmSN - ok 22:08:54.0875 1864 [ FFA4D901D46D07A5BAB2D8307FBB51A6 ] Wmi C:\WINDOWS\System32\advapi32.dll 22:08:54.0875 1864 Wmi - ok 22:08:54.0921 1864 [ 93908111BA57A6E60EC2FA2DE202105C ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe 22:08:54.0921 1864 WmiApSrv - ok 22:08:55.0031 1864 [ BF05650BB7DF5E9EBDD25974E22403BB ] WMPNetworkSvc C:\Programme\Windows Media Player\WMPNetwk.exe 22:08:55.0031 1864 WMPNetworkSvc - ok 22:08:55.0062 1864 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys 22:08:55.0062 1864 WS2IFSL - ok 22:08:55.0125 1864 [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc C:\WINDOWS\system32\wscsvc.dll 22:08:55.0125 1864 wscsvc - ok 22:08:55.0156 1864 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 22:08:55.0156 1864 WSTCODEC - ok 22:08:55.0203 1864 [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv C:\WINDOWS\system32\wuauserv.dll 22:08:55.0203 1864 wuauserv - ok 22:08:55.0234 1864 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 22:08:55.0234 1864 WudfPf - ok 22:08:55.0250 1864 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys 22:08:55.0265 1864 WudfRd - ok 22:08:55.0296 1864 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 22:08:55.0296 1864 WudfSvc - ok 22:08:55.0343 1864 [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 22:08:55.0343 1864 WZCSVC - ok 22:08:55.0390 1864 [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 22:08:55.0390 1864 xmlprov - ok 22:08:55.0406 1864 ================ Scan global =============================== 22:08:55.0515 1864 [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll 22:08:55.0578 1864 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll 22:08:55.0578 1864 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll 22:08:55.0593 1864 [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe 22:08:55.0593 1864 [Global] - ok 22:08:55.0593 1864 ================ Scan MBR ================================== 22:08:55.0609 1864 [ 4F02A8D4048A138C450ED7F867EB0144 ] \Device\Harddisk0\DR0 22:08:55.0734 1864 \Device\Harddisk0\DR0 - ok 22:08:55.0734 1864 ================ Scan VBR ================================== 22:08:55.0750 1864 [ 3EABA0639E6E91DE432B5CC697D6028E ] \Device\Harddisk0\DR0\Partition1 22:08:55.0750 1864 \Device\Harddisk0\DR0\Partition1 - ok 22:08:55.0750 1864 [ 28DC951D362DC489D47EC929C961683A ] \Device\Harddisk0\DR0\Partition2 22:08:55.0750 1864 \Device\Harddisk0\DR0\Partition2 - ok 22:08:55.0750 1864 ============================================================ 22:08:55.0750 1864 Scan finished 22:08:55.0750 1864 ============================================================ 22:08:55.0765 1476 Detected object count: 1 22:08:55.0765 1476 Actual detected object count: 1 22:12:14.0546 1476 C:\WINDOWS\System32\Drivers\cb010bd02561def3.sys - copied to quarantine 22:12:14.0593 1476 HKLM\SYSTEM\ControlSet001\services\cb010bd02561def3 - will be deleted on reboot 22:12:14.0609 1476 HKLM\SYSTEM\ControlSet002\services\cb010bd02561def3 - will be deleted on reboot 22:12:14.0656 1476 HKLM\SYSTEM\ControlSet003\services\cb010bd02561def3 - will be deleted on reboot 22:12:14.0703 1476 HKLM\SYSTEM\ControlSet004\services\cb010bd02561def3 - will be deleted on reboot 22:12:14.0812 1476 C:\WINDOWS\System32\Drivers\cb010bd02561def3.sys - will be deleted on reboot 22:12:14.0812 1476 cb010bd02561def3 ( Rootkit.Win32.Necurs.gen ) - User select action: Delete 22:12:33.0781 1920 Deinitialize success |
|
18.02.2013, 23:02
| #10 |
| | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion Hallo Leo, beim ersten scan 3 malware beim 2. alles ok Ist jetzt noch was zu tun, oder kann ich den PC normal verwenden. Hast du Vorschläge für gute Datensicherungs SW und Anti Viren SW Log files im Anhang LG Alfred |
|
18.02.2013, 23:09
| #11 | ||
| /// TB-Ausbilder | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion Hallo Alfred, Zitat:
Wieder im normalen Modus: Schritt 1 Warnung für Mitleser: Combofix sollte nur dann ausgeführt werden, wenn dies explizit von einem Teammitglied angewiesen wurde! Downloade dir bitte Combofix.
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
Schritt 2 Starte bitte die OTL.exe.
Bitte poste in deiner nächsten Antwort:
__________________ cheers, Leo |
|
19.02.2013, 20:30
| #12 |
| | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion Hallo Leo anbei die beiden logfiles von ComboFix und OTL hoffe es passt alles LG Alfred |
|
19.02.2013, 21:04
| #13 | |
| /// TB-Ausbilder | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion Hallo Alfred, Zitat:
 Wie läuft der Rechner jetzt? Bemerkst du noch Probleme? Kannst du auch mal versuchen, ob sich die vorhin blockierten Funktionen (wie Windows Firewall einschalten, Windows Updates einschalten) wieder alle aktivieren lassen. Wir kontrollieren nochmals und dann sollten wir noch die Sicherheitslücken schliessen, welchen diesen unschönen Malwarebesuch überhaupt erst möglich gemacht haben: Schritt 1
Code:
ATTFilter :commands
[emptytemp]
Schritt 2 Downloade dir bitte Malwarebytes Anti-Malware .
Schritt 3 Lade das Setup des ESET Online Scanners herunter und speichere es auf den Desktop.
Schritt 4 Downloade dir bitte SecurityCheck (Link 2).
Bitte poste in deiner nächsten Antwort:
__________________ cheers, Leo |
|
19.02.2013, 22:30
| #14 |
| | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion AVAST Antiviren SW lässt sich aktivieren, Windows Update und Firewall detto. OTL.exe inkl Neustart durchgeführt --> siehe log file Malewarebytes Anti Malware V1.7 lässt sich allerdings nicht herunterladen ( auf pony.de ) Schreibt zwar download wird vorbereitet - aber nach 10 Minuten ist immer noch nichts passiert ? LG Alfred |
|
19.02.2013, 22:39
| #15 |
| /// TB-Ausbilder | TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion
__________________ cheers, Leo |
|
| Themen zu TR.Necurs.A Drive-by Download. Virenscanner & Windows update & Firewall außer Funktion |
| adobe after effects, antivir, antivirus, avira, avira echtzeitscanner, bho, bonjour, canon, e-mail, error, februar 2013, firefox, flash player, fslx.sys, gmx.net, google, hijack, hijackthis, homepage, logfile, necurs, ntdll.dll, plug-in, problem, programm, realtek, refresh, scan, security, software, starten, system, third party, tr.necurs.a, trojan.necurs, updates, wichtige daten, win64, windows, windows internet, windows xp |
Textbox.
Linear-Darstellung
