Gesperrtes Windows und Zahlungsaufforderung

Bremser · 22.05.2012, 06:02

Hallo Community.

Vermutlich habe ich mir ebenfalls einen Trojaner eingefangen und würde euch sehr gerne um Hilfe bitten.

Ich nutze einen Asus eeePC mit Windows XP. Eingerichtet sind 5 Benutzerkonten. Während des Internet surferns mit einem Dumm-User Account erhielt ich plötzlich die Mitteilung Windows ist gesperrt und 100€ sind für eine Entsperrung zu zahlen. Taskmanager kann gestartet werden, wird aber durch Sperrungsmitteilung überlagert und ist nicht erreichbar.
Beim Herunterfahren ist kurzzeitig der Taskmanager sichtbar.
Ein weiterer Dumm-user und ein Admin Account funktionieren. Auch Festplattendaten scheinen nicht verändert zu sein.

Klar, irgendwas habe ich falsch gemacht. Dessen Dummheit ist mir aber nicht so offensichtlich, dass ich sagen kann: "Das wars".

Ich poste mal die Logdateien ich würde mich über Hilfe freuen.
Vielen Dank vorab an euch.

Grüße

cosinus · 22.05.2012, 14:07

Führ bitte auch ESET aus, danach sehen wir weiter:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bremser · 22.05.2012, 23:19

Hallo Cosinus

Danke für deine erste Info.

Eset habe ich durchlaufen lassen. Die Logdatei füge ich bei.

Viele Grüße

cosinus · 23.05.2012, 09:41

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Bremser · 24.05.2012, 20:11

Hallo Arne

Ich bin mir nicht sicher, ob ich das gleiche Verständnis habe wie du. Deswegen beschreibe ich (eventuell unnötig) etwas detaillierter.

1.Dumm-User Account:
- Kein Arbeiten mehr möglich.
- Startleiste nicht erreichbar

2.Dumm-User Account:
- Einige Programme gestartet (IE, Pdf, Avira, ppt)
- Startleiste geöffnet => keine leeren Verzeichnisse, keine Auffälligkeiten gefunden
- auf der Festplatte Dateiübersicht angeschaut und 2-3 Datei geöffnet => keine Auffälligkeiten
- Virenscanner aktualisiert Virenpattern wie gehabt
- Rechner ist weder unauffällig langsam noch bootet er länger
Fazit: Keinerlei Auffälligkeiten gegenüber dem Betrieb vor dem Befall.

Admin-Account:
- wie 2.Dumm-User Account => Keine Auffälligkeiten.

Ich hoffe das hilft dir weiter.

Grüße und vielen Dank !!

cosinus · 24.05.2012, 22:23

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Bremser · 28.05.2012, 19:51

Hallo Arne
Nach dem langen Wochenende komme ich nun dazu, die Scans durchzuführen

Der Inhalt von OTL.TXT
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 28.05.2012 20:14:27 - Run 1
OTL by OldTimer - Version 3.2.43.2     Folder = C:\Dokumente und Einstellungen\Admin\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 65,45% Memory free
3,33 Gb Paging File | 2,71 Gb Available in Paging File | 81,35% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 72,06 Gb Total Space | 26,99 Gb Free Space | 37,46% Space Free | Partition Type: NTFS
Drive D: | 72,06 Gb Total Space | 45,49 Gb Free Space | 63,13% Space Free | Partition Type: NTFS
Drive E: | 1,92 Gb Total Space | 1,92 Gb Free Space | 100,00% Space Free | Partition Type: FAT
 
Computer Name: UNSERERSTER | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.05.28 20:10:44 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Admin\Desktop\OTL.exe
PRC - [2012.05.08 21:27:58 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 21:27:57 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 21:27:57 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 21:27:57 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.02.18 16:37:16 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010.10.29 14:49:28 | 000,249,064 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2009.06.25 20:28:35 | 000,518,488 | ---- | M] (Lavasoft) -- C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2009.06.25 20:28:34 | 001,003,344 | ---- | M] (Lavasoft) -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2009.04.10 19:29:08 | 000,037,888 | ---- | M] () -- C:\Programme\Winamp\winampa.exe
PRC - [2009.01.23 09:49:53 | 000,416,768 | ---- | M] (ELANTECH Devices Corp.) -- C:\Programme\Elantech\ETDCtrl.exe
PRC - [2008.12.17 20:59:50 | 000,622,592 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\EeePC\ACPI\AsAcpiSvr.exe
PRC - [2008.12.04 14:38:06 | 000,114,688 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\EeePC\ACPI\AsTray.exe
PRC - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () -- C:\Eigene_Programme\Steuertipps\Steuer-Spar-Erklaerung 2012\AAVUpdateManager\aavus.exe
PRC - [2008.06.09 10:21:58 | 000,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
PRC - [2008.06.09 10:16:32 | 002,363,392 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe
PRC - [2008.05.21 02:56:24 | 000,094,208 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\EeePC\ACPI\AsEPCMon.exe
PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008.03.17 18:06:00 | 001,848,648 | ---- | M] (CANON INC.) -- C:\Programme\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2008.03.09 17:12:24 | 000,240,640 | ---- | M] () -- C:\Programme\AutoHotkey\AutoHotkey.exe
PRC - [2007.06.27 19:04:00 | 001,213,736 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007.06.27 19:04:00 | 000,279,848 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
PRC - [2007.06.27 19:03:40 | 000,152,872 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
PRC - [2007.06.25 08:47:24 | 001,629,480 | ---- | M] (Nero AG) -- C:\Eigene_Programme\Nero 7\InCD\NBHGui.exe
PRC - [2007.06.25 08:47:12 | 001,552,680 | ---- | M] (Nero AG) -- C:\Eigene_Programme\Nero 7\InCD\InCDsrv.exe
PRC - [2007.06.25 08:47:02 | 001,057,064 | ---- | M] (Nero AG) -- C:\Eigene_Programme\Nero 7\InCD\InCD.exe
PRC - [1999.06.27 21:38:02 | 000,794,112 | ---- | M] (Fred's Software) -- C:\Eigene_Programme\PrintKey2000\Printkey2000.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.05.11 19:57:21 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll
MOD - [2012.05.08 21:27:58 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2009.11.03 16:51:42 | 000,067,872 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll
MOD - [2009.06.25 20:28:51 | 001,630,048 | ---- | M] () -- C:\Programme\Lavasoft\Ad-Aware\Resources.dll
MOD - [2009.06.25 20:28:47 | 000,212,848 | ---- | M] () -- C:\Programme\Lavasoft\Ad-Aware\RPAPI.dll
MOD - [2009.04.10 19:29:08 | 000,037,888 | ---- | M] () -- C:\Programme\Winamp\winampa.exe
MOD - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () -- C:\Eigene_Programme\Steuertipps\Steuer-Spar-Erklaerung 2012\AAVUpdateManager\aavus.exe
MOD - [2008.09.11 00:00:06 | 000,168,960 | ---- | M] () -- C:\Programme\Lavasoft\Ad-Aware\unrar.dll
MOD - [2008.03.09 17:12:24 | 000,240,640 | ---- | M] () -- C:\Programme\AutoHotkey\AutoHotkey.exe
MOD - [2007.08.14 13:59:54 | 006,365,184 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LightScribe\QtGui4.dll
MOD - [2007.07.12 13:55:52 | 000,131,072 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2007.07.12 13:55:28 | 001,581,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LightScribe\QtCore4.dll
MOD - [2001.10.28 17:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012.05.08 21:27:58 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 21:27:57 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Programme\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2011.02.18 16:37:16 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009.06.25 20:28:34 | 001,003,344 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Eigene_Programme\Steuertipps\Steuer-Spar-Erklaerung 2012\AAVUpdateManager\aavus.exe -- (AAV UpdateService)
SRV - [2008.06.09 10:21:58 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2007.06.29 19:16:56 | 000,800,040 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Eigene_Programme\Nero 7\Nero BackItUp\NBService.exe -- (NBService)
SRV - [2007.06.27 19:04:00 | 000,279,848 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007.06.25 08:47:12 | 001,552,680 | ---- | M] (Nero AG) [Auto | Running] -- C:\Eigene_Programme\Nero 7\InCD\InCDsrv.exe -- (InCDsrv)
SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2012.05.08 21:27:58 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 21:27:58 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.06.25 20:28:46 | 000,064,160 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\Lbd.sys -- (Lbd)
DRV - [2009.02.13 10:49:30 | 005,029,376 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.12.08 18:01:56 | 000,055,136 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)
DRV - [2008.09.24 21:30:08 | 000,704,384 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rt2860.sys -- (RT80x86)
DRV - [2008.09.23 19:15:00 | 000,038,400 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\l1e51x86.sys -- (L1e)
DRV - [2008.09.18 20:44:38 | 001,326,528 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2008.08.19 16:16:36 | 000,991,656 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2008.08.19 16:16:28 | 000,047,272 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2008.08.11 10:14:12 | 001,752,704 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008.08.05 14:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2008.07.24 11:37:10 | 000,156,816 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2008.05.30 05:46:12 | 000,534,568 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2008.04.08 16:59:28 | 000,010,752 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASUSACPI.SYS -- (AsusACPI)
DRV - [2008.03.10 12:18:42 | 000,057,384 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwhid.sys -- (btwhid)
DRV - [2008.02.04 11:57:44 | 000,037,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2007.06.25 08:47:12 | 000,038,440 | ---- | M] (Nero AG) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\InCDRm.sys -- (incdrm)
DRV - [2007.06.25 08:47:12 | 000,036,776 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDPass.sys -- (InCDPass)
DRV - [2007.06.25 08:47:12 | 000,016,040 | ---- | M] (Nero AG) [Recognizer | System | Unknown] -- C:\WINDOWS\System32\drivers\InCDrec.sys -- (InCDrec)
DRV - [2007.06.25 08:47:02 | 000,119,080 | ---- | M] (Nero AG) [File_System | Disabled | Running] -- C:\WINDOWS\system32\drivers\InCDfs.sys -- (InCDfs)
DRV - [2006.01.04 09:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=109986&babsrc=HP_ss&mntrId=64d0a91b00000000000000248c9e04e8
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=109986&babsrc=SP_ss&mntrId=64d0a91b00000000000000248c9e04e8
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}: "URL" = hxxp://search.pdfcreator-toolbar.org/search?p=Q&ts=ne&w={searchTerms}&csrc=search-field
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1351351
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Eigene_Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
 
 
O1 HOSTS File: ([2008.04.14 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (PDFCreator Toolbar Helper) - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\Toolbar\WebBrowser: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Ad-Watch] C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AsusACPIServer] C:\Programme\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AsusEPCMonitor] C:\Programme\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AsusTray] C:\Programme\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [ETDWare] C:\Programme\Elantech\ETDCtrl.exe (ELANTECH Devices Corp.)
O4 - HKLM..\Run: [InCD] C:\Eigene_Programme\Nero 7\InCD\InCD.exe (Nero AG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [SecurDisc] C:\Eigene_Programme\Nero 7\InCD\NBHGui.exe (Nero AG)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe ()
O4 - HKU\S-1-5-21-970361835-3776818119-144542300-1009..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-21-970361835-3776818119-144542300-1009..\Run: [LightScribe Control Panel] C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
O4 - HKU\S-1-5-21-970361835-3776818119-144542300-1009..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil11e_ActiveX.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\Autostart\ac'tivAid.lnk = C:\Eigene_Programme\ActivAid\ac'tivAid.ahk ()
O4 - Startup: C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\Autostart\Printkey2000.lnk = C:\Eigene_Programme\PrintKey2000\Printkey2000.exe (Fred's Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{01F7AE68-DB54-41C4-AF7D-5316FB3EEF2B}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.03.02 10:12:14 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{80deda88-fb07-11de-bb63-002243e55ba0}\Shell\AutoRun\command - "" = E:\Get_Started_for_Win.exe
O33 - MountPoints2\{80deda89-fb07-11de-bb63-002243e55ba0}\Shell\AutoRun\command - "" = F:\Get_Started_for_Win.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= -  File not found
MsConfig - StartUpReg: MsnMsgr - hkey= - key= -  File not found
 
SafeBootMin: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: Lavasoft Ad-Aware Service - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: Lavasoft Ad-Aware Service - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe"
ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - 
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.05.28 20:10:43 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Admin\Desktop\OTL.exe
[2012.05.22 19:34:53 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.05.21 20:12:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Malwarebytes
[2012.05.21 20:12:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.05.21 20:12:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.05.21 20:12:21 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.05.21 20:12:21 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.05.21 07:18:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar
[2012.05.21 07:18:09 | 000,000,000 | ---D | C] -- C:\Programme\BabylonToolbar
[2012.05.21 07:17:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\Uncompressor
[2012.05.21 07:17:55 | 000,000,000 | ---D | C] -- C:\Programme\Uncompressor
[2012.05.21 07:17:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Babylon
[2012.05.21 07:17:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2012.05.21 07:17:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Babylon
[2012.05.20 19:03:39 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2012.05.20 19:02:33 | 000,607,260 | ---- | C] (Swearware) -- C:\Dokumente und Einstellungen\Admin\Desktop\dds.scr
[2012.05.20 19:01:54 | 000,607,260 | R--- | C] (Swearware) -- C:\Dokumente und Einstellungen\Admin\Desktop\dds.com
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.05.28 20:29:00 | 000,000,458 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2012.05.28 20:10:44 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Admin\Desktop\OTL.exe
[2012.05.28 19:37:12 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.05.28 19:37:09 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.05.24 20:49:54 | 000,003,136 | ---- | M] () -- C:\WINDOWS\WINCMD.INI
[2012.05.21 20:12:23 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.05.21 07:18:11 | 000,001,490 | ---- | M] () -- C:\user.js
[2012.05.21 07:17:56 | 000,000,704 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Uncompressor.lnk
[2012.05.20 19:17:24 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\i73phgsk.exe
[2012.05.20 19:02:37 | 000,607,260 | ---- | M] (Swearware) -- C:\Dokumente und Einstellungen\Admin\Desktop\dds.scr
[2012.05.20 19:01:59 | 000,607,260 | R--- | M] (Swearware) -- C:\Dokumente und Einstellungen\Admin\Desktop\dds.com
[2012.05.20 18:57:22 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\defogger_reenable
[2012.05.20 18:54:59 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Defogger.exe
[2012.05.11 20:08:56 | 000,185,016 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.05.11 19:56:16 | 000,527,552 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.05.11 19:56:16 | 000,502,762 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.05.11 19:56:16 | 000,105,646 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.05.11 19:56:16 | 000,088,286 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.05.11 19:45:13 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.05.08 21:27:58 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.05.08 21:27:58 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012.04.30 11:57:16 | 000,019,178 | ---- | M] () -- C:\WINDOWS\System32\AAWService_2012_04_30_11_57_16.dmp
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.05.21 20:12:23 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.05.21 07:18:08 | 000,001,490 | ---- | C] () -- C:\user.js
[2012.05.21 07:17:56 | 000,000,704 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Uncompressor.lnk
[2012.05.20 19:17:24 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\i73phgsk.exe
[2012.05.20 18:57:22 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\defogger_reenable
[2012.05.20 18:54:58 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Defogger.exe
[2012.04.30 11:57:16 | 000,019,178 | ---- | C] () -- C:\WINDOWS\System32\AAWService_2012_04_30_11_57_16.dmp
[2012.02.18 11:53:34 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.06.06 23:34:55 | 000,514,960 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-970361835-3776818119-144542300-1009-0.dat
[2011.06.06 21:06:03 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.06.06 16:50:03 | 000,516,759 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-970361835-3776818119-144542300-1006-0.dat
[2011.06.06 16:50:03 | 000,184,242 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2010.09.04 14:39:43 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
 
========== LOP Check ==========
 
[2012.05.21 07:17:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Babylon
[2012.05.21 07:18:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar
[2009.12.22 18:00:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\CD-LabelPrint
[2011.06.06 14:23:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\PriceGong
[2009.05.23 21:36:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Template
[2011.06.25 22:47:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Youtube Downloader HD
[2012.03.05 10:56:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AAV
[2012.05.21 07:17:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2009.12.18 19:08:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2009.12.18 20:17:37 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEGV
[2009.12.18 20:13:04 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan
[2009.05.23 23:32:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LightScribe
[2011.10.23 21:07:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
[2012.01.21 19:11:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\VS
[2010.05.02 18:15:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009.11.25 23:28:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009.06.25 20:24:56 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
[2009.12.18 20:13:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Canon
[2011.05.08 21:23:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\PriceGong
[2009.10.11 12:37:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Template
[2011.08.31 20:53:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Youtube Downloader HD
[2012.05.28 20:29:00 | 000,000,458 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2009.05.23 22:38:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Adobe
[2009.05.23 20:06:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Ahead
[2010.02.23 22:21:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Apple Computer
[2011.10.23 21:28:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Avira
[2012.05.21 07:17:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Babylon
[2012.05.21 07:18:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar
[2009.12.22 18:00:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\CD-LabelPrint
[2010.05.15 21:43:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\dvdcss
[2010.03.02 10:15:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Identities
[2009.03.02 10:43:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\InstallShield
[2009.05.22 21:16:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Macromedia
[2012.05.21 20:12:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Malwarebytes
[2009.07.05 13:48:11 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Microsoft
[2011.06.06 20:51:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Microsoft Corporation
[2011.06.06 14:23:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\PriceGong
[2009.05.22 23:14:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Sun
[2009.05.23 21:36:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Template
[2011.06.25 22:57:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\vlc
[2010.01.10 16:31:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Winamp
[2011.06.25 22:47:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Youtube Downloader HD
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
[2001.05.24 12:59:30 | 000,162,304 | ---- | M] () -- C:\UNWISE.EXE
 
< MD5 for: AGP440.SYS  >
[2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:atapi.sys
[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008.04.14 14:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: IASTOR.SYS  >
[2008.09.12 07:32:56 | 000,327,192 | ---- | M] (Intel Corporation) MD5=8EF427C54497C5F8A7A645990E4278C7 -- C:\WINDOWS\I386\$OEM$\TEXTMODE\IASTOR.SYS
[2008.09.12 07:32:56 | 000,327,192 | ---- | M] (Intel Corporation) MD5=8EF427C54497C5F8A7A645990E4278C7 -- C:\WINDOWS\OemDir\iaStor.sys
[2008.09.12 07:32:56 | 000,327,192 | ---- | M] (Intel Corporation) MD5=8EF427C54497C5F8A7A645990E4278C7 -- C:\WINDOWS\system32\drivers\iaStor.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 14:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 14:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 14:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 14:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008.04.14 14:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 14:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.04.14 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2008.04.14 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2010.03.02 11:05:06 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2010.03.02 11:05:06 | 001,069,056 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2010.03.02 11:05:06 | 000,450,560 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >

--- --- ---

[/code]

Der Inhalt von EXTRAS.TXT
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 28.05.2012 20:14:27 - Run 1
OTL by OldTimer - Version 3.2.43.2     Folder = C:\Dokumente und Einstellungen\Admin\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy	
 
1,99 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 65,45% Memory free
3,33 Gb Paging File | 2,71 Gb Available in Paging File | 81,35% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 72,06 Gb Total Space | 26,99 Gb Free Space | 37,46% Space Free | Partition Type: NTFS
Drive D: | 72,06 Gb Total Space | 45,49 Gb Free Space | 63,13% Space Free | Partition Type: NTFS
Drive E: | 1,92 Gb Total Space | 1,92 Gb Free Space | 100,00% Space Free | Partition Type: FAT
 
Computer Name: UNSERERSTER | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Eigene_Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Eigene_Programme\fotoservice\OnlineFotoservice\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OnlineFotoservice] -- "C:\Eigene_Programme\fotoservice\OnlineFotoservice\OnlineFotoservice.exe" "%1" ()
Directory [PlayWithVLC] -- "C:\Eigene_Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1"
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1"
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1"
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Disabled:Microsoft Management Console -- (Microsoft Corporation)
"C:\Programme\Avira\AntiVir Desktop\avcenter.exe" = C:\Programme\Avira\AntiVir Desktop\avcenter.exe:*:Enabled:AntiVir starten -- (Avira Operations GmbH & Co. KG)
"C:\Eigene_Programme\Rsync\rsync.exe" = C:\Eigene_Programme\Rsync\rsync.exe:*:Enabled:rsync -- ()
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software  1.14.17.1
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP630_series" = Canon MP630 series MP Drivers
"{19F5658D-92E8-4A08-8657-D38ABB1574B2}" = Asus ACPI Driver
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 24
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
"{3134052E-B1F0-465C-B320-5042095B1031}" = Nero 7 Essentials
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{353FE16B-30FE-469A-BF55-B978F4218003}" = iTunes
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3A608351-5980-4A47-AE08-3742C55B4016}" = Windows Live Family Safety
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{57BB52B7-6B7B-31F3-89F4-4EE8FE5CEF6D}" = Microsoft Help Viewer 1.1
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate for Eee PC
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5AB7D739-1735-3A9E-BE73-C43507CB4E6F}" = Microsoft Visual Studio 2010 Service Pack 1
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.6
"{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}" = Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}" = Windows Live Fotogalerie
"{6C1E7AA1-44E9-446D-AAB2-0DE6D9EFEAB1}" = Safari
"{6E4DAE31-7CF3-441A-B6E5-B014D63C80CD}" = Eee Instant Key
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B9955EE-6FC5-4983-A994-F710924BD8F1}" = ACSI Camp Site Guide Europe 2010
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{835686C5-8650-49EB-8CA0-4528B4035495}" = Windows Live Call
"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger
"{83AA2913-C123-4146-85BD-AD8F93971D39}" = BabylonObjectInstaller
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{88F08F98-12BC-4613-81A2-8F9B88CFC73E}" = Super Hybrid Engine
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync
"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}" = Azurewave Wireless LAN
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9180D83D-99D5-4E38-A221-B512E076ED0F}" = Projekte erfolgreich managen
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.0 - Deutsch
"{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}" = AAVUpdateManager
"{B3D1CFF9-C5DA-3590-894B-40821DDB67C5}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{B915FA4E-B670-43E9-8EA0-9F16BFFD8AE8}" = DirComp
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C05BC4CD-C001-37E7-939C-3392604DFBEF}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C668416A-9213-4058-B7F2-01A42D85559D}" = Microsoft SQL Server System CLR Types
"{C83CD843-260E-3BD0-86BC-4E613BFDDE0A}" = Microsoft Help Viewer 1.1 Language Pack - DEU
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCAC7E52-ECCE-3C4D-B1BE-BC2ACF1C1C0E}" = Microsoft Visual Basic 2010 Express - DEU
"{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}" = Steuer-Spar-Erklärung 2012
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{DF5F687F-8018-4542-9F98-7084E9022917}" = Windows Live Essentials
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E9089B6A-1FDE-47F3-8D29-175F5B7A0722}" = Microsoft SQL Server 2008 R2 Management Objects
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"ac'tivAid" = ac'tivAid v1.3.1
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Audiograbber" = Audiograbber 1.83 SE 
"Audiograbber-Lame" = Audiograbber Lame-MP3-Plugin
"AutoHotkey" = AutoHotkey 1.0.47.06
"Avira AntiVir Desktop" = Avira Free Antivirus
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"BabylonToolbar" = Babylon toolbar on IE
"Canon MP630 series Benutzerregistrierung" = Canon MP630 series Benutzerregistrierung
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Eee Storage" = Eee Storage
"Elantech" = ETDWare PS/2-x86 7.0.4.3 WHQL
"ESET Online Scanner" = ESET Online Scanner v3
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{7B9955EE-6FC5-4983-A994-F710924BD8F1}" = ACSI Camp Site Guide Europe 2010
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.1" = Microsoft Help Viewer 1.1
"Microsoft Help Viewer 1.1 Language Pack - DEU" = Microsoft Help Viewer 1.1 Language Pack - DEU
"Microsoft Visual Basic 2010 Express - DEU" = Microsoft Visual Basic 2010 Express - DEU
"Microsoft Visual Studio 2010 Service Pack 1" = Microsoft Visual Studio 2010 Service Pack 1
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU" = Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU
"MP Navigator EX 2.0" = Canon MP Navigator EX 2.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OnlineFotoservice" = OnlineFotoservice
"PDFCreator Toolbar" = PDFCreator Toolbar
"Softonic_Deutsch Toolbar" = Softonic_Deutsch Toolbar
"USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam
"VLC media player" = VLC media player 1.1.11
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Youtube Downloader HD_is1" = Youtube Downloader HD v. 2.5
"YTdetect" = Yahoo! Detect
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 09.04.2012 13:37:58 | Computer Name = UNSERERSTER | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
 
Error - 20.04.2012 13:16:54 | Computer Name = UNSERERSTER | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 02.05.2012 15:06:43 | Computer Name = UNSERERSTER | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
 
Error - 07.05.2012 15:22:32 | Computer Name = UNSERERSTER | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
 - Tried to start a service that wasn't the latest version of CLR Optimization service.
 Will shutdown 
 
Error - 08.05.2012 15:29:25 | Computer Name = UNSERERSTER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich 
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 08.05.2012 15:29:25 | Computer Name = UNSERERSTER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich 
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 11.05.2012 14:11:22 | Computer Name = UNSERERSTER | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
 - Tried to start a service that wasn't the latest version of CLR Optimization service.
 Will shutdown 
 
Error - 12.05.2012 15:26:57 | Computer Name = UNSERERSTER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich 
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 12.05.2012 15:26:58 | Computer Name = UNSERERSTER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich 
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 22.05.2012 13:34:01 | Computer Name = UNSERERSTER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Die Daten sind unzulässig.  .
 
[ OSession Events ]
Error - 09.08.2010 15:51:35 | Computer Name = UNSERERSTER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session 
lasted 7503 seconds with 4980 seconds of active time.  This session ended with a
 crash.
 
Error - 10.08.2010 14:49:45 | Computer Name = UNSERERSTER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session 
lasted 6670 seconds with 3240 seconds of active time.  This session ended with a
 crash.
 
Error - 09.10.2010 06:57:33 | Computer Name = UNSERERSTER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session 
lasted 4382 seconds with 3720 seconds of active time.  This session ended with a
 crash.
 
Error - 03.03.2011 17:17:03 | Computer Name = UNSERERSTER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session 
lasted 416 seconds with 300 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 21.05.2012 15:48:22 | Computer Name = UNSERERSTER | Source = PlugPlayManager | ID = 12
Description = Das Gerät "802.11n Wireless LAN Card" (PCI\VEN_1814&DEV_0781&SUBSYS_27901814&REV_00\4&37028e5f&0&00E3)
 wurde ohne vorbereitende Maßnahmen vom System entfernt.
 
Error - 21.05.2012 23:42:15 | Computer Name = UNSERERSTER | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
 Bibliothek Single Flash Reader USB Device nicht laden.
 
Error - 21.05.2012 23:42:16 | Computer Name = UNSERERSTER | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
 Bibliothek Single Flash Reader USB Device nicht laden.
 
Error - 21.05.2012 23:44:34 | Computer Name = UNSERERSTER | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
 Bibliothek Single Flash Reader USB Device nicht laden.
 
Error - 21.05.2012 23:44:34 | Computer Name = UNSERERSTER | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
 Bibliothek Single Flash Reader USB Device nicht laden.
 
Error - 21.05.2012 23:48:12 | Computer Name = UNSERERSTER | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
 Bibliothek Single Flash Reader USB Device nicht laden.
 
Error - 21.05.2012 23:48:12 | Computer Name = UNSERERSTER | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
 Bibliothek Single Flash Reader USB Device nicht laden.
 
Error - 22.05.2012 18:07:19 | Computer Name = UNSERERSTER | Source = PlugPlayManager | ID = 12
Description = Das Gerät "802.11n Wireless LAN Card" (PCI\VEN_1814&DEV_0781&SUBSYS_27901814&REV_00\4&37028e5f&0&00E3)
 wurde ohne vorbereitende Maßnahmen vom System entfernt.
 
Error - 24.05.2012 14:41:41 | Computer Name = UNSERERSTER | Source = PlugPlayManager | ID = 12
Description = Das Gerät "802.11n Wireless LAN Card" (PCI\VEN_1814&DEV_0781&SUBSYS_27901814&REV_00\4&37028e5f&0&00E3)
 wurde ohne vorbereitende Maßnahmen vom System entfernt.
 
Error - 28.05.2012 13:37:26 | Computer Name = UNSERERSTER | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.2.100 für die Netzwerkkarte mit der Netzwerkadresse
 002243962B11 wurde durch  den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server 
hat eine DHCPNACK-Meldung gesendet).
 
 
< End of report >

--- --- ---

Ich hoffe es hilft weiter. Vielen Dank bis hierhin.

Grüße

cosinus · 29.05.2012, 08:28

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=109986&babsrc=HP_ss&mntrId=64d0a91b00000000000000248c9e04e8
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=109986&babsrc=SP_ss&mntrId=64d0a91b00000000000000248c9e04e8
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}: "URL" = http://search.pdfcreator-toolbar.org/search?p=Q&ts=ne&w={searchTerms}&csrc=search-field
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1351351
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O2 - BHO: (PDFCreator Toolbar Helper) - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\Toolbar\WebBrowser: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O4 - HKLM..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.03.02 10:12:14 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{80deda88-fb07-11de-bb63-002243e55ba0}\Shell\AutoRun\command - "" = E:\Get_Started_for_Win.exe
O33 - MountPoints2\{80deda89-fb07-11de-bb63-002243e55ba0}\Shell\AutoRun\command - "" = F:\Get_Started_for_Win.exe
:Files
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar
C:\Programme\BabylonToolbar
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Babylon
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Babylon
C:\user.js
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\PriceGong
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Bremser · 29.05.2012, 20:01

Hallo Arne

Erstmal vielen Dank für die Hilfe.
Es kommt aber wie es kommen musste. Aber der Reihe nach.

-OTL mit Script gefüttert
-Avira gestartet um es abzuschalten. Dabei die Fehlermeldung.
"GDI+ Window: avcenter.exe - Abbild fehlerhaft
Die Anwendung oder DLL c:\Window\system32\MSchG.DLL ist keine gültige
Windows-Datei. Überprüfen Sie dies mit der Installationsdiskette"
<OK> gedrückt. Gleiche Fehlermeldung erneut. Wieder <OK> gedrückt.
Avira Oberfläche erschien und Virenscanner ließ sich ausschalten.
-WLAN abgeschaltet und OTL gestartet. Sofort <Kling> gehört.
-"eingeschüchtert" durch "Killing Process: DO NOT INTERRUPT" erstmal nichts getan
-nachdem sich längere Zeit nichts auf der Festplatte hat, mal mittels Taskswitch geschaut wer das <kling> verursachte
- Malwarebytes komplett vergessen. Fehlermeldung "Malwarebytes Anti-MalwareFehlermelung: MBAMService terminated unexpectectly"

Resultat: nichts geht mehr und ich traue mich nicht den Rechner auszuschalten.

Ergänzung:
- nachdem der Rechner über Nacht lief, habe ich ihn heute morgen ausgeschaltet.

- hochgefahren, OTL erneut mit dem Script gefüttert, (hoffentlich) alle Programme beendet.
- OTL gestartet, Killing Process noch im Gange

Grüße

cosinus · 30.05.2012, 10:12

Wiederhol den Fix im abgesicherten Modus bitte

Bremser · 30.05.2012, 19:18

Hallo Arne

- OTL im abgesicherten Modus gestartet und diesmal passiert auch erkennbar etwas.
- Folgendes OTL Log ist dabei (nach Neustart) entstanden.

Code:

ATTFilter

All processes killed
========== OTL ==========
HKU\S-1-5-21-970361835-3776818119-144542300-1009\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\URLSearchHooks\\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}\ deleted successfully.
C:\Programme\Softonic_Deutsch\prxtbSof2.dll moved successfully.
HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\SearchScopes\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}\ not found.
File C:\Programme\Softonic_Deutsch\prxtbSof2.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}\ deleted successfully.
C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}\ not found.
File C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}\ not found.
File C:\Programme\Softonic_Deutsch\prxtbSof2.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ deleted successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll moved successfully.
Registry value HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}\ not found.
File C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8DBB6D8E-E4A6-4E3B-9753-AF78B226441C}\ not found.
File C:\Programme\Softonic_Deutsch\prxtbSof2.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WinampAgent deleted successfully.
C:\Programme\Winamp\winampa.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry key HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer not found.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{80deda88-fb07-11de-bb63-002243e55ba0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80deda88-fb07-11de-bb63-002243e55ba0}\ not found.
File E:\Get_Started_for_Win.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{80deda89-fb07-11de-bb63-002243e55ba0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80deda89-fb07-11de-bb63-002243e55ba0}\ not found.
File F:\Get_Started_for_Win.exe not found.
========== FILES ==========
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar\Shared folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar\IE folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar\FF folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar\CR folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar\BabylonToolbar folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17 folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar folder moved successfully.
C:\Programme\BabylonToolbar folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\HtmlScreens folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Babylon folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Babylon folder moved successfully.
C:\user.js moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\PriceGong\Data folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\PriceGong folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Admin
->Temp folder emptied: 208487544 bytes
->Temporary Internet Files folder emptied: 15226586 bytes
->Java cache emptied: 74612347 bytes
->Apple Safari cache emptied: 928768 bytes
->Flash cache emptied: 3579 bytes
 
User: Admin_Backup
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: Leonard
->Temp folder emptied: 707898 bytes
->Temporary Internet Files folder emptied: 1483828 bytes
->Java cache emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32969 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Stefanie
->Temp folder emptied: 68712439 bytes
->Temporary Internet Files folder emptied: 188761851 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 1895 bytes
 
User: Wolfgang
->Temp folder emptied: 126370902 bytes
->Temporary Internet Files folder emptied: 89213097 bytes
->Java cache emptied: 9472974 bytes
->Apple Safari cache emptied: 30367744 bytes
->Flash cache emptied: 493 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 322567062 bytes
RecycleBin emptied: 44577367 bytes
 
Total Files Cleaned = 1.127,00 mb
 
 
[EMPTYFLASH]
 
User: Admin
->Flash cache emptied: 0 bytes
 
User: Admin_Backup
 
User: All Users
 
User: Default User
 
User: Leonard
 
User: LocalService
 
User: NetworkService
 
User: Stefanie
->Flash cache emptied: 0 bytes
 
User: Wolfgang
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.43.2 log created on 05302012_195453

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Vielen Dank bis hierhin !!!
Grüße

cosinus · 30.05.2012, 20:58

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C

nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

Bremser · 31.05.2012, 19:20

Hallo Arne

Danke für deine Mühen !!

Ich habe TdssKiller wie beschrieben gestartet und poste dir das Log.

Code:

ATTFilter

20:11:33.0984 3112	TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16
20:11:34.0031 3112	============================================================
20:11:34.0031 3112	Current date / time: 2012/05/31 20:11:34.0031
20:11:34.0031 3112	SystemInfo:
20:11:34.0031 3112	
20:11:34.0031 3112	OS Version: 5.1.2600 ServicePack: 3.0
20:11:34.0031 3112	Product type: Workstation
20:11:34.0031 3112	ComputerName: UNSERERSTER
20:11:34.0031 3112	UserName: Admin
20:11:34.0031 3112	Windows directory: C:\WINDOWS
20:11:34.0031 3112	System windows directory: C:\WINDOWS
20:11:34.0031 3112	Processor architecture: Intel x86
20:11:34.0031 3112	Number of processors: 2
20:11:34.0031 3112	Page size: 0x1000
20:11:34.0031 3112	Boot type: Normal boot
20:11:34.0031 3112	============================================================
20:11:35.0078 3112	Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x69A9, SectorsPerTrack: 0x36, TracksPerCylinder: 0xD6, Type 'K0', Flags 0x00000050
20:11:35.0078 3112	Drive \Device\Harddisk1\DR5 - Size: 0x7AA80000 (1.92 Gb), SectorSize: 0x200, Cylinders: 0xFA, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
20:11:35.0078 3112	============================================================
20:11:35.0078 3112	\Device\Harddisk0\DR0:
20:11:35.0078 3112	MBR partitions:
20:11:35.0078 3112	\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x36, BlocksNum 0x9020CE2
20:11:35.0078 3112	\Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x9020D18, BlocksNum 0x901DFF4
20:11:35.0078 3112	\Device\Harddisk1\DR5:
20:11:35.0093 3112	MBR partitions:
20:11:35.0093 3112	\Device\Harddisk1\DR5\Partition0: MBR, Type 0x6, StartLBA 0xF3, BlocksNum 0x3D530D
20:11:35.0093 3112	============================================================
20:11:35.0125 3112	C: <-> \Device\Harddisk0\DR0\Partition0
20:11:35.0187 3112	D: <-> \Device\Harddisk0\DR0\Partition1
20:11:35.0187 3112	============================================================
20:11:35.0187 3112	Initialize success
20:11:35.0187 3112	============================================================
20:13:15.0156 1428	============================================================
20:13:15.0156 1428	Scan started
20:13:15.0156 1428	Mode: Manual; SigCheck; TDLFS; 
20:13:15.0156 1428	============================================================
20:13:15.0937 1428	AAV UpdateService (7eeb488346fbfa3731276c3ee8a8fd9e) C:\Eigene_Programme\Steuertipps\Steuer-Spar-Erklaerung 2012\AAVUpdateManager\aavus.exe
20:13:16.0234 1428	AAV UpdateService - ok
20:13:16.0328 1428	Abiosdsk - ok
20:13:16.0343 1428	abp480n5 - ok
20:13:16.0390 1428	ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:13:17.0890 1428	ACPI - ok
20:13:17.0921 1428	ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
20:13:18.0140 1428	ACPIEC - ok
20:13:18.0140 1428	adpu160m - ok
20:13:18.0187 1428	aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
20:13:18.0406 1428	aec - ok
20:13:18.0453 1428	AFD             (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
20:13:18.0531 1428	AFD - ok
20:13:18.0531 1428	Aha154x - ok
20:13:18.0546 1428	aic78u2 - ok
20:13:18.0546 1428	aic78xx - ok
20:13:18.0578 1428	Alerter         (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
20:13:18.0781 1428	Alerter - ok
20:13:18.0812 1428	ALG             (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
20:13:18.0921 1428	ALG - ok
20:13:18.0921 1428	AliIde - ok
20:13:19.0109 1428	Ambfilt         (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys
20:13:19.0328 1428	Ambfilt - ok
20:13:19.0453 1428	amsint - ok
20:13:19.0593 1428	AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Programme\Avira\AntiVir Desktop\sched.exe
20:13:19.0625 1428	AntiVirSchedulerService - ok
20:13:19.0671 1428	AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Programme\Avira\AntiVir Desktop\avguard.exe
20:13:19.0703 1428	AntiVirService - ok
20:13:19.0796 1428	Apple Mobile Device (20f6f19fe9e753f2780dc2fa083ad597) C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
20:13:19.0828 1428	Apple Mobile Device - ok
20:13:19.0828 1428	AppMgmt - ok
20:13:19.0953 1428	AR5416          (7d53e5646ba23fd51296f7ef8979a000) C:\WINDOWS\system32\DRIVERS\athw.sys
20:13:20.0140 1428	AR5416 - ok
20:13:20.0156 1428	asc - ok
20:13:20.0171 1428	asc3350p - ok
20:13:20.0187 1428	asc3550 - ok
20:13:20.0343 1428	aspnet_state    (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
20:13:20.0453 1428	aspnet_state - ok
20:13:20.0500 1428	AsusACPI        (12415a4b61ded200fe9932b47a35fa42) C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys
20:13:20.0593 1428	AsusACPI - ok
20:13:20.0640 1428	AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:13:20.0890 1428	AsyncMac - ok
20:13:20.0937 1428	atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
20:13:21.0140 1428	atapi - ok
20:13:21.0140 1428	Atdisk - ok
20:13:21.0171 1428	Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:13:21.0359 1428	Atmarpc - ok
20:13:21.0406 1428	AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
20:13:21.0609 1428	AudioSrv - ok
20:13:21.0640 1428	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:13:21.0828 1428	audstub - ok
20:13:21.0859 1428	avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
20:13:21.0906 1428	avgntflt - ok
20:13:21.0953 1428	avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\WINDOWS\system32\DRIVERS\avipbb.sys
20:13:21.0968 1428	avipbb - ok
20:13:22.0000 1428	avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
20:13:22.0015 1428	avkmgr - ok
20:13:22.0156 1428	BBSvc           (01a24b415926bb5f772dbe12459d97de) C:\Programme\Microsoft\BingBar\BBSvc.EXE
20:13:22.0203 1428	BBSvc - ok
20:13:22.0265 1428	BBUpdate        (785de7abda13309d6065305542829e76) C:\Programme\Microsoft\BingBar\SeaPort.EXE
20:13:22.0296 1428	BBUpdate - ok
20:13:22.0328 1428	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:13:22.0578 1428	Beep - ok
20:13:22.0625 1428	BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
20:13:22.0875 1428	BITS - ok
20:13:22.0968 1428	Bonjour Service (f2060a34c8a75bc24a9222eb4f8c07bd) C:\Programme\Bonjour\mDNSResponder.exe
20:13:23.0000 1428	Bonjour Service - ok
20:13:23.0062 1428	Browser         (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
20:13:23.0265 1428	Browser - ok
20:13:23.0312 1428	btaudio         (4b43dfe1c1fbb305a1dc5504ef9bb34e) C:\WINDOWS\system32\drivers\btaudio.sys
20:13:23.0359 1428	btaudio - ok
20:13:23.0390 1428	BTDriver        (2f9f111d31aa3fbbe5781d829a4524e6) C:\WINDOWS\system32\DRIVERS\btport.sys
20:13:23.0421 1428	BTDriver - ok
20:13:23.0500 1428	BTKRNL          (70455baffc078b6152d1e52376296467) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
20:13:23.0578 1428	BTKRNL - ok
20:13:23.0671 1428	btwdins         (e43f7709f36444681978f9dc067a976b) C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
20:13:23.0718 1428	btwdins - ok
20:13:23.0750 1428	BTWDNDIS        (485020a1e1fc5c51a800ca69c618d881) C:\WINDOWS\system32\DRIVERS\btwdndis.sys
20:13:23.0765 1428	BTWDNDIS - ok
20:13:23.0781 1428	btwhid          (949eca9c56f657c06d3166d51f3226c7) C:\WINDOWS\system32\DRIVERS\btwhid.sys
20:13:23.0796 1428	btwhid - ok
20:13:23.0828 1428	BTWUSB          (2cfc2bd8785f82a42fcad83de1fa5a36) C:\WINDOWS\system32\Drivers\btwusb.sys
20:13:23.0843 1428	BTWUSB - ok
20:13:23.0890 1428	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:13:24.0093 1428	cbidf2k - ok
20:13:24.0140 1428	CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
20:13:24.0343 1428	CCDECODE - ok
20:13:24.0359 1428	cd20xrnt - ok
20:13:24.0390 1428	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:13:24.0578 1428	Cdaudio - ok
20:13:24.0593 1428	Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
20:13:24.0796 1428	Cdfs - ok
20:13:24.0828 1428	Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:13:25.0031 1428	Cdrom - ok
20:13:25.0031 1428	Changer - ok
20:13:25.0046 1428	CiSvc           (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
20:13:25.0265 1428	CiSvc - ok
20:13:25.0281 1428	ClipSrv         (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
20:13:25.0484 1428	ClipSrv - ok
20:13:25.0578 1428	clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:13:25.0687 1428	clr_optimization_v2.0.50727_32 - ok
20:13:25.0796 1428	clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:13:26.0000 1428	clr_optimization_v4.0.30319_32 - ok
20:13:26.0062 1428	CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
20:13:26.0328 1428	CmBatt - ok
20:13:26.0343 1428	CmdIde - ok
20:13:26.0359 1428	Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
20:13:26.0546 1428	Compbatt - ok
20:13:26.0562 1428	COMSysApp - ok
20:13:26.0578 1428	Cpqarray - ok
20:13:26.0625 1428	CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
20:13:26.0812 1428	CryptSvc - ok
20:13:26.0828 1428	dac2w2k - ok
20:13:26.0828 1428	dac960nt - ok
20:13:26.0890 1428	DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
20:13:26.0968 1428	DcomLaunch - ok
20:13:27.0015 1428	Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
20:13:27.0203 1428	Dhcp - ok
20:13:27.0234 1428	Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
20:13:27.0421 1428	Disk - ok
20:13:27.0437 1428	dmadmin - ok
20:13:27.0515 1428	dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
20:13:27.0750 1428	dmboot - ok
20:13:27.0796 1428	dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
20:13:28.0000 1428	dmio - ok
20:13:28.0015 1428	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:13:28.0203 1428	dmload - ok
20:13:28.0234 1428	dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
20:13:28.0421 1428	dmserver - ok
20:13:28.0453 1428	DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
20:13:28.0656 1428	DMusic - ok
20:13:28.0687 1428	Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
20:13:28.0781 1428	Dnscache - ok
20:13:28.0828 1428	Dot3svc         (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
20:13:29.0031 1428	Dot3svc - ok
20:13:29.0046 1428	dpti2o - ok
20:13:29.0093 1428	drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
20:13:29.0265 1428	drmkaud - ok
20:13:29.0296 1428	EapHost         (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
20:13:29.0500 1428	EapHost - ok
20:13:29.0515 1428	ERSvc           (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
20:13:29.0703 1428	ERSvc - ok
20:13:29.0750 1428	Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:13:29.0781 1428	Eventlog - ok
20:13:29.0828 1428	EventSystem     (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
20:13:29.0906 1428	EventSystem - ok
20:13:29.0937 1428	Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
20:13:30.0125 1428	Fastfat - ok
20:13:30.0171 1428	FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:13:30.0265 1428	FastUserSwitchingCompatibility - ok
20:13:30.0312 1428	Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
20:13:30.0515 1428	Fdc - ok
20:13:30.0531 1428	Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
20:13:30.0750 1428	Fips - ok
20:13:30.0781 1428	Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
20:13:30.0968 1428	Flpydisk - ok
20:13:31.0015 1428	FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
20:13:31.0218 1428	FltMgr - ok
20:13:31.0359 1428	FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
20:13:31.0375 1428	FontCache3.0.0.0 - ok
20:13:31.0406 1428	fssfltr         (eda991753af03e5b06935be114ba9640) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
20:13:31.0437 1428	fssfltr - ok
20:13:31.0562 1428	fsssvc          (f6717211c1ec2cddaa81b97b0727c2e9) C:\Programme\Windows Live\Family Safety\fsssvc.exe
20:13:31.0625 1428	fsssvc - ok
20:13:31.0671 1428	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:13:31.0906 1428	Fs_Rec - ok
20:13:31.0953 1428	Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:13:32.0140 1428	Ftdisk - ok
20:13:32.0187 1428	GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
20:13:32.0203 1428	GEARAspiWDM - ok
20:13:32.0250 1428	Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:13:32.0437 1428	Gpc - ok
20:13:32.0484 1428	HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
20:13:32.0656 1428	HDAudBus - ok
20:13:32.0703 1428	helpsvc         (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
20:13:32.0890 1428	helpsvc - ok
20:13:32.0921 1428	HidServ         (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
20:13:33.0109 1428	HidServ - ok
20:13:33.0125 1428	HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:13:33.0312 1428	HidUsb - ok
20:13:33.0343 1428	hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
20:13:33.0531 1428	hkmsvc - ok
20:13:33.0546 1428	hpn - ok
20:13:33.0609 1428	HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
20:13:33.0656 1428	HTTP - ok
20:13:33.0687 1428	HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
20:13:33.0875 1428	HTTPFilter - ok
20:13:33.0875 1428	i2omgmt - ok
20:13:33.0890 1428	i2omp - ok
20:13:33.0937 1428	i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:13:34.0125 1428	i8042prt - ok
20:13:34.0484 1428	ialm            (0f68e2ec713f132ffb19e45415b09679) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
20:13:34.0890 1428	ialm - ok
20:13:35.0046 1428	iaStor          (8ef427c54497c5f8a7a645990e4278c7) C:\WINDOWS\system32\drivers\iaStor.sys
20:13:35.0093 1428	iaStor - ok
20:13:35.0296 1428	idsvc           (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:13:35.0421 1428	idsvc - ok
20:13:35.0468 1428	Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:13:35.0718 1428	Imapi - ok
20:13:35.0734 1428	ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
20:13:35.0953 1428	ImapiService - ok
20:13:36.0000 1428	InCDfs          (580a81790cd0a48d85da322267da7ac4) C:\WINDOWS\system32\drivers\InCDFs.sys
20:13:36.0015 1428	InCDfs - ok
20:13:36.0062 1428	InCDPass        (aaa2789d2ce21b31be9406ba1ceb7285) C:\WINDOWS\system32\drivers\InCDPass.sys
20:13:36.0078 1428	InCDPass - ok
20:13:36.0093 1428	InCDrec         (4d022577e9072b5d22e0a383a7806bbb) C:\WINDOWS\system32\drivers\InCDrec.sys
20:13:36.0109 1428	InCDrec - ok
20:13:36.0125 1428	incdrm          (c258e57321a3c3737f4fa815fa69ee0b) C:\WINDOWS\system32\drivers\InCDRm.sys
20:13:36.0140 1428	incdrm - ok
20:13:36.0343 1428	InCDsrv         (9792b85e32e058cd6a43db274ba47d57) C:\Eigene_Programme\Nero 7\InCD\InCDsrv.exe
20:13:36.0437 1428	InCDsrv - ok
20:13:36.0562 1428	ini910u - ok
20:13:36.0921 1428	IntcAzAudAddService (816a4f17dffdeeb01896fe05991838e0) C:\WINDOWS\system32\drivers\RtkHDAud.sys
20:13:37.0187 1428	IntcAzAudAddService - ok
20:13:37.0265 1428	IntelIde - ok
20:13:37.0281 1428	intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
20:13:37.0484 1428	intelppm - ok
20:13:37.0515 1428	Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
20:13:37.0734 1428	Ip6Fw - ok
20:13:37.0750 1428	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:13:37.0921 1428	IpFilterDriver - ok
20:13:37.0937 1428	IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:13:38.0125 1428	IpInIp - ok
20:13:38.0296 1428	IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:13:38.0500 1428	IpNat - ok
20:13:38.0609 1428	iPod Service    (ca9d4b998bff311a539604ed87318fa0) C:\Programme\iPod\bin\iPodService.exe
20:13:38.0671 1428	iPod Service - ok
20:13:38.0718 1428	IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:13:38.0968 1428	IPSec - ok
20:13:39.0000 1428	IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:13:39.0156 1428	IRENUM - ok
20:13:39.0187 1428	isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:13:39.0375 1428	isapnp - ok
20:13:39.0468 1428	JavaQuickStarterService (5e06a9d23727daf96faa796f1135fdcd) C:\Programme\Java\jre6\bin\jqs.exe
20:13:39.0484 1428	JavaQuickStarterService - ok
20:13:39.0515 1428	Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:13:39.0734 1428	Kbdclass - ok
20:13:39.0796 1428	kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
20:13:39.0984 1428	kmixer - ok
20:13:40.0031 1428	KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
20:13:40.0171 1428	KSecDD - ok
20:13:40.0234 1428	Ktp             (85b6d85c044e3df77e92b5a7b265008f) C:\WINDOWS\system32\DRIVERS\ETD.sys
20:13:40.0312 1428	Ktp - ok
20:13:40.0343 1428	L1e             (fa46f5d09edf93e0c71fe6500fe3f4ae) C:\WINDOWS\system32\DRIVERS\l1e51x86.sys
20:13:40.0359 1428	L1e - ok
20:13:40.0421 1428	LanmanServer    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
20:13:40.0515 1428	LanmanServer - ok
20:13:40.0562 1428	lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
20:13:40.0656 1428	lanmanworkstation - ok
20:13:40.0781 1428	Lavasoft Ad-Aware Service (335b35f436d6801a4910afbde5aa6a16) C:\Programme\Lavasoft\Ad-Aware\AAWService.exe
20:13:40.0890 1428	Lavasoft Ad-Aware Service - ok
20:13:40.0921 1428	Lbd             (419590ebe7855215bb157ea0cf0d0531) C:\WINDOWS\system32\DRIVERS\Lbd.sys
20:13:40.0968 1428	Lbd - ok
20:13:40.0968 1428	lbrtfdc - ok
20:13:41.0109 1428	LightScribeService (abf90fc5a127f481219b873c1b8dfc1c) C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
20:13:41.0125 1428	LightScribeService ( UnsignedFile.Multi.Generic ) - warning
20:13:41.0125 1428	LightScribeService - detected UnsignedFile.Multi.Generic (1)
20:13:41.0171 1428	LmHosts         (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
20:13:41.0421 1428	LmHosts - ok
20:13:41.0437 1428	MBAMProtector   (fb097bbc1a18f044bd17bd2fccf97865) C:\WINDOWS\system32\drivers\mbam.sys
20:13:41.0468 1428	MBAMProtector - ok
20:13:41.0546 1428	MBAMService     (ba400ed640bca1eae5c727ae17c10207) C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
20:13:41.0593 1428	MBAMService - ok
20:13:41.0625 1428	Messenger       (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
20:13:41.0828 1428	Messenger - ok
20:13:41.0859 1428	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:13:42.0031 1428	mnmdd - ok
20:13:42.0093 1428	mnmsrvc         (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
20:13:42.0281 1428	mnmsrvc - ok
20:13:42.0312 1428	Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
20:13:42.0531 1428	Modem - ok
20:13:42.0625 1428	Monfilt         (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys
20:13:42.0765 1428	Monfilt - ok
20:13:42.0812 1428	Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:13:43.0000 1428	Mouclass - ok
20:13:43.0078 1428	mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:13:43.0281 1428	mouhid - ok
20:13:43.0296 1428	MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
20:13:43.0500 1428	MountMgr - ok
20:13:43.0500 1428	mraid35x - ok
20:13:43.0546 1428	MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:13:43.0734 1428	MRxDAV - ok
20:13:43.0796 1428	MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:13:43.0906 1428	MRxSmb - ok
20:13:43.0937 1428	MSDTC           (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
20:13:44.0125 1428	MSDTC - ok
20:13:44.0171 1428	Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
20:13:44.0406 1428	Msfs - ok
20:13:44.0406 1428	MSIServer - ok
20:13:44.0468 1428	MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:13:44.0671 1428	MSKSSRV - ok
20:13:44.0687 1428	MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:13:44.0859 1428	MSPCLOCK - ok
20:13:44.0906 1428	MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
20:13:45.0109 1428	MSPQM - ok
20:13:45.0140 1428	mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:13:45.0312 1428	mssmbios - ok
20:13:45.0343 1428	MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
20:13:45.0531 1428	MSTEE - ok
20:13:45.0578 1428	Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
20:13:45.0625 1428	Mup - ok
20:13:45.0656 1428	NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
20:13:45.0859 1428	NABTSFEC - ok
20:13:45.0921 1428	napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
20:13:46.0140 1428	napagent - ok
20:13:46.0296 1428	NBService       (b498a14133bd09ad0817590ace4470ad) C:\Eigene_Programme\Nero 7\Nero BackItUp\NBService.exe
20:13:46.0375 1428	NBService - ok
20:13:46.0437 1428	NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
20:13:46.0656 1428	NDIS - ok
20:13:46.0703 1428	NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
20:13:46.0937 1428	NdisIP - ok
20:13:46.0968 1428	NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:13:47.0015 1428	NdisTapi - ok
20:13:47.0062 1428	Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:13:47.0250 1428	Ndisuio - ok
20:13:47.0296 1428	NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:13:47.0484 1428	NdisWan - ok
20:13:47.0515 1428	NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
20:13:47.0609 1428	NDProxy - ok
20:13:47.0640 1428	NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
20:13:47.0828 1428	NetBIOS - ok
20:13:47.0875 1428	NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
20:13:48.0078 1428	NetBT - ok
20:13:48.0125 1428	NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:13:48.0312 1428	NetDDE - ok
20:13:48.0328 1428	NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:13:48.0515 1428	NetDDEdsdm - ok
20:13:48.0625 1428	Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:48.0796 1428	Netlogon - ok
20:13:48.0859 1428	Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
20:13:49.0062 1428	Netman - ok
20:13:49.0171 1428	NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
20:13:49.0250 1428	NetTcpPortSharing - ok
20:13:49.0312 1428	Nla             (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
20:13:49.0359 1428	Nla - ok
20:13:49.0484 1428	NMIndexingService (a328a46d87bb92ce4d8a4528e9d84787) C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
20:13:49.0500 1428	NMIndexingService - ok
20:13:49.0546 1428	Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
20:13:49.0734 1428	Npfs - ok
20:13:49.0765 1428	Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
20:13:50.0000 1428	Ntfs - ok
20:13:50.0031 1428	NtLmSsp         (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:50.0218 1428	NtLmSsp - ok
20:13:50.0250 1428	NtmsSvc         (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
20:13:50.0484 1428	NtmsSvc - ok
20:13:50.0500 1428	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:13:50.0687 1428	Null - ok
20:13:50.0703 1428	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:13:50.0890 1428	NwlnkFlt - ok
20:13:50.0906 1428	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:13:51.0093 1428	NwlnkFwd - ok
20:13:51.0218 1428	odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
20:13:51.0281 1428	odserv - ok
20:13:51.0328 1428	ose             (5a432a042dae460abe7199b758e8606c) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
20:13:51.0343 1428	ose - ok
20:13:51.0390 1428	Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
20:13:51.0578 1428	Parport - ok
20:13:51.0625 1428	PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
20:13:51.0843 1428	PartMgr - ok
20:13:51.0890 1428	ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
20:13:52.0078 1428	ParVdm - ok
20:13:52.0125 1428	PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
20:13:52.0312 1428	PCI - ok
20:13:52.0343 1428	PCIDump - ok
20:13:52.0343 1428	PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
20:13:52.0531 1428	PCIIde - ok
20:13:52.0562 1428	Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
20:13:52.0750 1428	Pcmcia - ok
20:13:52.0765 1428	PDCOMP - ok
20:13:52.0765 1428	PDFRAME - ok
20:13:52.0781 1428	PDRELI - ok
20:13:52.0781 1428	PDRFRAME - ok
20:13:52.0796 1428	perc2 - ok
20:13:52.0812 1428	perc2hib - ok
20:13:52.0875 1428	PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:13:52.0906 1428	PlugPlay - ok
20:13:52.0953 1428	PolicyAgent     (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:53.0125 1428	PolicyAgent - ok
20:13:53.0156 1428	PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:13:53.0343 1428	PptpMiniport - ok
20:13:53.0359 1428	ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:53.0531 1428	ProtectedStorage - ok
20:13:53.0546 1428	PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
20:13:53.0734 1428	PSched - ok
20:13:54.0000 1428	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:13:54.0203 1428	Ptilink - ok
20:13:54.0250 1428	PxHelp20        (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
20:13:54.0281 1428	PxHelp20 - ok
20:13:54.0281 1428	ql1080 - ok
20:13:54.0296 1428	Ql10wnt - ok
20:13:54.0312 1428	ql12160 - ok
20:13:54.0328 1428	ql1240 - ok
20:13:54.0343 1428	ql1280 - ok
20:13:54.0359 1428	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:13:54.0609 1428	RasAcd - ok
20:13:54.0625 1428	RasAuto         (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
20:13:54.0812 1428	RasAuto - ok
20:13:54.0828 1428	Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:13:55.0015 1428	Rasl2tp - ok
20:13:55.0046 1428	RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
20:13:55.0234 1428	RasMan - ok
20:13:55.0265 1428	RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:13:55.0468 1428	RasPppoe - ok
20:13:55.0484 1428	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
20:13:55.0656 1428	Raspti - ok
20:13:55.0718 1428	Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:13:55.0921 1428	Rdbss - ok
20:13:55.0953 1428	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:13:56.0156 1428	RDPCDD - ok
20:13:56.0218 1428	RDPWD           (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
20:13:56.0265 1428	RDPWD - ok
20:13:56.0328 1428	RDSessMgr       (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
20:13:56.0515 1428	RDSessMgr - ok
20:13:56.0562 1428	redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
20:13:56.0765 1428	redbook - ok
20:13:56.0796 1428	RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
20:13:57.0015 1428	RemoteAccess - ok
20:13:57.0062 1428	RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
20:13:57.0265 1428	RpcLocator - ok
20:13:57.0328 1428	RpcSs           (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
20:13:57.0375 1428	RpcSs - ok
20:13:57.0421 1428	RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
20:13:57.0593 1428	RSVP - ok
20:13:57.0671 1428	RT80x86         (f591f71883424f5b31e3348ea4454466) C:\WINDOWS\system32\DRIVERS\RT2860.sys
20:13:57.0796 1428	RT80x86 - ok
20:13:57.0843 1428	SamSs           (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:58.0031 1428	SamSs - ok
20:13:58.0078 1428	SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
20:13:58.0328 1428	SCardSvr - ok
20:13:58.0359 1428	Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
20:13:58.0546 1428	Schedule - ok
20:13:58.0593 1428	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:13:58.0671 1428	Secdrv - ok
20:13:58.0718 1428	seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
20:13:58.0906 1428	seclogon - ok
20:13:58.0937 1428	SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
20:13:59.0109 1428	SENS - ok
20:13:59.0140 1428	Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
20:13:59.0328 1428	Serial - ok
20:13:59.0359 1428	Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
20:13:59.0546 1428	Sfloppy - ok
20:13:59.0593 1428	SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
20:13:59.0781 1428	SharedAccess - ok
20:13:59.0812 1428	ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:13:59.0843 1428	ShellHWDetection - ok
20:13:59.0859 1428	Simbad - ok
20:13:59.0906 1428	SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
20:14:00.0078 1428	SLIP - ok
20:14:00.0234 1428	SNP2UVC         (060f51141b20b8156804446a04ab8b2a) C:\WINDOWS\system32\DRIVERS\snp2uvc.sys
20:14:00.0437 1428	SNP2UVC - ok
20:14:00.0546 1428	Sparrow - ok
20:14:00.0593 1428	splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
20:14:00.0843 1428	splitter - ok
20:14:00.0890 1428	Spooler         (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
20:14:00.0953 1428	Spooler - ok
20:14:01.0031 1428	sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
20:14:01.0140 1428	sr - ok
20:14:01.0156 1428	srservice       (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
20:14:01.0250 1428	srservice - ok
20:14:01.0312 1428	Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
20:14:01.0406 1428	Srv - ok
20:14:01.0437 1428	SSDPSRV         (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
20:14:01.0531 1428	SSDPSRV - ok
20:14:01.0609 1428	ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
20:14:01.0625 1428	ssmdrv - ok
20:14:01.0687 1428	stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
20:14:01.0890 1428	stisvc - ok
20:14:01.0937 1428	streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
20:14:02.0156 1428	streamip - ok
20:14:02.0203 1428	swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:14:02.0390 1428	swenum - ok
20:14:02.0437 1428	swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
20:14:02.0609 1428	swmidi - ok
20:14:02.0625 1428	SwPrv - ok
20:14:02.0625 1428	symc810 - ok
20:14:02.0640 1428	symc8xx - ok
20:14:02.0640 1428	sym_hi - ok
20:14:02.0656 1428	sym_u3 - ok
20:14:02.0703 1428	sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
20:14:02.0906 1428	sysaudio - ok
20:14:02.0953 1428	SysmonLog       (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
20:14:03.0140 1428	SysmonLog - ok
20:14:03.0203 1428	TapiSrv         (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
20:14:03.0390 1428	TapiSrv - ok
20:14:03.0437 1428	Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:14:03.0484 1428	Tcpip - ok
20:14:03.0531 1428	TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:14:03.0718 1428	TDPIPE - ok
20:14:03.0734 1428	TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
20:14:03.0921 1428	TDTCP - ok
20:14:03.0968 1428	TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
20:14:04.0156 1428	TermDD - ok
20:14:04.0234 1428	TermService     (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
20:14:04.0421 1428	TermService - ok
20:14:04.0468 1428	Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:14:04.0500 1428	Themes - ok
20:14:04.0500 1428	TosIde - ok
20:14:04.0546 1428	TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
20:14:04.0750 1428	TrkWks - ok
20:14:04.0796 1428	Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
20:14:04.0968 1428	Udfs - ok
20:14:04.0984 1428	ultra - ok
20:14:05.0062 1428	Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
20:14:05.0281 1428	Update - ok
20:14:05.0328 1428	upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
20:14:05.0421 1428	upnphost - ok
20:14:05.0437 1428	UPS             (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
20:14:05.0625 1428	UPS - ok
20:14:05.0671 1428	USBAAPL         (d4fb6ecc60a428564ba8768b0e23c0fc) C:\WINDOWS\system32\Drivers\usbaapl.sys
20:14:05.0734 1428	USBAAPL - ok
20:14:05.0781 1428	usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:14:05.0953 1428	usbccgp - ok
20:14:06.0015 1428	usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:14:06.0203 1428	usbehci - ok
20:14:06.0234 1428	usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:14:06.0406 1428	usbhub - ok
20:14:06.0453 1428	usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
20:14:06.0640 1428	usbprint - ok
20:14:06.0671 1428	usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
20:14:06.0859 1428	usbscan - ok
20:14:06.0875 1428	usbstor         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:14:07.0062 1428	usbstor - ok
20:14:07.0078 1428	usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
20:14:07.0250 1428	usbuhci - ok
20:14:07.0296 1428	usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
20:14:07.0484 1428	usbvideo - ok
20:14:07.0515 1428	VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
20:14:07.0703 1428	VgaSave - ok
20:14:07.0718 1428	ViaIde - ok
20:14:07.0765 1428	VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
20:14:07.0937 1428	VolSnap - ok
20:14:08.0000 1428	VSS             (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
20:14:08.0125 1428	VSS - ok
20:14:08.0171 1428	W32Time         (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
20:14:08.0343 1428	W32Time - ok
20:14:08.0390 1428	Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:14:08.0593 1428	Wanarp - ok
20:14:08.0593 1428	WDICA - ok
20:14:08.0625 1428	wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
20:14:08.0796 1428	wdmaud - ok
20:14:08.0843 1428	WebClient       (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
20:14:09.0031 1428	WebClient - ok
20:14:09.0156 1428	winmgmt         (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
20:14:09.0343 1428	winmgmt - ok
20:14:09.0406 1428	WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
20:14:09.0453 1428	WmdmPmSN - ok
20:14:09.0484 1428	WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
20:14:09.0671 1428	WmiApSrv - ok
20:14:09.0828 1428	WMPNetworkSvc   (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
20:14:09.0937 1428	WMPNetworkSvc - ok
20:14:10.0015 1428	WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
20:14:10.0046 1428	WpdUsb - ok
20:14:10.0265 1428	WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
20:14:10.0359 1428	WPFFontCache_v0400 - ok
20:14:10.0406 1428	wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
20:14:10.0671 1428	wscsvc - ok
20:14:10.0718 1428	WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
20:14:10.0890 1428	WSTCODEC - ok
20:14:10.0953 1428	wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
20:14:11.0140 1428	wuauserv - ok
20:14:11.0171 1428	WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
20:14:11.0265 1428	WudfPf - ok
20:14:11.0296 1428	WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
20:14:11.0328 1428	WudfRd - ok
20:14:11.0343 1428	WudfSvc         (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
20:14:11.0390 1428	WudfSvc - ok
20:14:11.0453 1428	WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
20:14:11.0671 1428	WZCSVC - ok
20:14:11.0703 1428	xmlprov         (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
20:14:11.0953 1428	xmlprov - ok
20:14:12.0000 1428	MBR (0x1B8)     (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
20:14:13.0171 1428	\Device\Harddisk0\DR0 - ok
20:14:13.0187 1428	MBR (0x1B8)     (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR5
20:14:13.0453 1428	\Device\Harddisk1\DR5 - ok
20:14:13.0453 1428	Boot (0x1200)   (cee99027cea77554252948d92431fe00) \Device\Harddisk0\DR0\Partition0
20:14:13.0468 1428	\Device\Harddisk0\DR0\Partition0 - ok
20:14:13.0500 1428	Boot (0x1200)   (48f7c22ed3ff089f54c572302c6ba6e3) \Device\Harddisk0\DR0\Partition1
20:14:13.0500 1428	\Device\Harddisk0\DR0\Partition1 - ok
20:14:13.0515 1428	Boot (0x1200)   (3d13054bcc387d3ad95f6ba4dc9b1ad2) \Device\Harddisk1\DR5\Partition0
20:14:13.0515 1428	\Device\Harddisk1\DR5\Partition0 - ok
20:14:13.0515 1428	============================================================
20:14:13.0515 1428	Scan finished
20:14:13.0515 1428	============================================================
20:14:13.0640 3140	Detected object count: 1
20:14:13.0640 3140	Actual detected object count: 1
20:14:32.0250 3140	LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
20:14:32.0250 3140	LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:11:33.0984 3112	TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16
20:11:34.0031 3112	============================================================
20:11:34.0031 3112	Current date / time: 2012/05/31 20:11:34.0031
20:11:34.0031 3112	SystemInfo:
20:11:34.0031 3112	
20:11:34.0031 3112	OS Version: 5.1.2600 ServicePack: 3.0
20:11:34.0031 3112	Product type: Workstation
20:11:34.0031 3112	ComputerName: UNSERERSTER
20:11:34.0031 3112	UserName: Admin
20:11:34.0031 3112	Windows directory: C:\WINDOWS
20:11:34.0031 3112	System windows directory: C:\WINDOWS
20:11:34.0031 3112	Processor architecture: Intel x86
20:11:34.0031 3112	Number of processors: 2
20:11:34.0031 3112	Page size: 0x1000
20:11:34.0031 3112	Boot type: Normal boot
20:11:34.0031 3112	============================================================
20:11:35.0078 3112	Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x69A9, SectorsPerTrack: 0x36, TracksPerCylinder: 0xD6, Type 'K0', Flags 0x00000050
20:11:35.0078 3112	Drive \Device\Harddisk1\DR5 - Size: 0x7AA80000 (1.92 Gb), SectorSize: 0x200, Cylinders: 0xFA, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
20:11:35.0078 3112	============================================================
20:11:35.0078 3112	\Device\Harddisk0\DR0:
20:11:35.0078 3112	MBR partitions:
20:11:35.0078 3112	\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x36, BlocksNum 0x9020CE2
20:11:35.0078 3112	\Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x9020D18, BlocksNum 0x901DFF4
20:11:35.0078 3112	\Device\Harddisk1\DR5:
20:11:35.0093 3112	MBR partitions:
20:11:35.0093 3112	\Device\Harddisk1\DR5\Partition0: MBR, Type 0x6, StartLBA 0xF3, BlocksNum 0x3D530D
20:11:35.0093 3112	============================================================
20:11:35.0125 3112	C: <-> \Device\Harddisk0\DR0\Partition0
20:11:35.0187 3112	D: <-> \Device\Harddisk0\DR0\Partition1
20:11:35.0187 3112	============================================================
20:11:35.0187 3112	Initialize success
20:11:35.0187 3112	============================================================
20:13:15.0156 1428	============================================================
20:13:15.0156 1428	Scan started
20:13:15.0156 1428	Mode: Manual; SigCheck; TDLFS; 
20:13:15.0156 1428	============================================================
20:13:15.0937 1428	AAV UpdateService (7eeb488346fbfa3731276c3ee8a8fd9e) C:\Eigene_Programme\Steuertipps\Steuer-Spar-Erklaerung 2012\AAVUpdateManager\aavus.exe
20:13:16.0234 1428	AAV UpdateService - ok
20:13:16.0328 1428	Abiosdsk - ok
20:13:16.0343 1428	abp480n5 - ok
20:13:16.0390 1428	ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:13:17.0890 1428	ACPI - ok
20:13:17.0921 1428	ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
20:13:18.0140 1428	ACPIEC - ok
20:13:18.0140 1428	adpu160m - ok
20:13:18.0187 1428	aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
20:13:18.0406 1428	aec - ok
20:13:18.0453 1428	AFD             (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
20:13:18.0531 1428	AFD - ok
20:13:18.0531 1428	Aha154x - ok
20:13:18.0546 1428	aic78u2 - ok
20:13:18.0546 1428	aic78xx - ok
20:13:18.0578 1428	Alerter         (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
20:13:18.0781 1428	Alerter - ok
20:13:18.0812 1428	ALG             (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
20:13:18.0921 1428	ALG - ok
20:13:18.0921 1428	AliIde - ok
20:13:19.0109 1428	Ambfilt         (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys
20:13:19.0328 1428	Ambfilt - ok
20:13:19.0453 1428	amsint - ok
20:13:19.0593 1428	AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Programme\Avira\AntiVir Desktop\sched.exe
20:13:19.0625 1428	AntiVirSchedulerService - ok
20:13:19.0671 1428	AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Programme\Avira\AntiVir Desktop\avguard.exe
20:13:19.0703 1428	AntiVirService - ok
20:13:19.0796 1428	Apple Mobile Device (20f6f19fe9e753f2780dc2fa083ad597) C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
20:13:19.0828 1428	Apple Mobile Device - ok
20:13:19.0828 1428	AppMgmt - ok
20:13:19.0953 1428	AR5416          (7d53e5646ba23fd51296f7ef8979a000) C:\WINDOWS\system32\DRIVERS\athw.sys
20:13:20.0140 1428	AR5416 - ok
20:13:20.0156 1428	asc - ok
20:13:20.0171 1428	asc3350p - ok
20:13:20.0187 1428	asc3550 - ok
20:13:20.0343 1428	aspnet_state    (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
20:13:20.0453 1428	aspnet_state - ok
20:13:20.0500 1428	AsusACPI        (12415a4b61ded200fe9932b47a35fa42) C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys
20:13:20.0593 1428	AsusACPI - ok
20:13:20.0640 1428	AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:13:20.0890 1428	AsyncMac - ok
20:13:20.0937 1428	atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
20:13:21.0140 1428	atapi - ok
20:13:21.0140 1428	Atdisk - ok
20:13:21.0171 1428	Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:13:21.0359 1428	Atmarpc - ok
20:13:21.0406 1428	AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
20:13:21.0609 1428	AudioSrv - ok
20:13:21.0640 1428	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:13:21.0828 1428	audstub - ok
20:13:21.0859 1428	avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
20:13:21.0906 1428	avgntflt - ok
20:13:21.0953 1428	avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\WINDOWS\system32\DRIVERS\avipbb.sys
20:13:21.0968 1428	avipbb - ok
20:13:22.0000 1428	avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
20:13:22.0015 1428	avkmgr - ok
20:13:22.0156 1428	BBSvc           (01a24b415926bb5f772dbe12459d97de) C:\Programme\Microsoft\BingBar\BBSvc.EXE
20:13:22.0203 1428	BBSvc - ok
20:13:22.0265 1428	BBUpdate        (785de7abda13309d6065305542829e76) C:\Programme\Microsoft\BingBar\SeaPort.EXE
20:13:22.0296 1428	BBUpdate - ok
20:13:22.0328 1428	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:13:22.0578 1428	Beep - ok
20:13:22.0625 1428	BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
20:13:22.0875 1428	BITS - ok
20:13:22.0968 1428	Bonjour Service (f2060a34c8a75bc24a9222eb4f8c07bd) C:\Programme\Bonjour\mDNSResponder.exe
20:13:23.0000 1428	Bonjour Service - ok
20:13:23.0062 1428	Browser         (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
20:13:23.0265 1428	Browser - ok
20:13:23.0312 1428	btaudio         (4b43dfe1c1fbb305a1dc5504ef9bb34e) C:\WINDOWS\system32\drivers\btaudio.sys
20:13:23.0359 1428	btaudio - ok
20:13:23.0390 1428	BTDriver        (2f9f111d31aa3fbbe5781d829a4524e6) C:\WINDOWS\system32\DRIVERS\btport.sys
20:13:23.0421 1428	BTDriver - ok
20:13:23.0500 1428	BTKRNL          (70455baffc078b6152d1e52376296467) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
20:13:23.0578 1428	BTKRNL - ok
20:13:23.0671 1428	btwdins         (e43f7709f36444681978f9dc067a976b) C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
20:13:23.0718 1428	btwdins - ok
20:13:23.0750 1428	BTWDNDIS        (485020a1e1fc5c51a800ca69c618d881) C:\WINDOWS\system32\DRIVERS\btwdndis.sys
20:13:23.0765 1428	BTWDNDIS - ok
20:13:23.0781 1428	btwhid          (949eca9c56f657c06d3166d51f3226c7) C:\WINDOWS\system32\DRIVERS\btwhid.sys
20:13:23.0796 1428	btwhid - ok
20:13:23.0828 1428	BTWUSB          (2cfc2bd8785f82a42fcad83de1fa5a36) C:\WINDOWS\system32\Drivers\btwusb.sys
20:13:23.0843 1428	BTWUSB - ok
20:13:23.0890 1428	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:13:24.0093 1428	cbidf2k - ok
20:13:24.0140 1428	CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
20:13:24.0343 1428	CCDECODE - ok
20:13:24.0359 1428	cd20xrnt - ok
20:13:24.0390 1428	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:13:24.0578 1428	Cdaudio - ok
20:13:24.0593 1428	Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
20:13:24.0796 1428	Cdfs - ok
20:13:24.0828 1428	Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:13:25.0031 1428	Cdrom - ok
20:13:25.0031 1428	Changer - ok
20:13:25.0046 1428	CiSvc           (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
20:13:25.0265 1428	CiSvc - ok
20:13:25.0281 1428	ClipSrv         (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
20:13:25.0484 1428	ClipSrv - ok
20:13:25.0578 1428	clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:13:25.0687 1428	clr_optimization_v2.0.50727_32 - ok
20:13:25.0796 1428	clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:13:26.0000 1428	clr_optimization_v4.0.30319_32 - ok
20:13:26.0062 1428	CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
20:13:26.0328 1428	CmBatt - ok
20:13:26.0343 1428	CmdIde - ok
20:13:26.0359 1428	Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
20:13:26.0546 1428	Compbatt - ok
20:13:26.0562 1428	COMSysApp - ok
20:13:26.0578 1428	Cpqarray - ok
20:13:26.0625 1428	CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
20:13:26.0812 1428	CryptSvc - ok
20:13:26.0828 1428	dac2w2k - ok
20:13:26.0828 1428	dac960nt - ok
20:13:26.0890 1428	DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
20:13:26.0968 1428	DcomLaunch - ok
20:13:27.0015 1428	Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
20:13:27.0203 1428	Dhcp - ok
20:13:27.0234 1428	Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
20:13:27.0421 1428	Disk - ok
20:13:27.0437 1428	dmadmin - ok
20:13:27.0515 1428	dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
20:13:27.0750 1428	dmboot - ok
20:13:27.0796 1428	dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
20:13:28.0000 1428	dmio - ok
20:13:28.0015 1428	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:13:28.0203 1428	dmload - ok
20:13:28.0234 1428	dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
20:13:28.0421 1428	dmserver - ok
20:13:28.0453 1428	DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
20:13:28.0656 1428	DMusic - ok
20:13:28.0687 1428	Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
20:13:28.0781 1428	Dnscache - ok
20:13:28.0828 1428	Dot3svc         (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
20:13:29.0031 1428	Dot3svc - ok
20:13:29.0046 1428	dpti2o - ok
20:13:29.0093 1428	drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
20:13:29.0265 1428	drmkaud - ok
20:13:29.0296 1428	EapHost         (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
20:13:29.0500 1428	EapHost - ok
20:13:29.0515 1428	ERSvc           (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
20:13:29.0703 1428	ERSvc - ok
20:13:29.0750 1428	Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:13:29.0781 1428	Eventlog - ok
20:13:29.0828 1428	EventSystem     (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
20:13:29.0906 1428	EventSystem - ok
20:13:29.0937 1428	Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
20:13:30.0125 1428	Fastfat - ok
20:13:30.0171 1428	FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:13:30.0265 1428	FastUserSwitchingCompatibility - ok
20:13:30.0312 1428	Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
20:13:30.0515 1428	Fdc - ok
20:13:30.0531 1428	Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
20:13:30.0750 1428	Fips - ok
20:13:30.0781 1428	Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
20:13:30.0968 1428	Flpydisk - ok
20:13:31.0015 1428	FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
20:13:31.0218 1428	FltMgr - ok
20:13:31.0359 1428	FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
20:13:31.0375 1428	FontCache3.0.0.0 - ok
20:13:31.0406 1428	fssfltr         (eda991753af03e5b06935be114ba9640) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
20:13:31.0437 1428	fssfltr - ok
20:13:31.0562 1428	fsssvc          (f6717211c1ec2cddaa81b97b0727c2e9) C:\Programme\Windows Live\Family Safety\fsssvc.exe
20:13:31.0625 1428	fsssvc - ok
20:13:31.0671 1428	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:13:31.0906 1428	Fs_Rec - ok
20:13:31.0953 1428	Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:13:32.0140 1428	Ftdisk - ok
20:13:32.0187 1428	GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
20:13:32.0203 1428	GEARAspiWDM - ok
20:13:32.0250 1428	Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:13:32.0437 1428	Gpc - ok
20:13:32.0484 1428	HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
20:13:32.0656 1428	HDAudBus - ok
20:13:32.0703 1428	helpsvc         (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
20:13:32.0890 1428	helpsvc - ok
20:13:32.0921 1428	HidServ         (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
20:13:33.0109 1428	HidServ - ok
20:13:33.0125 1428	HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:13:33.0312 1428	HidUsb - ok
20:13:33.0343 1428	hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
20:13:33.0531 1428	hkmsvc - ok
20:13:33.0546 1428	hpn - ok
20:13:33.0609 1428	HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
20:13:33.0656 1428	HTTP - ok
20:13:33.0687 1428	HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
20:13:33.0875 1428	HTTPFilter - ok
20:13:33.0875 1428	i2omgmt - ok
20:13:33.0890 1428	i2omp - ok
20:13:33.0937 1428	i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:13:34.0125 1428	i8042prt - ok
20:13:34.0484 1428	ialm            (0f68e2ec713f132ffb19e45415b09679) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
20:13:34.0890 1428	ialm - ok
20:13:35.0046 1428	iaStor          (8ef427c54497c5f8a7a645990e4278c7) C:\WINDOWS\system32\drivers\iaStor.sys
20:13:35.0093 1428	iaStor - ok
20:13:35.0296 1428	idsvc           (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:13:35.0421 1428	idsvc - ok
20:13:35.0468 1428	Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:13:35.0718 1428	Imapi - ok
20:13:35.0734 1428	ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
20:13:35.0953 1428	ImapiService - ok
20:13:36.0000 1428	InCDfs          (580a81790cd0a48d85da322267da7ac4) C:\WINDOWS\system32\drivers\InCDFs.sys
20:13:36.0015 1428	InCDfs - ok
20:13:36.0062 1428	InCDPass        (aaa2789d2ce21b31be9406ba1ceb7285) C:\WINDOWS\system32\drivers\InCDPass.sys
20:13:36.0078 1428	InCDPass - ok
20:13:36.0093 1428	InCDrec         (4d022577e9072b5d22e0a383a7806bbb) C:\WINDOWS\system32\drivers\InCDrec.sys
20:13:36.0109 1428	InCDrec - ok
20:13:36.0125 1428	incdrm          (c258e57321a3c3737f4fa815fa69ee0b) C:\WINDOWS\system32\drivers\InCDRm.sys
20:13:36.0140 1428	incdrm - ok
20:13:36.0343 1428	InCDsrv         (9792b85e32e058cd6a43db274ba47d57) C:\Eigene_Programme\Nero 7\InCD\InCDsrv.exe
20:13:36.0437 1428	InCDsrv - ok
20:13:36.0562 1428	ini910u - ok
20:13:36.0921 1428	IntcAzAudAddService (816a4f17dffdeeb01896fe05991838e0) C:\WINDOWS\system32\drivers\RtkHDAud.sys
20:13:37.0187 1428	IntcAzAudAddService - ok
20:13:37.0265 1428	IntelIde - ok
20:13:37.0281 1428	intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
20:13:37.0484 1428	intelppm - ok
20:13:37.0515 1428	Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
20:13:37.0734 1428	Ip6Fw - ok
20:13:37.0750 1428	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:13:37.0921 1428	IpFilterDriver - ok
20:13:37.0937 1428	IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:13:38.0125 1428	IpInIp - ok
20:13:38.0296 1428	IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:13:38.0500 1428	IpNat - ok
20:13:38.0609 1428	iPod Service    (ca9d4b998bff311a539604ed87318fa0) C:\Programme\iPod\bin\iPodService.exe
20:13:38.0671 1428	iPod Service - ok
20:13:38.0718 1428	IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:13:38.0968 1428	IPSec - ok
20:13:39.0000 1428	IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:13:39.0156 1428	IRENUM - ok
20:13:39.0187 1428	isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:13:39.0375 1428	isapnp - ok
20:13:39.0468 1428	JavaQuickStarterService (5e06a9d23727daf96faa796f1135fdcd) C:\Programme\Java\jre6\bin\jqs.exe
20:13:39.0484 1428	JavaQuickStarterService - ok
20:13:39.0515 1428	Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:13:39.0734 1428	Kbdclass - ok
20:13:39.0796 1428	kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
20:13:39.0984 1428	kmixer - ok
20:13:40.0031 1428	KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
20:13:40.0171 1428	KSecDD - ok
20:13:40.0234 1428	Ktp             (85b6d85c044e3df77e92b5a7b265008f) C:\WINDOWS\system32\DRIVERS\ETD.sys
20:13:40.0312 1428	Ktp - ok
20:13:40.0343 1428	L1e             (fa46f5d09edf93e0c71fe6500fe3f4ae) C:\WINDOWS\system32\DRIVERS\l1e51x86.sys
20:13:40.0359 1428	L1e - ok
20:13:40.0421 1428	LanmanServer    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
20:13:40.0515 1428	LanmanServer - ok
20:13:40.0562 1428	lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
20:13:40.0656 1428	lanmanworkstation - ok
20:13:40.0781 1428	Lavasoft Ad-Aware Service (335b35f436d6801a4910afbde5aa6a16) C:\Programme\Lavasoft\Ad-Aware\AAWService.exe
20:13:40.0890 1428	Lavasoft Ad-Aware Service - ok
20:13:40.0921 1428	Lbd             (419590ebe7855215bb157ea0cf0d0531) C:\WINDOWS\system32\DRIVERS\Lbd.sys
20:13:40.0968 1428	Lbd - ok
20:13:40.0968 1428	lbrtfdc - ok
20:13:41.0109 1428	LightScribeService (abf90fc5a127f481219b873c1b8dfc1c) C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
20:13:41.0125 1428	LightScribeService ( UnsignedFile.Multi.Generic ) - warning
20:13:41.0125 1428	LightScribeService - detected UnsignedFile.Multi.Generic (1)
20:13:41.0171 1428	LmHosts         (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
20:13:41.0421 1428	LmHosts - ok
20:13:41.0437 1428	MBAMProtector   (fb097bbc1a18f044bd17bd2fccf97865) C:\WINDOWS\system32\drivers\mbam.sys
20:13:41.0468 1428	MBAMProtector - ok
20:13:41.0546 1428	MBAMService     (ba400ed640bca1eae5c727ae17c10207) C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
20:13:41.0593 1428	MBAMService - ok
20:13:41.0625 1428	Messenger       (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
20:13:41.0828 1428	Messenger - ok
20:13:41.0859 1428	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:13:42.0031 1428	mnmdd - ok
20:13:42.0093 1428	mnmsrvc         (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
20:13:42.0281 1428	mnmsrvc - ok
20:13:42.0312 1428	Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
20:13:42.0531 1428	Modem - ok
20:13:42.0625 1428	Monfilt         (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys
20:13:42.0765 1428	Monfilt - ok
20:13:42.0812 1428	Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:13:43.0000 1428	Mouclass - ok
20:13:43.0078 1428	mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:13:43.0281 1428	mouhid - ok
20:13:43.0296 1428	MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
20:13:43.0500 1428	MountMgr - ok
20:13:43.0500 1428	mraid35x - ok
20:13:43.0546 1428	MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:13:43.0734 1428	MRxDAV - ok
20:13:43.0796 1428	MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:13:43.0906 1428	MRxSmb - ok
20:13:43.0937 1428	MSDTC           (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
20:13:44.0125 1428	MSDTC - ok
20:13:44.0171 1428	Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
20:13:44.0406 1428	Msfs - ok
20:13:44.0406 1428	MSIServer - ok
20:13:44.0468 1428	MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:13:44.0671 1428	MSKSSRV - ok
20:13:44.0687 1428	MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:13:44.0859 1428	MSPCLOCK - ok
20:13:44.0906 1428	MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
20:13:45.0109 1428	MSPQM - ok
20:13:45.0140 1428	mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:13:45.0312 1428	mssmbios - ok
20:13:45.0343 1428	MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
20:13:45.0531 1428	MSTEE - ok
20:13:45.0578 1428	Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
20:13:45.0625 1428	Mup - ok
20:13:45.0656 1428	NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
20:13:45.0859 1428	NABTSFEC - ok
20:13:45.0921 1428	napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
20:13:46.0140 1428	napagent - ok
20:13:46.0296 1428	NBService       (b498a14133bd09ad0817590ace4470ad) C:\Eigene_Programme\Nero 7\Nero BackItUp\NBService.exe
20:13:46.0375 1428	NBService - ok
20:13:46.0437 1428	NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
20:13:46.0656 1428	NDIS - ok
20:13:46.0703 1428	NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
20:13:46.0937 1428	NdisIP - ok
20:13:46.0968 1428	NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:13:47.0015 1428	NdisTapi - ok
20:13:47.0062 1428	Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:13:47.0250 1428	Ndisuio - ok
20:13:47.0296 1428	NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:13:47.0484 1428	NdisWan - ok
20:13:47.0515 1428	NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
20:13:47.0609 1428	NDProxy - ok
20:13:47.0640 1428	NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
20:13:47.0828 1428	NetBIOS - ok
20:13:47.0875 1428	NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
20:13:48.0078 1428	NetBT - ok
20:13:48.0125 1428	NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:13:48.0312 1428	NetDDE - ok
20:13:48.0328 1428	NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:13:48.0515 1428	NetDDEdsdm - ok
20:13:48.0625 1428	Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:48.0796 1428	Netlogon - ok
20:13:48.0859 1428	Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
20:13:49.0062 1428	Netman - ok
20:13:49.0171 1428	NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
20:13:49.0250 1428	NetTcpPortSharing - ok
20:13:49.0312 1428	Nla             (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
20:13:49.0359 1428	Nla - ok
20:13:49.0484 1428	NMIndexingService (a328a46d87bb92ce4d8a4528e9d84787) C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
20:13:49.0500 1428	NMIndexingService - ok
20:13:49.0546 1428	Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
20:13:49.0734 1428	Npfs - ok
20:13:49.0765 1428	Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
20:13:50.0000 1428	Ntfs - ok
20:13:50.0031 1428	NtLmSsp         (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:50.0218 1428	NtLmSsp - ok
20:13:50.0250 1428	NtmsSvc         (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
20:13:50.0484 1428	NtmsSvc - ok
20:13:50.0500 1428	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:13:50.0687 1428	Null - ok
20:13:50.0703 1428	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:13:50.0890 1428	NwlnkFlt - ok
20:13:50.0906 1428	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:13:51.0093 1428	NwlnkFwd - ok
20:13:51.0218 1428	odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
20:13:51.0281 1428	odserv - ok
20:13:51.0328 1428	ose             (5a432a042dae460abe7199b758e8606c) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
20:13:51.0343 1428	ose - ok
20:13:51.0390 1428	Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
20:13:51.0578 1428	Parport - ok
20:13:51.0625 1428	PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
20:13:51.0843 1428	PartMgr - ok
20:13:51.0890 1428	ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
20:13:52.0078 1428	ParVdm - ok
20:13:52.0125 1428	PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
20:13:52.0312 1428	PCI - ok
20:13:52.0343 1428	PCIDump - ok
20:13:52.0343 1428	PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
20:13:52.0531 1428	PCIIde - ok
20:13:52.0562 1428	Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
20:13:52.0750 1428	Pcmcia - ok
20:13:52.0765 1428	PDCOMP - ok
20:13:52.0765 1428	PDFRAME - ok
20:13:52.0781 1428	PDRELI - ok
20:13:52.0781 1428	PDRFRAME - ok
20:13:52.0796 1428	perc2 - ok
20:13:52.0812 1428	perc2hib - ok
20:13:52.0875 1428	PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:13:52.0906 1428	PlugPlay - ok
20:13:52.0953 1428	PolicyAgent     (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:53.0125 1428	PolicyAgent - ok
20:13:53.0156 1428	PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:13:53.0343 1428	PptpMiniport - ok
20:13:53.0359 1428	ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:53.0531 1428	ProtectedStorage - ok
20:13:53.0546 1428	PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
20:13:53.0734 1428	PSched - ok
20:13:54.0000 1428	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:13:54.0203 1428	Ptilink - ok
20:13:54.0250 1428	PxHelp20        (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
20:13:54.0281 1428	PxHelp20 - ok
20:13:54.0281 1428	ql1080 - ok
20:13:54.0296 1428	Ql10wnt - ok
20:13:54.0312 1428	ql12160 - ok
20:13:54.0328 1428	ql1240 - ok
20:13:54.0343 1428	ql1280 - ok
20:13:54.0359 1428	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:13:54.0609 1428	RasAcd - ok
20:13:54.0625 1428	RasAuto         (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
20:13:54.0812 1428	RasAuto - ok
20:13:54.0828 1428	Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:13:55.0015 1428	Rasl2tp - ok
20:13:55.0046 1428	RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
20:13:55.0234 1428	RasMan - ok
20:13:55.0265 1428	RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:13:55.0468 1428	RasPppoe - ok
20:13:55.0484 1428	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
20:13:55.0656 1428	Raspti - ok
20:13:55.0718 1428	Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:13:55.0921 1428	Rdbss - ok
20:13:55.0953 1428	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:13:56.0156 1428	RDPCDD - ok
20:13:56.0218 1428	RDPWD           (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
20:13:56.0265 1428	RDPWD - ok
20:13:56.0328 1428	RDSessMgr       (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
20:13:56.0515 1428	RDSessMgr - ok
20:13:56.0562 1428	redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
20:13:56.0765 1428	redbook - ok
20:13:56.0796 1428	RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
20:13:57.0015 1428	RemoteAccess - ok
20:13:57.0062 1428	RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
20:13:57.0265 1428	RpcLocator - ok
20:13:57.0328 1428	RpcSs           (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
20:13:57.0375 1428	RpcSs - ok
20:13:57.0421 1428	RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
20:13:57.0593 1428	RSVP - ok
20:13:57.0671 1428	RT80x86         (f591f71883424f5b31e3348ea4454466) C:\WINDOWS\system32\DRIVERS\RT2860.sys
20:13:57.0796 1428	RT80x86 - ok
20:13:57.0843 1428	SamSs           (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:58.0031 1428	SamSs - ok
20:13:58.0078 1428	SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
20:13:58.0328 1428	SCardSvr - ok
20:13:58.0359 1428	Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
20:13:58.0546 1428	Schedule - ok
20:13:58.0593 1428	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:13:58.0671 1428	Secdrv - ok
20:13:58.0718 1428	seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
20:13:58.0906 1428	seclogon - ok
20:13:58.0937 1428	SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
20:13:59.0109 1428	SENS - ok
20:13:59.0140 1428	Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
20:13:59.0328 1428	Serial - ok
20:13:59.0359 1428	Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
20:13:59.0546 1428	Sfloppy - ok
20:13:59.0593 1428	SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
20:13:59.0781 1428	SharedAccess - ok
20:13:59.0812 1428	ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:13:59.0843 1428	ShellHWDetection - ok
20:13:59.0859 1428	Simbad - ok
20:13:59.0906 1428	SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
20:14:00.0078 1428	SLIP - ok
20:14:00.0234 1428	SNP2UVC         (060f51141b20b8156804446a04ab8b2a) C:\WINDOWS\system32\DRIVERS\snp2uvc.sys
20:14:00.0437 1428	SNP2UVC - ok
20:14:00.0546 1428	Sparrow - ok
20:14:00.0593 1428	splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
20:14:00.0843 1428	splitter - ok
20:14:00.0890 1428	Spooler         (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
20:14:00.0953 1428	Spooler - ok
20:14:01.0031 1428	sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
20:14:01.0140 1428	sr - ok
20:14:01.0156 1428	srservice       (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
20:14:01.0250 1428	srservice - ok
20:14:01.0312 1428	Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
20:14:01.0406 1428	Srv - ok
20:14:01.0437 1428	SSDPSRV         (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
20:14:01.0531 1428	SSDPSRV - ok
20:14:01.0609 1428	ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
20:14:01.0625 1428	ssmdrv - ok
20:14:01.0687 1428	stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
20:14:01.0890 1428	stisvc - ok
20:14:01.0937 1428	streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
20:14:02.0156 1428	streamip - ok
20:14:02.0203 1428	swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:14:02.0390 1428	swenum - ok
20:14:02.0437 1428	swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
20:14:02.0609 1428	swmidi - ok
20:14:02.0625 1428	SwPrv - ok
20:14:02.0625 1428	symc810 - ok
20:14:02.0640 1428	symc8xx - ok
20:14:02.0640 1428	sym_hi - ok
20:14:02.0656 1428	sym_u3 - ok
20:14:02.0703 1428	sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
20:14:02.0906 1428	sysaudio - ok
20:14:02.0953 1428	SysmonLog       (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
20:14:03.0140 1428	SysmonLog - ok
20:14:03.0203 1428	TapiSrv         (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
20:14:03.0390 1428	TapiSrv - ok
20:14:03.0437 1428	Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:14:03.0484 1428	Tcpip - ok
20:14:03.0531 1428	TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:14:03.0718 1428	TDPIPE - ok
20:14:03.0734 1428	TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
20:14:03.0921 1428	TDTCP - ok
20:14:03.0968 1428	TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
20:14:04.0156 1428	TermDD - ok
20:14:04.0234 1428	TermService     (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
20:14:04.0421 1428	TermService - ok
20:14:04.0468 1428	Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:14:04.0500 1428	Themes - ok
20:14:04.0500 1428	TosIde - ok
20:14:04.0546 1428	TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
20:14:04.0750 1428	TrkWks - ok
20:14:04.0796 1428	Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
20:14:04.0968 1428	Udfs - ok
20:14:04.0984 1428	ultra - ok
20:14:05.0062 1428	Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
20:14:05.0281 1428	Update - ok
20:14:05.0328 1428	upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
20:14:05.0421 1428	upnphost - ok
20:14:05.0437 1428	UPS             (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
20:14:05.0625 1428	UPS - ok
20:14:05.0671 1428	USBAAPL         (d4fb6ecc60a428564ba8768b0e23c0fc) C:\WINDOWS\system32\Drivers\usbaapl.sys
20:14:05.0734 1428	USBAAPL - ok
20:14:05.0781 1428	usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:14:05.0953 1428	usbccgp - ok
20:14:06.0015 1428	usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:14:06.0203 1428	usbehci - ok
20:14:06.0234 1428	usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:14:06.0406 1428	usbhub - ok
20:14:06.0453 1428	usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
20:14:06.0640 1428	usbprint - ok
20:14:06.0671 1428	usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
20:14:06.0859 1428	usbscan - ok
20:14:06.0875 1428	usbstor         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:14:07.0062 1428	usbstor - ok
20:14:07.0078 1428	usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
20:14:07.0250 1428	usbuhci - ok
20:14:07.0296 1428	usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
20:14:07.0484 1428	usbvideo - ok
20:14:07.0515 1428	VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
20:14:07.0703 1428	VgaSave - ok
20:14:07.0718 1428	ViaIde - ok
20:14:07.0765 1428	VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
20:14:07.0937 1428	VolSnap - ok
20:14:08.0000 1428	VSS             (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
20:14:08.0125 1428	VSS - ok
20:14:08.0171 1428	W32Time         (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
20:14:08.0343 1428	W32Time - ok
20:14:08.0390 1428	Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:14:08.0593 1428	Wanarp - ok
20:14:08.0593 1428	WDICA - ok
20:14:08.0625 1428	wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
20:14:08.0796 1428	wdmaud - ok
20:14:08.0843 1428	WebClient       (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
20:14:09.0031 1428	WebClient - ok
20:14:09.0156 1428	winmgmt         (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
20:14:09.0343 1428	winmgmt - ok
20:14:09.0406 1428	WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
20:14:09.0453 1428	WmdmPmSN - ok
20:14:09.0484 1428	WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
20:14:09.0671 1428	WmiApSrv - ok
20:14:09.0828 1428	WMPNetworkSvc   (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
20:14:09.0937 1428	WMPNetworkSvc - ok
20:14:10.0015 1428	WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
20:14:10.0046 1428	WpdUsb - ok
20:14:10.0265 1428	WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
20:14:10.0359 1428	WPFFontCache_v0400 - ok
20:14:10.0406 1428	wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
20:14:10.0671 1428	wscsvc - ok
20:14:10.0718 1428	WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
20:14:10.0890 1428	WSTCODEC - ok
20:14:10.0953 1428	wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
20:14:11.0140 1428	wuauserv - ok
20:14:11.0171 1428	WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
20:14:11.0265 1428	WudfPf - ok
20:14:11.0296 1428	WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
20:14:11.0328 1428	WudfRd - ok
20:14:11.0343 1428	WudfSvc         (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
20:14:11.0390 1428	WudfSvc - ok
20:14:11.0453 1428	WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
20:14:11.0671 1428	WZCSVC - ok
20:14:11.0703 1428	xmlprov         (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
20:14:11.0953 1428	xmlprov - ok
20:14:12.0000 1428	MBR (0x1B8)     (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
20:14:13.0171 1428	\Device\Harddisk0\DR0 - ok
20:14:13.0187 1428	MBR (0x1B8)     (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR5
20:14:13.0453 1428	\Device\Harddisk1\DR5 - ok
20:14:13.0453 1428	Boot (0x1200)   (cee99027cea77554252948d92431fe00) \Device\Harddisk0\DR0\Partition0
20:14:13.0468 1428	\Device\Harddisk0\DR0\Partition0 - ok
20:14:13.0500 1428	Boot (0x1200)   (48f7c22ed3ff089f54c572302c6ba6e3) \Device\Harddisk0\DR0\Partition1
20:14:13.0500 1428	\Device\Harddisk0\DR0\Partition1 - ok
20:14:13.0515 1428	Boot (0x1200)   (3d13054bcc387d3ad95f6ba4dc9b1ad2) \Device\Harddisk1\DR5\Partition0
20:14:13.0515 1428	\Device\Harddisk1\DR5\Partition0 - ok
20:14:13.0515 1428	============================================================
20:14:13.0515 1428	Scan finished
20:14:13.0515 1428	============================================================
20:14:13.0640 3140	Detected object count: 1
20:14:13.0640 3140	Actual detected object count: 1
20:14:32.0250 3140	LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
20:14:32.0250 3140	LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip

Viele Grüße

cosinus · 31.05.2012, 20:04

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Bremser · 31.05.2012, 20:54

Hallo Arne

So, nun COMBOFIX ausgeführt.
Anbei das Log

Combofix Logfile:

Code:

ATTFilter

ComboFix 12-05-31.02 - Admin 31.05.2012  21:27:57.1.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.2039.1220 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Admin\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\1.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\a.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\b.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\c.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\d.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\e.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\f.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\g.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\h.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\i.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\J.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\k.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\l.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\m.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\mru.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\n.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\o.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\p.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\q.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\r.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\s.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\t.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\u.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\v.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\w.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\x.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\y.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\z.xml
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-04-28 bis 2012-05-31  ))))))))))))))))))))))))))))))
.
.
2012-05-29 18:42 . 2012-05-30 18:07    --------    d-----w-    C:\_OTL
2012-05-22 17:34 . 2012-05-22 17:34    --------    d-----w-    c:\programme\ESET
2012-05-21 18:12 . 2012-05-21 18:12    --------    d-----w-    c:\dokumente und einstellungen\Admin\Anwendungsdaten\Malwarebytes
2012-05-21 18:12 . 2012-05-21 18:12    --------    d-----w-    c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-05-21 18:12 . 2012-05-21 18:12    --------    d-----w-    c:\programme\Malwarebytes' Anti-Malware
2012-05-21 18:12 . 2012-04-04 13:56    22344    ----a-w-    c:\windows\system32\drivers\mbam.sys
2012-05-21 05:17 . 2012-05-21 05:17    --------    d-----w-    c:\programme\Uncompressor
2012-05-20 17:03 . 2012-05-20 17:03    --------    d--h--w-    c:\windows\PIF
2012-05-18 20:58 . 2012-05-18 20:58    --------    d-sh--w-    c:\dokumente und einstellungen\Stefanie\PrivacIE
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-08 19:27 . 2011-10-23 19:26    83392    ----a-w-    c:\windows\system32\drivers\avgntflt.sys
2012-05-08 19:27 . 2011-10-23 19:26    137928    ----a-w-    c:\windows\system32\drivers\avipbb.sys
2012-04-11 13:51 . 2008-04-14 07:30    2029056    ----a-w-    c:\windows\system32\ntkrnlpa.exe
2012-04-11 13:51 . 2010-03-02 07:58    1862400    ----a-w-    c:\windows\system32\win32k.sys
2012-04-11 13:51 . 2008-04-14 07:29    2150912    ----a-w-    c:\windows\system32\ntoskrnl.exe
2008-05-07 08:34 . 2009-03-02 08:49    15523560    ----a-w-    c:\programme\U1 Setup.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayIconExtension1]
@="{fe25455d-b4c2-4e32-97d2-92632ec1c224}"
[HKEY_CLASSES_ROOT\CLSID\{fe25455d-b4c2-4e32-97d2-92632ec1c224}]
2009-11-06 23:07    297808    ----a-w-    c:\windows\system32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayIconExtension2]
@="{1fae2d88-a78e-4f03-909f-be818a3c1ce6}"
[HKEY_CLASSES_ROOT\CLSID\{1fae2d88-a78e-4f03-909f-be818a3c1ce6}]
2009-11-06 23:07    297808    ----a-w-    c:\windows\system32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"ETDWare"="c:\programme\Elantech\ETDCtrl.exe" [2009-01-23 416768]
"AsusTray"="c:\programme\EeePC\ACPI\AsTray.exe" [2008-12-04 114688]
"AsusACPIServer"="c:\programme\EeePC\ACPI\AsAcpiSvr.exe" [2008-12-17 622592]
"AsusEPCMonitor"="c:\programme\EeePC\ACPI\AsEPCMon.exe" [2008-05-21 94208]
"NeroFilterCheck"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SecurDisc"="c:\eigene_programme\Nero 7\InCD\NBHGui.exe" [2007-06-25 1629480]
"InCD"="c:\eigene_programme\Nero 7\InCD\InCD.exe" [2007-06-25 1057064]
"Ad-Watch"="c:\programme\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-25 518488]
"CanonSolutionMenu"="c:\programme\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]
"CanonMyPrinter"="c:\programme\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]
"QuickTime Task"="c:\eigene_programme\Quicktime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\eigene_programme\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-10-29 249064]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-13 17508864]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\Wolfgang\Startmenü\Programme\Autostart\
k8h00.exe.lnk - c:\windows\system32\rundll32.exe [2010-3-2 33792]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\programme\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\dokumente und einstellungen\Admin\Startmenü\Programme\Autostart\
ac'tivAid.lnk - c:\eigene_programme\ActivAid\ac'tivAid.ahk [2008-6-5 495612]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\programme\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
Printkey2000.lnk - c:\eigene_programme\PrintKey2000\Printkey2000.exe [2009-5-22 794112]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programme\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Programme\\Avira\\AntiVir Desktop\\avcenter.exe"=
"c:\\Eigene_Programme\\Rsync\\rsync.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Eigene_Programme\\iTunes\\iTunes.exe"=
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [25.06.2009 20:29 64160]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [23.10.2011 21:26 36000]
R2 AAV UpdateService;AAV UpdateService;c:\eigene_programme\Steuertipps\Steuer-Spar-Erklaerung 2012\AAVUpdateManager\aavus.exe [24.10.2008 17:35 128296]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [23.10.2011 21:26 86224]
R2 BBUpdate;BBUpdate;c:\programme\Microsoft\BingBar\SeaPort.EXE [13.10.2011 18:21 249648]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\programme\Lavasoft\Ad-Aware\AAWService.exe [09.03.2009 21:06 1003344]
R2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [21.05.2012 20:12 654408]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [21.05.2012 20:12 22344]
R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [02.03.2009 10:44 704384]
S2 BBSvc;Bing Bar Update Service;c:\programme\Microsoft\BingBar\BBSvc.EXE [21.10.2011 16:23 196176]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 13:16 130384]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [02.03.2009 10:42 1684736]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 13:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 08:14    451872    ----a-w-    c:\programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2012-05-28 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 18:28]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = 
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Senden an &Bluetooth-Gerät... - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Senden an Bluetooth - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
AddRemove-BabylonToolbar - c:\programme\BabylonToolbar\BabylonToolbar\1.5.3.17\uninstall.exe
AddRemove-Winamp - c:\programme\Winamp\UninstWA.exe
AddRemove-Youtube Downloader HD_is1 - c:\eigene_programme\Youtube_downloader_HD\Youtube Downloader HD\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-05-31 21:37
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-05-31  21:40:05
ComboFix-quarantined-files.txt  2012-05-31 19:40
.
Vor Suchlauf: 7 Verzeichnis(se), 30.051.483.648 Bytes frei
Nach Suchlauf: 9 Verzeichnis(se), 32.209.793.024 Bytes frei
.
WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 0A74A938002FEDAD38FDABF9F23E09DA

--- --- ---

Viele Grüße und vielen Dank

23.05.2012, 09:41	#4
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Gesperrtes Windows und Zahlungsaufforderung Hätte da mal zwei Fragen bevor es weiter geht 1.) Geht der normale Modus uneingeschränkt? 2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden? __________________ Logfiles bitte immer in CODE-Tags posten

30.05.2012, 10:12	#10
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Gesperrtes Windows und Zahlungsaufforderung Wiederhol den Fix im abgesicherten Modus bitte __________________ Logfiles bitte immer in CODE-Tags posten

Gesperrtes Windows und Zahlungsaufforderung

Plagegeister aller Art und deren Bekämpfung: Gesperrtes Windows und Zahlungsaufforderung