Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
DRV - (SYMIDSCO) -- C:\PROGRA~1\GEMEIN~1\SYMANT~1\SymcData\IDS-DI~1\20070709.002\symidsco.sys File not found
FF - user.js - File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-1394577478-1094693981-2114805246-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

->Temporary Internet Files folder emptied: 2311303 bytes
->Flash cache emptied: 15202 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 21547232 bytes
 
User: xx1
->Temp folder emptied: 522927175 bytes
->Temporary Internet Files folder emptied: 794186710 bytes
->Java cache emptied: 25534377 bytes
->FireFox cache emptied: 42858769 bytes
->Flash cache emptied: 5679 bytes
 
User: temp
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2134333 bytes
%systemroot%\System32 .tmp files removed: 5826783 bytes
%systemroot%\System32\dllcache .tmp files removed: 11690496 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 534385431 bytes
RecycleBin emptied: 15616638 bytes
 
Total Files Cleaned = 2'126.00 mb
 
 
[EMPTYFLASH]
 
User: Administrator
 
User: All Users
 
User: Default User
 
User: xx
->Flash cache emptied: 0 bytes
 
User: LocalService
->Flash cache emptied: 0 bytes
 
User: NetworkService
 
User: xx1
->Flash cache emptied: 0 bytes
 
User: temp
 
Total Flash Files Cleaned = 0.00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.59.1 log created on 09022012_162855

Files\Folders moved on Reboot...
File\Folder C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temp\~DFEBA5.tmp not found!
File\Folder C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temp\~DFEBB9.tmp not found!
File\Folder C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temp\~DFED88.tmp not found!
File\Folder C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temp\~DFEF50.tmp not found!
File\Folder C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temp\~DFF177.tmp not found!
File\Folder C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temp\~DFF1FC.tmp not found!
C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temporary Internet Files\Content.IE5\WTOH5X9H\ads[1].htm moved successfully.
C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temporary Internet Files\Content.IE5\QGWHOS1D\ads[9].htm moved successfully.
C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Q40B2568\122251-weisser-bildschirm-meldung-pc-gesperrt-2[1].html moved successfully.
C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temporary Internet Files\Content.IE5\5IE33M8I\ads[8].htm moved successfully.
C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

Log ist leider unvollständig

Tut mir leid, jetzt ist alles vom Log file kopiert.

All processes killed
========== OTL ==========
Service SYMIDSCO stopped successfully!
Service SYMIDSCO deleted successfully!
File  C:\PROGRA~1\GEMEIN~1\SYMANT~1\SymcData\IDS-DI~1\20070709.002\symidsco.sys File not found not found.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoControlPanel deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1394577478-1094693981-2114805246-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Auflösungscache wurde geleert.
C:\OTL\cmd.bat deleted successfully.
C:\OTL\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 289480 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: All Users
 
User: Default User
->Temporary Internet Files folder emptied: 33170 bytes
 
User: xx
->Temp folder emptied: 31076289 bytes
->Temporary Internet Files folder emptied: 64306942 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 154840715 bytes
->Flash cache emptied: 1819 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 2311303 bytes
->Flash cache emptied: 15202 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 21547232 bytes
 
User: xx1
->Temp folder emptied: 522927175 bytes
->Temporary Internet Files folder emptied: 794186710 bytes
->Java cache emptied: 25534377 bytes
->FireFox cache emptied: 42858769 bytes
->Flash cache emptied: 5679 bytes
 
User: temp
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2134333 bytes
%systemroot%\System32 .tmp files removed: 5826783 bytes
%systemroot%\System32\dllcache .tmp files removed: 11690496 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 534385431 bytes
RecycleBin emptied: 15616638 bytes
 
Total Files Cleaned = 2'126.00 mb
 
 
[EMPTYFLASH]
 
User: Administrator
 
User: All Users
 
User: Default User
 
User: xx
->Flash cache emptied: 0 bytes
 
User: LocalService
->Flash cache emptied: 0 bytes
 
User: NetworkService
 
User: xx1
->Flash cache emptied: 0 bytes
 
User: temp
 
Total Flash Files Cleaned = 0.00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.59.1 log created on 09022012_162855

Files\Folders moved on Reboot...
File\Folder C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temp\~DFEBA5.tmp not found!
File\Folder C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temp\~DFEBB9.tmp not found!
File\Folder C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temp\~DFED88.tmp not found!
File\Folder C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temp\~DFEF50.tmp not found!
File\Folder C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temp\~DFF177.tmp not found!
File\Folder C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temp\~DFF1FC.tmp not found!
C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temporary Internet Files\Content.IE5\WTOH5X9H\ads[1].htm moved successfully.
C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temporary Internet Files\Content.IE5\QGWHOS1D\ads[9].htm moved successfully.
C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Q40B2568\122251-weisser-bildschirm-meldung-pc-gesperrt-2[1].html moved successfully.
C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temporary Internet Files\Content.IE5\5IE33M8I\ads[8].htm moved successfully.
C:\Dokumente und Einstellungen\xx\Lokale Einstellungen\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

17:22:59.0990 2168  TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
17:23:01.0475 2168  ============================================================
17:23:01.0475 2168  Current date / time: 2012/09/04 17:23:01.0475
17:23:01.0475 2168  SystemInfo:
17:23:01.0475 2168  
17:23:01.0475 2168  OS Version: 5.1.2600 ServicePack: 3.0
17:23:01.0475 2168  Product type: Workstation
17:23:01.0475 2168  ComputerName: xx
17:23:01.0475 2168  UserName: xx
17:23:01.0475 2168  Windows directory: C:\WINDOWS
17:23:01.0475 2168  System windows directory: C:\WINDOWS
17:23:01.0475 2168  Processor architecture: Intel x86
17:23:01.0475 2168  Number of processors: 2
17:23:01.0475 2168  Page size: 0x1000
17:23:01.0475 2168  Boot type: Normal boot
17:23:01.0475 2168  ============================================================
17:23:04.0178 2168  Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
17:23:04.0209 2168  ============================================================
17:23:04.0209 2168  \Device\Harddisk0\DR0:
17:23:04.0209 2168  MBR partitions:
17:23:04.0209 2168  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x950A5C1
17:23:04.0209 2168  ============================================================
17:23:04.0225 2168  C: <-> \Device\Harddisk0\DR0\Partition1
17:23:04.0225 2168  ============================================================
17:23:04.0225 2168  Initialize success
17:23:04.0225 2168  ============================================================
17:25:26.0084 6012  ============================================================
17:25:26.0100 6012  Scan started
17:25:26.0100 6012  Mode: Manual; SigCheck; TDLFS; 
17:25:26.0100 6012  ============================================================
17:25:26.0756 6012  ================ Scan services =============================
17:25:26.0912 6012  Abiosdsk - ok
17:25:26.0928 6012  abp480n5 - ok
17:25:26.0959 6012  [ 0F2D66D5F08EBE2F77BB904288DCF6F0 ] ac97intc        C:\WINDOWS\system32\drivers\ac97intc.sys
17:25:27.0490 6012  ac97intc - ok
17:25:27.0522 6012  [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI            C:\WINDOWS\system32\DRIVERS\ACPI.sys
17:25:27.0787 6012  ACPI - ok
17:25:27.0818 6012  [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC          C:\WINDOWS\system32\drivers\ACPIEC.sys
17:25:27.0959 6012  ACPIEC - ok
17:25:27.0990 6012  [ 9A11864873DA202C996558B2106B0BBC ] adpu160m        C:\WINDOWS\system32\DRIVERS\adpu160m.sys
17:25:28.0131 6012  adpu160m - ok
17:25:28.0162 6012  [ 0EA9B1F0C6C90A509C8603775366ADB7 ] adpu320         C:\WINDOWS\system32\DRIVERS\adpu320.sys
17:25:28.0193 6012  adpu320 ( UnsignedFile.Multi.Generic ) - warning
17:25:28.0193 6012  adpu320 - detected UnsignedFile.Multi.Generic (1)
17:25:28.0209 6012  [ 8BED39E3C35D6A489438B8141717A557 ] aec             C:\WINDOWS\system32\drivers\aec.sys
17:25:28.0381 6012  aec - ok
17:25:28.0412 6012  [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD             C:\WINDOWS\System32\drivers\afd.sys
17:25:28.0490 6012  AFD - ok
17:25:28.0490 6012  Aha154x - ok
17:25:28.0522 6012  [ 19DD0FB48B0C18892F70E2E7D61A1529 ] aic78u2         C:\WINDOWS\system32\DRIVERS\aic78u2.sys
17:25:28.0662 6012  aic78u2 - ok
17:25:28.0678 6012  [ B7FE594A7468AA0132DEB03FB8E34326 ] aic78xx         C:\WINDOWS\system32\DRIVERS\aic78xx.sys
17:25:28.0834 6012  aic78xx - ok
17:25:28.0881 6012  [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter         C:\WINDOWS\system32\alrsvc.dll
17:25:29.0053 6012  Alerter - ok
17:25:29.0084 6012  [ 190CD73D4984F94D823F9444980513E5 ] ALG             C:\WINDOWS\System32\alg.exe
17:25:29.0240 6012  ALG - ok
17:25:29.0240 6012  AliIde - ok
17:25:29.0240 6012  amsint - ok
17:25:29.0381 6012  [ 7EF47644B74EBE721CC32211D3C35E76 ] Apple Mobile Device C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
17:25:29.0397 6012  Apple Mobile Device - ok
17:25:29.0443 6012  [ D45960BE52C3C610D361977057F98C54 ] AppMgmt         C:\WINDOWS\System32\appmgmts.dll
17:25:29.0615 6012  AppMgmt - ok
17:25:29.0631 6012  asc - ok
17:25:29.0631 6012  asc3350p - ok
17:25:29.0631 6012  asc3550 - ok
17:25:29.0756 6012  [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
17:25:29.0818 6012  aspnet_state - ok
17:25:29.0850 6012  [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac        C:\WINDOWS\system32\DRIVERS\asyncmac.sys
17:25:30.0022 6012  AsyncMac - ok
17:25:30.0053 6012  [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi           C:\WINDOWS\system32\DRIVERS\atapi.sys
17:25:30.0240 6012  atapi - ok
17:25:30.0240 6012  Atdisk - ok
17:25:30.0272 6012  [ 9916C1225104BA14794209CFA8012159 ] Atmarpc         C:\WINDOWS\system32\DRIVERS\atmarpc.sys
17:25:30.0428 6012  Atmarpc - ok
17:25:30.0475 6012  [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv        C:\WINDOWS\System32\audiosrv.dll
17:25:30.0647 6012  AudioSrv - ok
17:25:30.0678 6012  [ D9F724AA26C010A217C97606B160ED68 ] audstub         C:\WINDOWS\system32\DRIVERS\audstub.sys
17:25:30.0818 6012  audstub - ok
17:25:30.0865 6012  [ 48BF91CFFBCDD12A710207F2A08FEC4D ] b57w2k          C:\WINDOWS\system32\DRIVERS\b57xp32.sys
17:25:30.0912 6012  b57w2k - ok
17:25:30.0928 6012  [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep            C:\WINDOWS\system32\drivers\Beep.sys
17:25:31.0084 6012  Beep - ok
17:25:31.0131 6012  [ D6F603772A789BB3228F310D650B8BD1 ] BITS            C:\WINDOWS\system32\qmgr.dll
17:25:31.0318 6012  BITS - ok
17:25:31.0350 6012  [ 7F72473390FEEE312A66AF045C8EF0F6 ] Blfp            C:\WINDOWS\system32\DRIVERS\baspxp32.sys
17:25:31.0443 6012  Blfp - ok
17:25:31.0506 6012  [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Programme\Bonjour\mDNSResponder.exe
17:25:31.0553 6012  Bonjour Service - ok
17:25:31.0600 6012  [ B71549F23736ADF83A571061C47777FD ] Browser         C:\WINDOWS\System32\browser.dll
17:25:31.0678 6012  Browser - ok
17:25:31.0693 6012  [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k         C:\WINDOWS\system32\drivers\cbidf2k.sys
17:25:31.0850 6012  cbidf2k - ok
17:25:31.0865 6012  cd20xrnt - ok
17:25:31.0881 6012  [ C1B486A7658353D33A10CC15211A873B ] Cdaudio         C:\WINDOWS\system32\drivers\Cdaudio.sys
17:25:32.0053 6012  Cdaudio - ok
17:25:32.0053 6012  [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs            C:\WINDOWS\system32\drivers\Cdfs.sys
17:25:32.0225 6012  Cdfs - ok
17:25:32.0240 6012  [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom           C:\WINDOWS\system32\DRIVERS\cdrom.sys
17:25:32.0428 6012  Cdrom - ok
17:25:32.0443 6012  [ 1C7B1E36F3CED9E4B0B13385E627FE8B ] cfwids          C:\WINDOWS\system32\drivers\cfwids.sys
17:25:32.0490 6012  cfwids - ok
17:25:32.0506 6012  Changer - ok
17:25:32.0537 6012  [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc           C:\WINDOWS\system32\cisvc.exe
17:25:32.0709 6012  CiSvc - ok
17:25:32.0740 6012  [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv         C:\WINDOWS\system32\clipsrv.exe
17:25:32.0912 6012  ClipSrv - ok
17:25:32.0959 6012  [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
17:25:33.0131 6012  clr_optimization_v2.0.50727_32 - ok
17:25:33.0147 6012  CmdIde - ok
17:25:33.0147 6012  COMSysApp - ok
17:25:33.0162 6012  Cpqarray - ok
17:25:33.0178 6012  [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc        C:\WINDOWS\System32\cryptsvc.dll
17:25:33.0412 6012  CryptSvc - ok
17:25:33.0412 6012  dac2w2k - ok
17:25:33.0412 6012  dac960nt - ok
17:25:33.0459 6012  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch      C:\WINDOWS\system32\rpcss.dll
17:25:33.0553 6012  DcomLaunch - ok
17:25:33.0584 6012  [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp            C:\WINDOWS\System32\dhcpcsvc.dll
17:25:33.0756 6012  Dhcp - ok
17:25:33.0787 6012  [ 044452051F3E02E7963599FC8F4F3E25 ] Disk            C:\WINDOWS\system32\DRIVERS\disk.sys
17:25:33.0959 6012  Disk - ok
17:25:33.0959 6012  dmadmin - ok
17:25:34.0022 6012  [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot          C:\WINDOWS\system32\drivers\dmboot.sys
17:25:34.0240 6012  dmboot - ok
17:25:34.0272 6012  [ 53720AB12B48719D00E327DA470A619A ] dmio            C:\WINDOWS\system32\drivers\dmio.sys
17:25:34.0443 6012  dmio - ok
17:25:34.0459 6012  [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload          C:\WINDOWS\system32\drivers\dmload.sys
17:25:34.0615 6012  dmload - ok
17:25:34.0647 6012  [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver        C:\WINDOWS\System32\dmserver.dll
17:25:34.0818 6012  dmserver - ok
17:25:34.0865 6012  [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic          C:\WINDOWS\system32\drivers\DMusic.sys
17:25:35.0022 6012  DMusic - ok
17:25:35.0068 6012  [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache        C:\WINDOWS\System32\dnsrslvr.dll
17:25:35.0147 6012  Dnscache - ok
17:25:35.0178 6012  [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc         C:\WINDOWS\System32\dot3svc.dll
17:25:35.0334 6012  Dot3svc - ok
17:25:35.0350 6012  [ 40F3B93B4E5B0126F2F5C0A7A5E22660 ] dpti2o          C:\WINDOWS\system32\DRIVERS\dpti2o.sys
17:25:35.0490 6012  dpti2o - ok
17:25:35.0537 6012  [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud         C:\WINDOWS\system32\drivers\drmkaud.sys
17:25:35.0725 6012  drmkaud - ok
17:25:35.0756 6012  [ A6DE5342417FEC3C0AA8EFEBB899C431 ] E100B           C:\WINDOWS\system32\DRIVERS\e100b325.sys
17:25:35.0912 6012  E100B - ok
17:25:35.0943 6012  [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost         C:\WINDOWS\System32\eapsvc.dll
17:25:36.0115 6012  EapHost - ok
17:25:36.0147 6012  [ 877C18558D70587AA7823A1A308AC96B ] ERSvc           C:\WINDOWS\System32\ersvc.dll
17:25:36.0303 6012  ERSvc - ok
17:25:36.0334 6012  [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog        C:\WINDOWS\system32\services.exe
17:25:36.0428 6012  Eventlog - ok
17:25:36.0475 6012  [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem     C:\WINDOWS\system32\es.dll
17:25:36.0553 6012  EventSystem - ok
17:25:36.0584 6012  [ 38D332A6D56AF32635675F132548343E ] Fastfat         C:\WINDOWS\system32\drivers\Fastfat.sys
17:25:36.0740 6012  Fastfat - ok
17:25:36.0772 6012  [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
17:25:36.0850 6012  FastUserSwitchingCompatibility - ok
17:25:36.0881 6012  [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc             C:\WINDOWS\system32\DRIVERS\fdc.sys
17:25:37.0053 6012  Fdc - ok
17:25:37.0084 6012  [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips            C:\WINDOWS\system32\drivers\Fips.sys
17:25:37.0256 6012  Fips - ok
17:25:37.0287 6012  [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk        C:\WINDOWS\system32\DRIVERS\flpydisk.sys
17:25:37.0459 6012  Flpydisk - ok
17:25:37.0490 6012  [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr          C:\WINDOWS\system32\drivers\fltmgr.sys
17:25:37.0662 6012  FltMgr - ok
17:25:37.0740 6012  [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
17:25:37.0756 6012  FontCache3.0.0.0 - ok
17:25:37.0803 6012  [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec          C:\WINDOWS\system32\drivers\Fs_Rec.sys
17:25:37.0975 6012  Fs_Rec - ok
17:25:37.0990 6012  [ 8F1955CE42E1484714B542F341647778 ] Ftdisk          C:\WINDOWS\system32\DRIVERS\ftdisk.sys
17:25:38.0162 6012  Ftdisk - ok
17:25:38.0178 6012  [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM     C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
17:25:38.0209 6012  GEARAspiWDM - ok
17:25:38.0240 6012  [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc             C:\WINDOWS\system32\DRIVERS\msgpc.sys
17:25:38.0397 6012  Gpc - ok
17:25:38.0459 6012  [ F02A533F517EB38333CB12A9E8963773 ] gupdate         C:\Programme\Google\Update\GoogleUpdate.exe
17:25:38.0490 6012  gupdate - ok
17:25:38.0490 6012  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Programme\Google\Update\GoogleUpdate.exe
17:25:38.0506 6012  gupdatem - ok
17:25:38.0553 6012  [ 2A013E7530BEAB6E569FAA83F517E836 ] HdAudAddService C:\WINDOWS\system32\drivers\HdAudio.sys
17:25:38.0631 6012  HdAudAddService - ok
17:25:38.0678 6012  [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus        C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
17:25:38.0881 6012  HDAudBus - ok
17:25:38.0959 6012  [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc         C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
17:25:39.0115 6012  helpsvc - ok
17:25:39.0115 6012  HidServ - ok
17:25:39.0147 6012  [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb          C:\WINDOWS\system32\DRIVERS\hidusb.sys
17:25:39.0318 6012  HidUsb - ok
17:25:39.0365 6012  [ ED29F14101523A6E0E808107405D452C ] hkmsvc          C:\WINDOWS\System32\kmsvc.dll
17:25:39.0537 6012  hkmsvc - ok
17:25:39.0537 6012  hpn - ok
17:25:39.0615 6012  [ 85DD9EDBB1A035BA9B0E9FCC70624990 ] hpqwmi          C:\Programme\HPQ\Shared\hpqwmi.exe
17:25:39.0615 6012  hpqwmi ( UnsignedFile.Multi.Generic ) - warning
17:25:39.0615 6012  hpqwmi - detected UnsignedFile.Multi.Generic (1)
17:25:39.0662 6012  [ 30CA91E657CEDE2F95359D6EF186F650 ] HPZid412        C:\WINDOWS\system32\DRIVERS\HPZid412.sys
17:25:39.0678 6012  HPZid412 ( UnsignedFile.Multi.Generic ) - warning
17:25:39.0678 6012  HPZid412 - detected UnsignedFile.Multi.Generic (1)
17:25:39.0678 6012  [ EFD31AFA752AA7C7BBB57BCBE2B01C78 ] HPZipr12        C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
17:25:39.0693 6012  HPZipr12 ( UnsignedFile.Multi.Generic ) - warning
17:25:39.0693 6012  HPZipr12 - detected UnsignedFile.Multi.Generic (1)
17:25:39.0709 6012  [ 7AC43C38CA8FD7ED0B0A4466F753E06E ] HPZius12        C:\WINDOWS\system32\DRIVERS\HPZius12.sys
17:25:39.0725 6012  HPZius12 ( UnsignedFile.Multi.Generic ) - warning
17:25:39.0725 6012  HPZius12 - detected UnsignedFile.Multi.Generic (1)
17:25:39.0772 6012  [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP            C:\WINDOWS\system32\Drivers\HTTP.sys
17:25:39.0818 6012  HTTP - ok
17:25:39.0834 6012  [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter      C:\WINDOWS\System32\w3ssl.dll
17:25:40.0006 6012  HTTPFilter - ok
17:25:40.0006 6012  i2omgmt - ok
17:25:40.0022 6012  i2omp - ok
17:25:40.0068 6012  [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt        C:\WINDOWS\system32\DRIVERS\i8042prt.sys
17:25:40.0225 6012  i8042prt - ok
17:25:40.0256 6012  [ 06B7EF73BA5F302EECC294CDF7E19702 ] i81x            C:\WINDOWS\system32\DRIVERS\i81xnt5.sys
17:25:40.0412 6012  i81x - ok
17:25:40.0459 6012  [ 7B5B44EFE5EB9DADFB8EE29700885D23 ] iAimFP0         C:\WINDOWS\system32\DRIVERS\wADV01nt.sys
17:25:40.0600 6012  iAimFP0 - ok
17:25:40.0615 6012  [ EB1F6BAB6C22EDE0BA551B527475F7E9 ] iAimFP1         C:\WINDOWS\system32\DRIVERS\wADV02NT.sys
17:25:40.0772 6012  iAimFP1 - ok
17:25:40.0787 6012  [ 03CE989D846C1AA81145CB22FCB86D06 ] iAimFP2         C:\WINDOWS\system32\DRIVERS\wADV05NT.sys
17:25:40.0943 6012  iAimFP2 - ok
17:25:40.0959 6012  [ 525849B4469DE021D5D61B4DB9BE3A9D ] iAimFP3         C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys
17:25:41.0100 6012  iAimFP3 - ok
17:25:41.0115 6012  [ 589C2BCDB5BD602BF7B63D210407EF8C ] iAimFP4         C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys
17:25:41.0272 6012  iAimFP4 - ok
17:25:41.0303 6012  [ 0308AEF61941E4AF478FA1A0F83812F5 ] iAimFP5         C:\WINDOWS\system32\DRIVERS\wADV07nt.sys
17:25:41.0443 6012  iAimFP5 - ok
17:25:41.0475 6012  [ 714038A8AA5DE08E12062202CD7EAEB5 ] iAimFP6         C:\WINDOWS\system32\DRIVERS\wADV08nt.sys
17:25:41.0615 6012  iAimFP6 - ok
17:25:41.0678 6012  [ 7BB3AA595E4507A788DE1CDC63F4C8C4 ] iAimFP7         C:\WINDOWS\system32\DRIVERS\wADV09nt.sys
17:25:41.0834 6012  iAimFP7 - ok
17:25:41.0850 6012  [ D83BDD5C059667A2F647A6BE5703A4D2 ] iAimTV0         C:\WINDOWS\system32\DRIVERS\wATV01nt.sys
17:25:42.0006 6012  iAimTV0 - ok
17:25:42.0006 6012  [ ED968D23354DAA0D7C621580C012A1F6 ] iAimTV1         C:\WINDOWS\system32\DRIVERS\wATV02NT.sys
17:25:42.0178 6012  iAimTV1 - ok
17:25:42.0178 6012  [ D738273F218A224C1DDAC04203F27A84 ] iAimTV3         C:\WINDOWS\system32\DRIVERS\wATV04nt.sys
17:25:42.0365 6012  iAimTV3 - ok
17:25:42.0381 6012  [ 0052D118995CBAB152DAABE6106D1442 ] iAimTV4         C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys
17:25:42.0522 6012  iAimTV4 - ok
17:25:42.0553 6012  [ 791CC45DE6E50445BE72E8AD6401FF45 ] iAimTV5         C:\WINDOWS\system32\DRIVERS\wATV10nt.sys
17:25:42.0725 6012  iAimTV5 - ok
17:25:42.0725 6012  [ 352FA0E98BC461CE1CE5D41F64DB558D ] iAimTV6         C:\WINDOWS\system32\DRIVERS\wATV06nt.sys
17:25:42.0881 6012  iAimTV6 - ok
17:25:42.0959 6012  [ 9A883C3C4D91292C0D09DE7C728E781C ] ialm            C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
17:25:43.0053 6012  ialm - ok
17:25:43.0131 6012  [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT        C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
17:25:43.0147 6012  IDriverT ( UnsignedFile.Multi.Generic ) - warning
17:25:43.0147 6012  IDriverT - detected UnsignedFile.Multi.Generic (1)
17:25:43.0240 6012  [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc           c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
17:25:43.0350 6012  idsvc - ok
17:25:43.0381 6012  [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi           C:\WINDOWS\system32\DRIVERS\imapi.sys
17:25:43.0553 6012  Imapi - ok
17:25:43.0584 6012  [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService    C:\WINDOWS\system32\imapi.exe
17:25:43.0756 6012  ImapiService - ok
17:25:43.0756 6012  ini910u - ok
17:25:43.0865 6012  [ 38E36FD56F8CB7E8B9802531365856A4 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys
17:25:44.0084 6012  IntcAzAudAddService - ok
17:25:44.0131 6012  [ 69C4E3C9E67A1F103B94E14FDD5F3213 ] IntelIde        C:\WINDOWS\system32\DRIVERS\intelide.sys
17:25:44.0287 6012  IntelIde - ok
17:25:44.0318 6012  [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm        C:\WINDOWS\system32\DRIVERS\intelppm.sys
17:25:44.0490 6012  intelppm - ok
17:25:44.0506 6012  [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw           C:\WINDOWS\system32\drivers\ip6fw.sys
17:25:44.0709 6012  Ip6Fw - ok
17:25:44.0740 6012  [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver  C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
17:25:44.0897 6012  IpFilterDriver - ok
17:25:44.0928 6012  [ B87AB476DCF76E72010632B5550955F5 ] IpInIp          C:\WINDOWS\system32\DRIVERS\ipinip.sys
17:25:45.0100 6012  IpInIp - ok
17:25:45.0100 6012  [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat           C:\WINDOWS\system32\DRIVERS\ipnat.sys
17:25:45.0272 6012  IpNat - ok
17:25:45.0318 6012  [ 57EDB35EA2FECA88F8B17C0C095C9A56 ] iPod Service    C:\Programme\iPod\bin\iPodService.exe
17:25:45.0397 6012  iPod Service - ok
17:25:45.0443 6012  [ 23C74D75E36E7158768DD63D92789A91 ] IPSec           C:\WINDOWS\system32\DRIVERS\ipsec.sys
17:25:45.0615 6012  IPSec - ok
17:25:45.0647 6012  [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM          C:\WINDOWS\system32\DRIVERS\irenum.sys
17:25:45.0834 6012  IRENUM - ok
17:25:45.0881 6012  [ 6DFB88F64135C525433E87648BDA30DE ] isapnp          C:\WINDOWS\system32\DRIVERS\isapnp.sys
17:25:46.0022 6012  isapnp - ok
17:25:46.0131 6012  [ 1834C96FB1F9280BCF6DDFA6DE8338BF ] JavaQuickStarterService C:\Programme\Java\jre6\bin\jqs.exe
17:25:46.0147 6012  JavaQuickStarterService - ok
17:25:46.0193 6012  [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass        C:\WINDOWS\system32\DRIVERS\kbdclass.sys
17:25:46.0350 6012  Kbdclass - ok
17:25:46.0381 6012  [ 692BCF44383D056AED41B045A323D378 ] kmixer          C:\WINDOWS\system32\drivers\kmixer.sys
17:25:46.0537 6012  kmixer - ok
17:25:46.0553 6012  [ B467646C54CC746128904E1654C750C1 ] KSecDD          C:\WINDOWS\system32\drivers\KSecDD.sys
17:25:46.0600 6012  KSecDD - ok
17:25:46.0631 6012  [ 2BBDCB79900990F0716DFCB714E72DE7 ] lanmanserver    C:\WINDOWS\System32\srvsvc.dll
17:25:46.0678 6012  lanmanserver - ok
17:25:46.0709 6012  [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
17:25:46.0772 6012  lanmanworkstation - ok
17:25:46.0772 6012  lbrtfdc - ok
17:25:46.0818 6012  [ 636714B7D43C8D0C80449123FD266920 ] LmHosts         C:\WINDOWS\System32\lmhsvc.dll
17:25:46.0990 6012  LmHosts - ok
17:25:47.0100 6012  [ 7E6932EEDA54C8EAF7DC6C2225261B85 ] McAfee SiteAdvisor Service C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe
17:25:47.0131 6012  McAfee SiteAdvisor Service - ok
17:25:47.0131 6012  [ 7E6932EEDA54C8EAF7DC6C2225261B85 ] McMPFSvc        C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe
17:25:47.0162 6012  McMPFSvc - ok
17:25:47.0162 6012  [ 7E6932EEDA54C8EAF7DC6C2225261B85 ] mcmscsvc        C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
17:25:47.0209 6012  mcmscsvc - ok
17:25:47.0256 6012  [ 7E6932EEDA54C8EAF7DC6C2225261B85 ] McNaiAnn        C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
17:25:47.0272 6012  McNaiAnn - ok
17:25:47.0287 6012  [ 7E6932EEDA54C8EAF7DC6C2225261B85 ] McNASvc         C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
17:25:47.0303 6012  McNASvc - ok
17:25:47.0428 6012  [ B3CD9ADE1C2665124CA34125B331B0B4 ] McODS           C:\Programme\McAfee\VirusScan\mcods.exe
17:25:47.0475 6012  McODS - ok
17:25:47.0475 6012  [ 7E6932EEDA54C8EAF7DC6C2225261B85 ] McProxy         C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
17:25:47.0506 6012  McProxy - ok
17:25:47.0553 6012  [ 593FA4C378818ECE76BA64A11AD56CF2 ] McShield        C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mcshield.exe
17:25:47.0584 6012  McShield - ok
17:25:47.0662 6012  [ 11F714F85530A2BD134074DC30E99FCA ] MDM             C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
17:25:47.0693 6012  MDM - ok
17:25:47.0725 6012  [ B7550A7107281D170CE85524B1488C98 ] Messenger       C:\WINDOWS\System32\msgsvc.dll
17:25:47.0928 6012  Messenger - ok
17:25:47.0959 6012  [ 43C31BDF404A6D7A7AC1BFD5EAD2A566 ] mfeapfk         C:\WINDOWS\system32\drivers\mfeapfk.sys
17:25:47.0975 6012  mfeapfk - ok
17:25:48.0006 6012  [ C1DC5F42D3367F33B6451BE78B38BD46 ] mfeavfk         C:\WINDOWS\system32\drivers\mfeavfk.sys
17:25:48.0037 6012  mfeavfk - ok
17:25:48.0037 6012  mfeavfk01 - ok
17:25:48.0084 6012  [ 0435C43F4C2BE01B84868AD2A906397B ] mfebopk         C:\WINDOWS\system32\drivers\mfebopk.sys
17:25:48.0115 6012  mfebopk - ok
17:25:48.0162 6012  [ 7E1F8B1BDC8240F08BD358B3A466C005 ] mfefire         C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mfefire.exe
17:25:48.0193 6012  mfefire - ok
17:25:48.0225 6012  [ 4EA6FF90015424517843E931448E00F1 ] mfefirek        C:\WINDOWS\system32\drivers\mfefirek.sys
17:25:48.0272 6012  mfefirek - ok
17:25:48.0318 6012  [ D1E998748BA24A731106611D535C6BBF ] mfehidk         C:\WINDOWS\system32\drivers\mfehidk.sys
17:25:48.0381 6012  mfehidk - ok
17:25:48.0397 6012  [ 26C76D10ED650E6492800D6F081ECFBA ] mfendisk        C:\WINDOWS\system32\DRIVERS\mfendisk.sys
17:25:48.0428 6012  mfendisk - ok
17:25:48.0428 6012  [ 26C76D10ED650E6492800D6F081ECFBA ] mfendiskmp      C:\WINDOWS\system32\DRIVERS\mfendisk.sys
17:25:48.0459 6012  mfendiskmp - ok
17:25:48.0475 6012  [ F454A13377F0A006D20A8C14A753C432 ] mferkdet        C:\WINDOWS\system32\drivers\mferkdet.sys
17:25:48.0506 6012  mferkdet - ok
17:25:48.0522 6012  [ 070D3FAF2EAC417C59D8674A8752F7A6 ] mfetdi2k        C:\WINDOWS\system32\drivers\mfetdi2k.sys
17:25:48.0553 6012  mfetdi2k - ok
17:25:48.0584 6012  [ B10C4EFD40810C08F4B44DF2EFCB54F7 ] mfevtp          C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe
17:25:48.0615 6012  mfevtp - ok
17:25:48.0647 6012  [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd           C:\WINDOWS\system32\drivers\mnmdd.sys
17:25:48.0818 6012  mnmdd - ok
17:25:48.0865 6012  [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc         C:\WINDOWS\system32\mnmsrvc.exe
17:25:49.0022 6012  mnmsrvc - ok
17:25:49.0084 6012  [ 35176FA09A0FC58DB630991A81A0BA39 ] MOBKbackup      C:\Programme\McAfee Online Backup\MOBKbackup.exe
17:25:49.0100 6012  MOBKbackup - ok
17:25:49.0115 6012  [ E896775837A8BCE436348DF460522394 ] MOBKFilter      C:\WINDOWS\system32\DRIVERS\MOBK.sys
17:25:49.0147 6012  MOBKFilter - ok
17:25:49.0178 6012  [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem           C:\WINDOWS\system32\drivers\Modem.sys
17:25:49.0334 6012  Modem - ok
17:25:49.0365 6012  [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass        C:\WINDOWS\system32\DRIVERS\mouclass.sys
17:25:49.0537 6012  Mouclass - ok
17:25:49.0568 6012  [ 66A6F73C74E1791464160A7065CE711A ] mouhid          C:\WINDOWS\system32\DRIVERS\mouhid.sys
17:25:49.0725 6012  mouhid - ok
17:25:49.0725 6012  [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr        C:\WINDOWS\system32\drivers\MountMgr.sys
17:25:49.0897 6012  MountMgr - ok
17:25:49.0928 6012  [ 46297FA8E30A6007F14118FC2B942FBC ] MozillaMaintenance C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
17:25:49.0959 6012  MozillaMaintenance - ok
17:25:49.0959 6012  mraid35x - ok
17:25:49.0990 6012  [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV          C:\WINDOWS\system32\DRIVERS\mrxdav.sys
17:25:50.0162 6012  MRxDAV - ok
17:25:50.0193 6012  [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb          C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
17:25:50.0272 6012  MRxSmb - ok
17:25:50.0318 6012  [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC           C:\WINDOWS\system32\msdtc.exe
17:25:50.0490 6012  MSDTC - ok
17:25:50.0506 6012  [ C941EA2454BA8350021D774DAF0F1027 ] Msfs            C:\WINDOWS\system32\drivers\Msfs.sys
17:25:50.0662 6012  Msfs - ok
17:25:50.0662 6012  MSIServer - ok
17:25:50.0693 6012  [ 7E6932EEDA54C8EAF7DC6C2225261B85 ] MSK80Service    C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe
17:25:50.0725 6012  MSK80Service - ok
17:25:50.0756 6012  [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV         C:\WINDOWS\system32\drivers\MSKSSRV.sys
17:25:50.0928 6012  MSKSSRV - ok
17:25:50.0943 6012  [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK        C:\WINDOWS\system32\drivers\MSPCLOCK.sys
17:25:51.0084 6012  MSPCLOCK - ok
17:25:51.0115 6012  [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM           C:\WINDOWS\system32\drivers\MSPQM.sys
17:25:51.0272 6012  MSPQM - ok
17:25:51.0318 6012  [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios        C:\WINDOWS\system32\DRIVERS\mssmbios.sys
17:25:51.0459 6012  mssmbios - ok
17:25:51.0475 6012  [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup             C:\WINDOWS\system32\drivers\Mup.sys
17:25:51.0522 6012  Mup - ok
17:25:51.0568 6012  [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent        C:\WINDOWS\System32\qagentrt.dll
17:25:51.0740 6012  napagent - ok
17:25:51.0756 6012  [ 1DF7F42665C94B825322FAE71721130D ] NDIS            C:\WINDOWS\system32\drivers\NDIS.sys
17:25:51.0928 6012  NDIS - ok
17:25:51.0959 6012  [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi        C:\WINDOWS\system32\DRIVERS\ndistapi.sys
17:25:52.0022 6012  NdisTapi - ok
17:25:52.0068 6012  [ F927A4434C5028758A842943EF1A3849 ] Ndisuio         C:\WINDOWS\system32\DRIVERS\ndisuio.sys
17:25:52.0225 6012  Ndisuio - ok
17:25:52.0256 6012  [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan         C:\WINDOWS\system32\DRIVERS\ndiswan.sys
17:25:52.0412 6012  NdisWan - ok
17:25:52.0443 6012  [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy         C:\WINDOWS\system32\drivers\NDProxy.sys
17:25:52.0490 6012  NDProxy - ok
17:25:52.0537 6012  [ 2969D26EEE289BE7422AA46FC55F4E38 ] Net Driver HPZ12 C:\WINDOWS\system32\HPZinw12.dll
17:25:52.0553 6012  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
17:25:52.0553 6012  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
17:25:52.0568 6012  [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS         C:\WINDOWS\system32\DRIVERS\netbios.sys
17:25:52.0756 6012  NetBIOS - ok
17:25:52.0772 6012  [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT           C:\WINDOWS\system32\DRIVERS\netbt.sys
17:25:52.0943 6012  NetBT - ok
17:25:52.0975 6012  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE          C:\WINDOWS\system32\netdde.exe
17:25:53.0162 6012  NetDDE - ok
17:25:53.0193 6012  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm      C:\WINDOWS\system32\netdde.exe
17:25:53.0350 6012  NetDDEdsdm - ok
17:25:53.0397 6012  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon        C:\WINDOWS\system32\lsass.exe
17:25:53.0553 6012  Netlogon - ok
17:25:53.0600 6012  [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman          C:\WINDOWS\System32\netman.dll
17:25:53.0756 6012  Netman - ok
17:25:53.0803 6012  [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
17:25:53.0818 6012  NetTcpPortSharing - ok
17:25:53.0865 6012  [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla             C:\WINDOWS\System32\mswsock.dll
17:25:53.0912 6012  Nla - ok
17:25:53.0959 6012  [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs            C:\WINDOWS\system32\drivers\Npfs.sys
17:25:54.0131 6012  Npfs - ok
17:25:54.0178 6012  [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs            C:\WINDOWS\system32\drivers\Ntfs.sys
17:25:54.0334 6012  Ntfs - ok
17:25:54.0350 6012  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp         C:\WINDOWS\system32\lsass.exe
17:25:54.0506 6012  NtLmSsp - ok
17:25:54.0537 6012  [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc         C:\WINDOWS\system32\ntmssvc.dll
17:25:54.0740 6012  NtmsSvc - ok
17:25:54.0772 6012  [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null            C:\WINDOWS\system32\drivers\Null.sys
17:25:54.0912 6012  Null - ok
17:25:54.0943 6012  [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt        C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
17:25:55.0100 6012  NwlnkFlt - ok
17:25:55.0115 6012  [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd        C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
17:25:55.0272 6012  NwlnkFwd - ok
17:25:55.0350 6012  [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose             C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
17:25:55.0365 6012  ose - ok
17:25:55.0678 6012  [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc         C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
17:25:56.0037 6012  osppsvc - ok
17:25:56.0084 6012  [ A7AF0C0860F1C43FC6581BA8A99EABEF ] P3              C:\WINDOWS\system32\DRIVERS\p3.sys
17:25:56.0256 6012  P3 - ok
17:25:56.0287 6012  [ F84785660305B9B903FB3BCA8BA29837 ] Parport         C:\WINDOWS\system32\DRIVERS\parport.sys
17:25:56.0459 6012  Parport - ok
17:25:56.0459 6012  [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr         C:\WINDOWS\system32\drivers\PartMgr.sys
17:25:56.0631 6012  PartMgr - ok
17:25:56.0678 6012  [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm          C:\WINDOWS\system32\drivers\ParVdm.sys
17:25:56.0834 6012  ParVdm - ok
17:25:56.0850 6012  [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI             C:\WINDOWS\system32\DRIVERS\pci.sys
17:25:57.0022 6012  PCI - ok
17:25:57.0037 6012  PCIDump - ok
17:25:57.0053 6012  [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde          C:\WINDOWS\system32\DRIVERS\pciide.sys
17:25:57.0225 6012  PCIIde - ok
17:25:57.0240 6012  [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia          C:\WINDOWS\system32\drivers\Pcmcia.sys
17:25:57.0428 6012  Pcmcia - ok
17:25:57.0443 6012  PDCOMP - ok
17:25:57.0443 6012  PDFRAME - ok
17:25:57.0459 6012  PDRELI - ok
17:25:57.0459 6012  PDRFRAME - ok
17:25:57.0475 6012  perc2 - ok
17:25:57.0475 6012  perc2hib - ok
17:25:57.0506 6012  [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay        C:\WINDOWS\system32\services.exe
17:25:57.0568 6012  PlugPlay - ok
17:25:57.0584 6012  [ BAFC9706BDF425A02B66468AB2605C59 ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.dll
17:25:57.0600 6012  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
17:25:57.0600 6012  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
17:25:57.0615 6012  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent     C:\WINDOWS\system32\lsass.exe
17:25:57.0756 6012  PolicyAgent - ok
17:25:57.0803 6012  [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport    C:\WINDOWS\system32\DRIVERS\raspptp.sys
17:25:57.0975 6012  PptpMiniport - ok
17:25:57.0975 6012  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
17:25:58.0131 6012  ProtectedStorage - ok
17:25:58.0131 6012  [ 09298EC810B07E5D582CB3A3F9255424 ] PSched          C:\WINDOWS\system32\DRIVERS\psched.sys
17:25:58.0303 6012  PSched - ok
17:25:58.0318 6012  [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink         C:\WINDOWS\system32\DRIVERS\ptilink.sys
17:25:58.0475 6012  Ptilink - ok
17:25:58.0506 6012  [ 86724469CD077901706854974CD13C3E ] PxHelp20        C:\WINDOWS\system32\Drivers\PxHelp20.sys
17:25:58.0506 6012  PxHelp20 ( UnsignedFile.Multi.Generic ) - warning
17:25:58.0506 6012  PxHelp20 - detected UnsignedFile.Multi.Generic (1)
17:25:58.0522 6012  ql1080 - ok
17:25:58.0522 6012  Ql10wnt - ok
17:25:58.0537 6012  ql12160 - ok
17:25:58.0537 6012  ql1240 - ok
17:25:58.0553 6012  ql1280 - ok
17:25:58.0568 6012  [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd          C:\WINDOWS\system32\DRIVERS\rasacd.sys
17:25:58.0725 6012  RasAcd - ok
17:25:58.0787 6012  [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto         C:\WINDOWS\System32\rasauto.dll
17:25:58.0928 6012  RasAuto - ok
17:25:58.0943 6012  [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp         C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
17:25:59.0100 6012  Rasl2tp - ok
17:25:59.0131 6012  [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan          C:\WINDOWS\System32\rasmans.dll
17:25:59.0303 6012  RasMan - ok
17:25:59.0334 6012  [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe        C:\WINDOWS\system32\DRIVERS\raspppoe.sys
17:25:59.0475 6012  RasPppoe - ok
17:25:59.0506 6012  [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti          C:\WINDOWS\system32\DRIVERS\raspti.sys
17:25:59.0647 6012  Raspti - ok
17:25:59.0662 6012  [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss           C:\WINDOWS\system32\DRIVERS\rdbss.sys
17:25:59.0818 6012  Rdbss - ok
17:25:59.0834 6012  [ 4912D5B403614CE99C28420F75353332 ] RDPCDD          C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
17:25:59.0990 6012  RDPCDD - ok
17:26:00.0006 6012  [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr           C:\WINDOWS\system32\DRIVERS\rdpdr.sys
17:26:00.0178 6012  rdpdr - ok
17:26:00.0240 6012  [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD           C:\WINDOWS\system32\drivers\RDPWD.sys
17:26:00.0303 6012  RDPWD - ok
17:26:00.0350 6012  [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr       C:\WINDOWS\system32\sessmgr.exe
17:26:00.0537 6012  RDSessMgr - ok
17:26:00.0568 6012  [ ED761D453856F795A7FE056E42C36365 ] redbook         C:\WINDOWS\system32\DRIVERS\redbook.sys
17:26:00.0740 6012  redbook - ok
17:26:00.0772 6012  [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess    C:\WINDOWS\System32\mprdim.dll
17:26:00.0959 6012  RemoteAccess - ok
17:26:01.0006 6012  [ E4CD1F3D84E1C2CA0B8CF7501E201593 ] RemoteRegistry  C:\WINDOWS\system32\regsvc.dll
17:26:01.0193 6012  RemoteRegistry - ok
17:26:01.0272 6012  [ 9CB7A30BC6BADBADA630C231D8BF0016 ] RetroLauncher   C:\Programme\Dantz\Retrospect\retrorun.exe
17:26:01.0303 6012  RetroLauncher ( UnsignedFile.Multi.Generic ) - warning
17:26:01.0303 6012  RetroLauncher - detected UnsignedFile.Multi.Generic (1)
17:26:01.0350 6012  [ 0B9E8B4AB54D05605C2AFF3B491061F2 ] RetroWDSvc      C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
17:26:01.0365 6012  RetroWDSvc ( UnsignedFile.Multi.Generic ) - warning
17:26:01.0365 6012  RetroWDSvc - detected UnsignedFile.Multi.Generic (1)
17:26:01.0412 6012  [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator      C:\WINDOWS\system32\locator.exe
17:26:01.0568 6012  RpcLocator - ok
17:26:01.0600 6012  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs           C:\WINDOWS\system32\rpcss.dll
17:26:01.0662 6012  RpcSs - ok
17:26:01.0725 6012  [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP            C:\WINDOWS\system32\rsvp.exe
17:26:01.0897 6012  RSVP - ok
17:26:01.0912 6012  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs           C:\WINDOWS\system32\lsass.exe
17:26:02.0068 6012  SamSs - ok
17:26:02.0100 6012  [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr        C:\WINDOWS\System32\SCardSvr.exe
17:26:02.0287 6012  SCardSvr - ok
17:26:02.0318 6012  [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule        C:\WINDOWS\system32\schedsvc.dll
17:26:02.0506 6012  Schedule - ok
17:26:02.0553 6012  [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv          C:\WINDOWS\system32\DRIVERS\secdrv.sys
17:26:02.0709 6012  Secdrv - ok
17:26:02.0740 6012  [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon        C:\WINDOWS\System32\seclogon.dll
17:26:02.0928 6012  seclogon - ok
17:26:02.0928 6012  [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS            C:\WINDOWS\system32\sens.dll
17:26:03.0115 6012  SENS - ok
17:26:03.0147 6012  [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum         C:\WINDOWS\system32\DRIVERS\serenum.sys
17:26:03.0412 6012  serenum - ok
17:26:03.0428 6012  [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial          C:\WINDOWS\system32\DRIVERS\serial.sys
17:26:03.0584 6012  Serial - ok
17:26:03.0631 6012  [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy         C:\WINDOWS\system32\drivers\Sfloppy.sys
17:26:03.0787 6012  Sfloppy - ok
17:26:03.0850 6012  [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess    C:\WINDOWS\System32\ipnathlp.dll
17:26:04.0037 6012  SharedAccess - ok
17:26:04.0053 6012  [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
17:26:04.0084 6012  ShellHWDetection - ok
17:26:04.0084 6012  Simbad - ok
17:26:04.0115 6012  [ A1ECEEAA5C5E74B2499EB51D38185B84 ] SONYPVU1        C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
17:26:04.0287 6012  SONYPVU1 - ok
17:26:04.0303 6012  Sparrow - ok
17:26:04.0334 6012  [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter        C:\WINDOWS\system32\drivers\splitter.sys
17:26:04.0506 6012  splitter - ok
17:26:04.0537 6012  [ 60784F891563FB1B767F70117FC2428F ] Spooler         C:\WINDOWS\system32\spoolsv.exe
17:26:04.0584 6012  Spooler - ok
17:26:04.0600 6012  [ 50FA898F8C032796D3B1B9951BB5A90F ] sr              C:\WINDOWS\system32\DRIVERS\sr.sys
17:26:04.0756 6012  sr - ok
17:26:04.0803 6012  [ FE77A85495065F3AD59C5C65B6C54182 ] srservice       C:\WINDOWS\system32\srsvc.dll
17:26:04.0959 6012  srservice - ok
17:26:05.0006 6012  [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv             C:\WINDOWS\system32\DRIVERS\srv.sys
17:26:05.0084 6012  Srv - ok
17:26:05.0131 6012  [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV         C:\WINDOWS\System32\ssdpsrv.dll
17:26:05.0303 6012  SSDPSRV - ok
17:26:05.0350 6012  [ BC2C5985611C5356B24AEB370953DED9 ] stisvc          C:\WINDOWS\system32\wiaservc.dll
17:26:05.0522 6012  stisvc - ok
17:26:05.0553 6012  [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum          C:\WINDOWS\system32\DRIVERS\swenum.sys
17:26:05.0740 6012  swenum - ok
17:26:05.0756 6012  [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi          C:\WINDOWS\system32\drivers\swmidi.sys
17:26:05.0912 6012  swmidi - ok
17:26:05.0928 6012  SwPrv - ok
17:26:05.0959 6012  [ 1FF3217614018630D0A6758630FC698C ] symc810         C:\WINDOWS\system32\DRIVERS\symc810.sys
17:26:06.0100 6012  symc810 - ok
17:26:06.0131 6012  [ 070E001D95CF725186EF8B20335F933C ] symc8xx         C:\WINDOWS\system32\DRIVERS\symc8xx.sys
17:26:06.0287 6012  symc8xx - ok
17:26:06.0303 6012  [ F2B7E8416F508368AC6730E2AE1C614F ] Symmpi          C:\WINDOWS\system32\DRIVERS\symmpi.sys
17:26:06.0303 6012  Symmpi ( UnsignedFile.Multi.Generic ) - warning
17:26:06.0303 6012  Symmpi - detected UnsignedFile.Multi.Generic (1)
17:26:06.0318 6012  [ 80AC1C4ABBE2DF3B738BF15517A51F2C ] sym_hi          C:\WINDOWS\system32\DRIVERS\sym_hi.sys
17:26:06.0475 6012  sym_hi - ok
17:26:06.0490 6012  [ BF4FAB949A382A8E105F46EBB4937058 ] sym_u3          C:\WINDOWS\system32\DRIVERS\sym_u3.sys
17:26:06.0631 6012  sym_u3 - ok
17:26:06.0662 6012  [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio        C:\WINDOWS\system32\drivers\sysaudio.sys
17:26:06.0818 6012  sysaudio - ok
17:26:06.0834 6012  [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog       C:\WINDOWS\system32\smlogsvc.exe
17:26:07.0022 6012  SysmonLog - ok
17:26:07.0068 6012  [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv         C:\WINDOWS\System32\tapisrv.dll
17:26:07.0240 6012  TapiSrv - ok
17:26:07.0287 6012  [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip           C:\WINDOWS\system32\DRIVERS\tcpip.sys
17:26:07.0318 6012  Tcpip - ok
17:26:07.0365 6012  [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE          C:\WINDOWS\system32\drivers\TDPIPE.sys
17:26:07.0537 6012  TDPIPE - ok
17:26:07.0568 6012  [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP           C:\WINDOWS\system32\drivers\TDTCP.sys
17:26:07.0740 6012  TDTCP - ok
17:26:07.0787 6012  [ 88155247177638048422893737429D9E ] TermDD          C:\WINDOWS\system32\DRIVERS\termdd.sys
17:26:07.0959 6012  TermDD - ok
17:26:08.0006 6012  [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService     C:\WINDOWS\System32\termsrv.dll
17:26:08.0193 6012  TermService - ok
17:26:08.0209 6012  [ 2DB7D303C36DDD055215052F118E8E75 ] Themes          C:\WINDOWS\System32\shsvcs.dll
17:26:08.0240 6012  Themes - ok
17:26:08.0287 6012  [ 03681A1CE77F51586903869A5AB1DEAB ] TlntSvr         C:\WINDOWS\system32\tlntsvr.exe
17:26:08.0522 6012  TlntSvr - ok
17:26:08.0537 6012  TosIde - ok
17:26:08.0568 6012  [ 626504572B175867F30F3215C04B3E2F ] TrkWks          C:\WINDOWS\system32\trkwks.dll
17:26:08.0772 6012  TrkWks - ok
17:26:08.0818 6012  [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs            C:\WINDOWS\system32\drivers\Udfs.sys
17:26:09.0006 6012  Udfs - ok
17:26:09.0022 6012  ultra - ok
17:26:09.0068 6012  [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost        C:\WINDOWS\System32\upnphost.dll
17:26:09.0225 6012  upnphost - ok
17:26:09.0256 6012  [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS             C:\WINDOWS\System32\ups.exe
17:26:09.0412 6012  UPS - ok
17:26:09.0428 6012  [ EAFE1E00739AFE6C51487A050E772E17 ] USBAAPL         C:\WINDOWS\system32\Drivers\usbaapl.sys
17:26:09.0553 6012  USBAAPL - ok
17:26:09.0584 6012  [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp         C:\WINDOWS\system32\DRIVERS\usbccgp.sys
17:26:09.0772 6012  usbccgp - ok
17:26:09.0803 6012  [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci         C:\WINDOWS\system32\DRIVERS\usbehci.sys
17:26:09.0959 6012  usbehci - ok
17:26:10.0006 6012  [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub          C:\WINDOWS\system32\DRIVERS\usbhub.sys
17:26:10.0162 6012  usbhub - ok
17:26:10.0193 6012  [ A717C8721046828520C9EDF31288FC00 ] usbprint        C:\WINDOWS\system32\DRIVERS\usbprint.sys
17:26:10.0365 6012  usbprint - ok
17:26:10.0365 6012  [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan         C:\WINDOWS\system32\DRIVERS\usbscan.sys
17:26:10.0537 6012  usbscan - ok
17:26:10.0568 6012  [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR         C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
17:26:10.0725 6012  USBSTOR - ok
17:26:10.0756 6012  [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci         C:\WINDOWS\system32\DRIVERS\usbuhci.sys
17:26:10.0912 6012  usbuhci - ok
17:26:10.0943 6012  [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx      C:\WINDOWS\system32\DRIVERS\usb8023x.sys
17:26:11.0100 6012  usb_rndisx - ok
17:26:11.0131 6012  [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave         C:\WINDOWS\System32\drivers\vga.sys
17:26:11.0287 6012  VgaSave - ok
17:26:11.0303 6012  [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde          C:\WINDOWS\system32\DRIVERS\viaide.sys
17:26:11.0475 6012  ViaIde - ok
17:26:11.0506 6012  [ A5A712F4E880874A477AF790B5186E1D ] VolSnap         C:\WINDOWS\system32\drivers\VolSnap.sys
17:26:11.0678 6012  VolSnap - ok
17:26:11.0725 6012  [ 68F106273BE29E7B7EF8266977268E78 ] VSS             C:\WINDOWS\System32\vssvc.exe
17:26:11.0928 6012  VSS - ok
17:26:11.0959 6012  [ 7B353059E665F8B7AD2BBEAEF597CF45 ] W32Time         C:\WINDOWS\system32\w32time.dll
17:26:12.0115 6012  W32Time - ok
17:26:12.0147 6012  [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp          C:\WINDOWS\system32\DRIVERS\wanarp.sys
17:26:12.0318 6012  Wanarp - ok
17:26:12.0334 6012  [ 4A954A20A4C73D6DB13C0FE25F3F1B0C ] wceusbsh        C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
17:26:12.0381 6012  wceusbsh - ok
17:26:12.0381 6012  WDICA - ok
17:26:12.0412 6012  [ 6768ACF64B18196494413695F0C3A00F ] wdmaud          C:\WINDOWS\system32\drivers\wdmaud.sys
17:26:12.0568 6012  wdmaud - ok
17:26:12.0615 6012  [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient       C:\WINDOWS\System32\webclnt.dll
17:26:12.0772 6012  WebClient - ok
17:26:12.0850 6012  [ 6F3F3973D97714CC5F906A19FE883729 ] winmgmt         C:\WINDOWS\system32\wbem\WMIsvc.dll
17:26:13.0006 6012  winmgmt - ok
17:26:13.0053 6012  [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN        C:\WINDOWS\system32\MsPMSNSv.dll
17:26:13.0084 6012  WmdmPmSN - ok
17:26:13.0147 6012  [ FFA4D901D46D07A5BAB2D8307FBB51A6 ] Wmi             C:\WINDOWS\System32\advapi32.dll
17:26:13.0240 6012  Wmi - ok
17:26:13.0287 6012  [ C42584FD66CE9E17403AEBCA199F7BDB ] WmiAcpi         C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
17:26:13.0459 6012  WmiAcpi - ok
17:26:13.0490 6012  [ 93908111BA57A6E60EC2FA2DE202105C ] WmiApSrv        C:\WINDOWS\system32\wbem\wmiapsrv.exe
17:26:13.0647 6012  WmiApSrv - ok
17:26:13.0740 6012  [ BF05650BB7DF5E9EBDD25974E22403BB ] WMPNetworkSvc   C:\Programme\Windows Media Player\WMPNetwk.exe
17:26:13.0850 6012  WMPNetworkSvc - ok
17:26:13.0881 6012  [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc          C:\WINDOWS\system32\wscsvc.dll
17:26:14.0037 6012  wscsvc - ok
17:26:14.0037 6012  WSearch - ok
17:26:14.0084 6012  [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv        C:\WINDOWS\system32\wuauserv.dll
17:26:14.0256 6012  wuauserv - ok
17:26:14.0303 6012  [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf          C:\WINDOWS\system32\DRIVERS\WudfPf.sys
17:26:14.0365 6012  WudfPf - ok
17:26:14.0397 6012  [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd          C:\WINDOWS\system32\DRIVERS\wudfrd.sys
17:26:14.0428 6012  WudfRd - ok
17:26:14.0459 6012  [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc         C:\WINDOWS\System32\WUDFSvc.dll
17:26:14.0490 6012  WudfSvc - ok
17:26:14.0553 6012  [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC          C:\WINDOWS\System32\wzcsvc.dll
17:26:14.0740 6012  WZCSVC - ok
17:26:14.0787 6012  [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov         C:\WINDOWS\System32\xmlprov.dll
17:26:14.0943 6012  xmlprov - ok
17:26:14.0959 6012  ================ Scan global ===============================
17:26:14.0990 6012  [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll
17:26:15.0022 6012  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
17:26:15.0037 6012  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
17:26:15.0053 6012  [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe
17:26:15.0068 6012  [Global] - ok
17:26:15.0068 6012  ================ Scan MBR ==================================
17:26:15.0084 6012  [ E5FA06ACA0D60BA9C870D0EF3D9898C9 ] \Device\Harddisk0\DR0
17:26:15.0287 6012  \Device\Harddisk0\DR0 - ok
17:26:15.0287 6012  ================ Scan VBR ==================================
17:26:15.0287 6012  [ A9DB90E6BB26C5B5F9818CB685C52F2B ] \Device\Harddisk0\DR0\Partition1
17:26:15.0287 6012  \Device\Harddisk0\DR0\Partition1 - ok
17:26:15.0287 6012  ============================================================
17:26:15.0287 6012  Scan finished
17:26:15.0287 6012  ============================================================
17:26:15.0397 1064  Detected object count: 12
17:26:15.0397 1064  Actual detected object count: 12
17:28:44.0022 1064  adpu320 ( UnsignedFile.Multi.Generic ) - skipped by user
17:28:44.0022 1064  adpu320 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:28:44.0037 1064  hpqwmi ( UnsignedFile.Multi.Generic ) - skipped by user
17:28:44.0037 1064  hpqwmi ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:28:44.0037 1064  HPZid412 ( UnsignedFile.Multi.Generic ) - skipped by user
17:28:44.0037 1064  HPZid412 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:28:44.0037 1064  HPZipr12 ( UnsignedFile.Multi.Generic ) - skipped by user
17:28:44.0037 1064  HPZipr12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:28:44.0037 1064  HPZius12 ( UnsignedFile.Multi.Generic ) - skipped by user
17:28:44.0037 1064  HPZius12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:28:44.0037 1064  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
17:28:44.0037 1064  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:28:44.0037 1064  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
17:28:44.0037 1064  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:28:44.0037 1064  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
17:28:44.0037 1064  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:28:44.0037 1064  PxHelp20 ( UnsignedFile.Multi.Generic ) - skipped by user
17:28:44.0037 1064  PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:28:44.0037 1064  RetroLauncher ( UnsignedFile.Multi.Generic ) - skipped by user
17:28:44.0037 1064  RetroLauncher ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:28:44.0037 1064  RetroWDSvc ( UnsignedFile.Multi.Generic ) - skipped by user
17:28:44.0037 1064  RetroWDSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:28:44.0037 1064  Symmpi ( UnsignedFile.Multi.Generic ) - skipped by user
17:28:44.0037 1064  Symmpi ( UnsignedFile.Multi.Generic ) - User select action: Skip
         

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir ComboFix hier herunter auf deinen Desktop.

• Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

• Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
  Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

[Code]
Combofix Logfile:

ComboFix 12-09-04.03 - xx 05.09.2012  11:30:49.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.41.1031.18.2039.1380 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\xx\Desktop\ComboFix.exe
AV: McAfee  Anti-Virus und Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee  Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\xx1\GoToAssistDownloadHelper.exe
c:\dokumente und einstellungen\xx1\WINDOWS
c:\windows\IsUn0407.exe
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-08-05 bis 2012-09-05  ))))))))))))))))))))))))))))))
.
.
2012-08-16 01:14 . 2012-08-16 01:14	--------	d-----w-	c:\programme\Microsoft CAPICOM 2.1.0.2
2012-08-15 14:22 . 2012-08-15 14:22	--------	d-----w-	c:\dokumente und einstellungen\xx1\Anwendungsdaten\Windows Search
2012-08-15 13:53 . 2012-08-21 13:41	--------	d-----w-	c:\dokumente und einstellungen\xx1\logs 15.8.12
2012-08-15 10:36 . 2012-08-15 10:36	--------	d-----w-	c:\dokumente und einstellungen\xx1\Anwendungsdaten\Malwarebytes
2012-08-15 10:36 . 2012-08-15 10:36	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-08-15 10:36 . 2012-08-15 10:36	--------	d-----w-	c:\programme\Malwarebytes' Anti-Malware
2012-08-15 10:36 . 2012-07-03 11:46	22344	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-08-14 13:15 . 2012-06-02 13:18	214256	----a-w-	c:\windows\system32\muweb.dll
2012-08-14 13:15 . 2012-06-02 13:18	275696	----a-w-	c:\windows\system32\mucltui.dll
2012-08-14 13:14 . 2012-08-14 13:14	--------	d-----w-	c:\dokumente und einstellungen\xx1\Lokale Einstellungen\Anwendungsdaten\Citrix
2012-08-14 12:48 . 2012-08-14 12:48	--------	d-----w-	c:\dokumente und einstellungen\xx1\Anwendungsdaten\McAfee
2012-08-13 17:01 . 2012-08-13 17:01	--------	d-----w-	c:\dokumente und einstellungen\xx1\Anwendungsdaten\Windows Desktop Search
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-17 05:40 . 2012-04-10 08:38	426184	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-07-17 05:39 . 2011-05-26 06:23	70344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-06 13:59 . 2004-08-04 02:00	78336	----a-w-	c:\windows\system32\browser.dll
2012-07-04 14:05 . 2004-08-04 02:00	139784	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-07-03 18:25 . 2004-08-04 02:00	1866240	----a-w-	c:\windows\system32\win32k.sys
2012-07-02 17:39 . 2004-08-04 02:00	916992	----a-w-	c:\windows\system32\wininet.dll
2012-07-02 17:39 . 2004-08-04 02:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2012-07-02 17:39 . 2004-08-04 02:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2004-08-04 02:00	385024	----a-w-	c:\windows\system32\html.iec
2012-07-19 09:53 . 2011-05-10 06:44	136672	----a-w-	c:\programme\mozilla firefox\components\browsercomps.dll
2011-04-14 12:01 . 2010-07-12 12:54	24376	----a-w-	c:\programme\mozilla firefox\components\Scriptff.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK]
@="{3c3f3c1a-9153-7c05-f938-622e7003894d}"
[HKEY_CLASSES_ROOT\CLSID\{3c3f3c1a-9153-7c05-f938-622e7003894d}]
2010-04-13 18:11	2872120	----a-w-	c:\programme\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK2]
@="{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}"
[HKEY_CLASSES_ROOT\CLSID\{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}]
2010-04-13 18:11	2872120	----a-w-	c:\programme\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK3]
@="{b4caf489-1eec-c617-49ad-8d7088598c06}"
[HKEY_CLASSES_ROOT\CLSID\{b4caf489-1eec-c617-49ad-8d7088598c06}]
2010-04-13 18:11	2872120	----a-w-	c:\programme\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Verknüpfung mit der High Definition Audio-Eigenschaftenseite"="HDAShCut.exe" [2005-01-07 61952]
"RTHDCPL"="RTHDCPL.EXE" [2005-03-08 13924864]
"PTHOSTTR"="c:\programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2005-10-04 86016]
"SetRefresh"="c:\programme\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2006-05-18 180269]
"Adobe Photo Downloader"="c:\programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-23 57344]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-02-18 248040]
"WD Button Manager"="WDBtnMgr.exe" [2006-05-23 335872]
"HP Software Update"="c:\programme\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"HP Component Manager"="c:\programme\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"Microsoft Works Update Detection"="c:\programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 50688]
"AppleSyncNotifier"="c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-21 47904]
"mcui_exe"="c:\programme\McAfee.com\Agent\mcagent.exe" [2012-03-21 1318816]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-09-08 421888]
"APSDaemon"="c:\programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2012-03-27 421736]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Adobe Reader - Schnellstart.lnk - c:\programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
HOTSYNCSHORTCUTNAME.lnk - c:\programme\Palm\Hotsync.exe [2004-6-9 471040]
HP Digital Imaging Monitor.lnk - c:\programme\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
HP Image Zone Schnellstart.lnk - c:\programme\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]
Sonic CinePlayer Quick Launch.lnk - c:\programme\Gemeinsame Dateien\Sonic Shared\CineTray.exe [2005-10-15 114688]
Windows Search.lnk - c:\programme\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programme\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\programme\Microsoft ActiveSync\rapimgr.exe"= c:\programme\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programme\Microsoft ActiveSync\wcescomm.exe"= c:\programme\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programme\Microsoft ActiveSync\WCESMgr.exe"= c:\programme\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Programme\\Gemeinsame Dateien\\McAfee\\McSvcHost\\McSvHost.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Programme\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\Programme\\Gemeinsame Dateien\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [10.05.2010 08:20 89792]
R1 MOBKFilter;MOBKFilter;c:\windows\system32\drivers\MOBK.sys [12.07.2010 14:57 54776]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [12.07.2010 14:53 214904]
R2 McMPFSvc;McAfee Personal Firewall Service;"c:\programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [12.07.2010 14:53 214904]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [12.07.2010 14:53 214904]
R2 mfefire;McAfee Firewall Core Service;c:\programme\Gemeinsame Dateien\McAfee\SystemCore\mfefire.exe [10.05.2010 08:21 161632]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe [10.05.2010 08:20 151880]
R2 MOBKbackup;1%;c:\programme\McAfee Online Backup\MOBKbackup.exe [13.04.2010 20:11 229688]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [10.05.2010 08:20 57600]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [10.05.2010 08:20 340920]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [10.05.2010 08:20 83856]
R3 osppsvc;Office Software Protection Platform;c:\programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09.01.2010 21:37 4640000]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [18.08.2010 08:47 136176]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [18.08.2010 08:47 136176]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [10.05.2010 08:20 83856]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [10.05.2010 08:20 87656]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programme\Mozilla Maintenance Service\maintenanceservice.exe [10.05.2012 09:48 113120]
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2012-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-08-18 06:47]
.
2012-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-08-18 06:47]
.
2012-09-05 c:\windows\Tasks\User_Feed_Synchronization-{E59FF3FD-E8DE-4E33-B712-3D5EB02914EE}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
2012-09-05 c:\windows\Tasks\vtscheduletask.job
- c:\programme\McAfee\Supportability\MVT\MvtApp.exe [2012-08-14 19:05]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
TCP: Interfaces\{58454C97-8418-4A09-8745-05102A472665}: NameServer = 8.8.8.8
DPF: {A8203263-E018-4106-BDBE-8BF6915E8190} - hxxps://download.infotriever.com/bin/ifhelper.cab
FF - ProfilePath - c:\dokumente und einstellungen\xx\Anwendungsdaten\Mozilla\Firefox\Profiles\t3zdlhan.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
AddRemove-JellyFish Light 3.5 - c:\program loads\Uninst.isu
AddRemove-Software Setup - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-09-05 11:37
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
.
c:\dokume~1\xx\LOKALE~1\Temp\catchme.dll 53248 bytes executable
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 1
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"7040AC1900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(2572)
c:\windows\system32\igfxdev.dll
.
Zeit der Fertigstellung: 2012-09-05  11:39:39
ComboFix-quarantined-files.txt  2012-09-05 09:39
.
Vor Suchlauf: 26 Verzeichnis(se), 21'961'551'872 Bytes frei
Nach Suchlauf: 30 Verzeichnis(se), 22'266'064'896 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - A59EAF7CB7F09FA28E6EA03D7AA7EE21
         

--- --- ---

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

• Starte die aswMBR.exe - (aswMBR.exe Anleitung)
  Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
• Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
  Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  
• Klicke auf Scan.
• Warte bitte bis Scan finished successfully im DOS-Fenster steht.
• Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Gmer Log

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit quick scan 2012-09-05 16:20:53
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e WDC_WD800JD-60LSA0 rev.07.01D07
Running: irikhe8f.exe; Driver: C:\DOKUME~1\GL\LOKALE~1\Temp\uxtdapog.sys


---- System - GMER 1.0.15 ----

Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  ZwCreateKey [0xB9EA95D0]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  ZwDeleteKey [0xB9EA95E4]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  ZwDeleteValueKey [0xB9EA9610]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  ZwMapViewOfSection [0xB9EA9666]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  ZwOpenKey [0xB9EA95BC]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  ZwOpenProcess [0xB9EA9594]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  ZwOpenThread [0xB9EA95A8]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  ZwRenameKey [0xB9EA95FA]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  ZwSetSecurityObject [0xB9EA963C]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  ZwSetValueKey [0xB9EA9626]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  ZwTerminateProcess [0xB9EA9690]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  ZwUnmapViewOfSection [0xB9EA967C]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  ZwYieldExecution [0xB9EA9650]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  NtMapViewOfSection
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  NtOpenProcess
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  NtOpenThread
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)  NtSetSecurityObject

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                         mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
AttachedDevice  \FileSystem\Ntfs \Ntfs                         MOBK.sys (Mozy Change Monitor Filter Driver/Mozy, Inc.)
AttachedDevice  \Driver\Tcpip \Device\Ip                       mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice  \Driver\Tcpip \Device\Tcp                      mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice  \Driver\Tcpip \Device\Udp                      mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice  \Driver\Tcpip \Device\RawIp                    mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

---- EOF - GMER 1.0.15 ----
         

OSAM log

OSAM Logfile:

	
	
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 16:26:58 on 05.09.2012

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"vtscheduletask.job" - "McAfee, Inc." - C:\Programme\McAfee\Supportability\MVT\MvtApp.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"BACSCPL.cpl" - ? - C:\WINDOWS\system32\BACSCPL.cpl
"CMDVDPak.cpl" - "Sonic Solutions" - C:\WINDOWS\system32\CMDVDPak.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLCFG32.CPL
"PTHOST.CPL" - "HP" - C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOST.CPL
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"catchme" (catchme) - ? - C:\DOKUME~1\GL\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"IEEE-1284.4 Driver HPZid412" (HPZid412) - "HP" - C:\WINDOWS\System32\DRIVERS\HPZid412.sys
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"McAfee Inc." (mfeavfk01) - ? - C:\WINDOWS\system32\drivers\mfeavfk01.sys  (File not found)
"MOBKFilter" (MOBKFilter) - "Mozy, Inc." - C:\WINDOWS\System32\DRIVERS\MOBK.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"Print Class Driver for IEEE-1284.4 HPZipr12" (HPZipr12) - "HP" - C:\WINDOWS\System32\DRIVERS\HPZipr12.sys
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"USB to IEEE-1284.4 Translation Driver HPZius12" (HPZius12) - "HP" - C:\WINDOWS\System32\DRIVERS\HPZius12.sys
"uxtdapog" (uxtdapog) - ? - C:\DOKUME~1\xx\LOKALE~1\Temp\uxtdapog.sys  (Hidden registry entry, rootkit activity | File not found)
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{3EF5086B-5478-4598-A054-786C45D75692} "McInternetProtocolRoot Class" - "McAfee, Inc." - c:\progra~1\mcafee\msc\mcsniepl.dll
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{CF184AD3-CDCB-4168-A3F7-8E447D129300} "CZipHandler Object" - "Hewlett-Packard Company" - C:\Programme\HP\hpcoretech\comp\hpuiprot.dll
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
{5513F07E-936B-4E52-9B00-067394E91CC5} "McAfee SACore Protocol Handler" - "McAfee, Inc." - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
{5513F07E-936B-4E52-9B00-067394E91CC5} "McAfee SACore Protocol Handler" - "McAfee, Inc." - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{56F9679E-7826-4C84-81F3-532071A8BCC5} "Windows Desktop Search Namespace Manager" - "Microsoft Corporation" - C:\Programme\Windows Desktop Search\MSNLNamespaceMgr.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\VISSHE.DLL
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -   (File not found | COM-object registry key not found)
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - c:\WINDOWS\system32\mscoree.dll
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\VISSHE.DLL
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)
{781bca65-20ed-8f6a-368f-b523ec4f51b2} "McAfee Online Backup" - "McAfee, Inc." - C:\Programme\McAfee Online Backup\MOBKshell.dll
{3c3f3c1a-9153-7c05-f938-622e7003894d} "McAfee Online Backup Shell-Erweiterungen" - "McAfee, Inc." - C:\Programme\McAfee Online Backup\MOBKshell.dll
{e6ea1d7d-144e-b977-98c4-84c53c1a69d0} "McAfee Online Backup Shell-Erweiterungen Icon Overlay 2" - "McAfee, Inc." - C:\Programme\McAfee Online Backup\MOBKshell.dll
{b4caf489-1eec-c617-49ad-8d7088598c06} "McAfee Online Backup Shell-Erweiterungen Icon Overlay 3" - "McAfee, Inc." - C:\Programme\McAfee Online Backup\MOBKshell.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll
{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLSHEXT.DLL
{49BF5420-FA7F-11cf-8011-00A0C90A8F78} "Mobiles Gerät" - "Microsoft Corporation" - C:\PROGRA~1\MI3AA1~1\Wcesview.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\OLKFSTUB.DLL
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Programme\Real\RealPlayer\rpshell.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{13E7F612-F261-4391-BEA2-39DF4F3FA311} "Windows Desktop Search" - "Microsoft Corporation" - C:\Programme\Windows Desktop Search\msnlExt.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} "Java Plug-in 1.5.0" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.5.0\bin\npjpi150.dll / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} "Java Plug-in 1.5.0_06" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.5.0_06\bin\npjpi150_06.dll / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} "Java Plug-in 1.5.0_09" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.5.0_09\bin\npjpi150_09.dll / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} "Java Plug-in 1.5.0_10" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.5.0_10\bin\npjpi150_10.dll / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} "Java Plug-in 1.5.0_11" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.5.0_11\bin\npjpi150_11.dll / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} "Java Plug-in 1.6.0_01" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_01\bin\npjpi160_01.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} "Java Plug-in 1.6.0_02" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_02\bin\npjpi160_02.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash32_11_3_300_265.ocx / hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
{A8203263-E018-4106-BDBE-8BF6915E8190} "{A8203263-E018-4106-BDBE-8BF6915E8190}" - ? -   (File not found | COM-object registry key not found) / https://download.infotriever.com/bin/ifhelper.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension" - "Microsoft Corporation" - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "Create Mobile Favorite" - "Microsoft Corporation" - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} "McAfee SiteAdvisor Toolbar" - "McAfee, Inc." - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{B164E929-A1B6-4A06-B104-2CD0E90A88FF} "McAfee SiteAdvisor BHO" - "McAfee, Inc." - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} "scriptproxy" - "McAfee, Inc." - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\ScriptSn.20120627215332.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"Adobe Reader - Schnellstart.lnk" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"HOTSYNCSHORTCUTNAME.lnk" - "PalmSource, Inc" - C:\Programme\Palm\Hotsync.exe  (Shortcut exists | File exists)
"HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe  (Shortcut exists | File exists)
"HP Image Zone Schnellstart.lnk" - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\bin\hpqthb08.exe  (Shortcut exists | File exists)
"Sonic CinePlayer Quick Launch.lnk" - "Sonic Solutions" - C:\Programme\Gemeinsame Dateien\Sonic Shared\CineTray.exe  (Shortcut exists | File exists)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Photo Downloader" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
"AppleSyncNotifier" - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe
"APSDaemon" - "Apple Inc." - "C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe"
"HP Component Manager" - "Hewlett-Packard Company" - "C:\Programme\HP\hpcoretech\hpcmpmgr.exe"
"HP Software Update" - "Hewlett-Packard Company" - "C:\Programme\HP\HP Software Update\HPWuSchd2.exe"
"iTunesHelper" - "Apple Inc." - "C:\Programme\iTunes\iTunesHelper.exe"
"mcui_exe" - "McAfee, Inc." - "C:\Programme\McAfee.com\Agent\mcagent.exe" /runkey
"Microsoft Works Update Detection" - "Microsoft® Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
"PTHOSTTR" - "Hewlett-Packard Development Company, L.P." - C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime
"SetRefresh" - "Hewlett-Packard Company" - C:\Programme\Compaq\SetRefresh\SetRefresh.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
"TkBellExe" - "RealNetworks, Inc." - "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot
"WD Button Manager" - "Western Digital Technologies, Inc." - WDBtnMgr.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"HP Standard TCP/IP Port" - "Hewlett Packard" - C:\WINDOWS\system32\HpTcpMon.dll
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"1%" (MOBKbackup) - "McAfee, Inc." - C:\Programme\McAfee Online Backup\MOBKbackup.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"HP WMI Interface" (hpqwmi) - "Hewlett-Packard Development Company, L.P." - C:\Programme\HPQ\Shared\hpqwmi.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
"McAfee Anti-Spam Service" (MSK80Service) - "McAfee, Inc." - C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe
"McAfee Firewall Core Service" (mfefire) - "McAfee, Inc." - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfefire.exe
"McAfee McShield" (McShield) - "McAfee, Inc." - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mcshield.exe
"McAfee Network Agent" (McNASvc) - "McAfee, Inc." - C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
"McAfee Personal Firewall Service" (McMPFSvc) - "McAfee, Inc." - C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe
"McAfee Proxy Service" (McProxy) - "McAfee, Inc." - C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
"McAfee Scanner" (McODS) - "McAfee, Inc." - C:\Programme\McAfee\VirusScan\mcods.exe
"McAfee Services" (mcmscsvc) - "McAfee, Inc." - C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
"McAfee SiteAdvisor Service" (McAfee SiteAdvisor Service) - "McAfee, Inc." - C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe
"McAfee Validation Trust Protection Service" (mfevtp) - "McAfee, Inc." - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe
"McAfee VirusScan Announcer" (McNaiAnn) - "McAfee, Inc." - C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\WINDOWS\system32\HPZinw12.dll
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\WINDOWS\system32\HPZipm12.dll
"Retrospect Launcher" (RetroLauncher) - "Dantz Development Corporation" - C:\Programme\Dantz\Retrospect\retrorun.exe
"Retrospect WD Service" (RetroWDSvc) - "Dantz Development Corporation" - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
         
 
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
         

aswMBR log (ohne AV scan)

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-05 16:42:36
-----------------------------
16:42:36.515    OS Version: Windows 5.1.2600 Service Pack 3
16:42:36.515    Number of processors: 2 586 0x403
16:42:36.515    ComputerName: x  UserName: xx
16:42:37.328    Initialize success
16:42:48.687    AVAST engine defs: 12090501
16:43:19.359    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e
16:43:19.359    Disk 0 Vendor: WDC_WD800JD-60LSA0 07.01D07 Size: 76319MB BusType: 3
16:43:19.390    Disk 0 MBR read successfully
16:43:19.390    Disk 0 MBR scan
16:43:19.562    Disk 0 unknown MBR code
16:43:19.593    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        76308 MB offset 63
16:43:19.640    Disk 0 scanning sectors +156280320
16:43:19.781    Disk 0 scanning C:\WINDOWS\system32\drivers
16:43:33.062    Service scanning
16:43:52.375    Modules scanning
16:44:00.281    Disk 0 trace - called modules:
16:44:00.312    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 
16:44:00.312    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aa1eab8]
16:44:00.312    3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\00000067[0x8a9f79e8]
16:44:00.312    5 ACPI.sys[b9f7e620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-e[0x8a9f6d98]
16:44:00.312    Scan finished successfully
16:44:18.671    Disk 0 MBR has been saved successfully to "C:\aswMBR\MBR.dat"
16:44:18.687    The log file has been saved successfully to "C:\aswMBR\aswMBR.txt"
         

Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

hier das Log-file:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-06 13:50:57
-----------------------------
13:50:57.187    OS Version: Windows 5.1.2600 Service Pack 3
13:50:57.187    Number of processors: 2 586 0x403
13:50:57.187    ComputerName: x  UserName: xx
13:50:57.750    Initialize success
13:51:07.687    AVAST engine defs: 12090501
13:51:25.859    Verifying
13:51:35.890    Disk 0 Windows 501 MBR fixed successfully
13:56:12.453    Disk 0 MBR has been saved successfully to "C:\aswMBR\MBR.dat"
13:56:12.453    The log file has been saved successfully to "C:\aswMBR\aswMBR-1.txt"
         

Ich wollte nicht das Fix-Log sehen sondern das Log eines neuen Scans

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-07 10:14:24
-----------------------------
10:14:24.421    OS Version: Windows 5.1.2600 Service Pack 3
10:14:24.421    Number of processors: 2 586 0x403
10:14:24.421    ComputerName: x  UserName: xx
10:14:24.656    Initialize success
10:14:33.046    AVAST engine defs: 12090601
10:15:11.765    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e
10:15:11.765    Disk 0 Vendor: WDC_WD800JD-60LSA0 07.01D07 Size: 76319MB BusType: 3
10:15:11.765    Disk 0 MBR read successfully
10:15:11.781    Disk 0 MBR scan
10:15:11.812    Disk 0 Windows XP default MBR code
10:15:11.828    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        76308 MB offset 63
10:15:11.843    Disk 0 scanning sectors +156280320
10:15:11.890    Disk 0 scanning C:\WINDOWS\system32\drivers
10:15:25.421    Service scanning
10:15:43.140    Modules scanning
10:15:51.062    Disk 0 trace - called modules:
10:15:51.078    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 
10:15:51.078    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8ae03ab8]
10:15:51.093    3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\00000068[0x8ade89e8]
10:15:51.093    5 ACPI.sys[b9f7e620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-e[0x8ae4cd98]
10:15:51.093    Scan finished successfully
10:15:59.171    Disk 0 MBR has been saved successfully to "C:\aswMBR\MBR.dat"
10:15:59.171    The log file has been saved successfully to "C:\aswMBR\aswMBR-2.txt"
         

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!