Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Umleitung auf ihavenet.com

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 19.11.2012, 16:59   #1
lebierle
 
Umleitung auf ihavenet.com - Standard

Umleitung auf ihavenet.com



Hallo liebes Trojaner Board!

Mein Computer hat seit kurzem das Problem, dass man sobald man auf einen Link im Google-Suchergebnis klickt auf "ihavenet.com" oder manchmal auch andere Seiten weitergeleitet wird.

Ich bisher folgende Dinge unternommen:
(laut Anleitungen hier im Forum)
  1. mit TDSSKiller gesucht
  2. mit aswMBR gesucht
  3. defogger benutzt
  4. OTL suchen lassen
  5. Gmer suchen lassen

TDSSKiller hat 4 oder 5 Sachen gefunden, die aber harmlos zu scheinen sein (Drucker- /Sound-Treiber zB)

Logfiles:

TDSSKiller:
Code:
ATTFilter
17:13:10.0484 3052  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
17:13:10.0671 3052  ============================================================
17:13:10.0671 3052  Current date / time: 2012/11/14 17:13:10.0671
17:13:10.0671 3052  SystemInfo:
17:13:10.0671 3052  
17:13:10.0671 3052  OS Version: 5.1.2600 ServicePack: 3.0
17:13:10.0671 3052  Product type: Workstation
17:13:10.0671 3052  ComputerName: HENRYFORD
17:13:10.0671 3052  UserName: BinnebMa
17:13:10.0671 3052  Windows directory: C:\WINDOWS
17:13:10.0671 3052  System windows directory: C:\WINDOWS
17:13:10.0671 3052  Processor architecture: Intel x86
17:13:10.0671 3052  Number of processors: 2
17:13:10.0671 3052  Page size: 0x1000
17:13:10.0671 3052  Boot type: Normal boot
17:13:10.0671 3052  ============================================================
17:13:12.0218 3052  Drive \Device\Harddisk0\DR0 - Size: 0x9516AE000 (37.27 Gb), SectorSize: 0x200, Cylinders: 0x1431, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000054
17:13:12.0218 3052  ============================================================
17:13:12.0218 3052  \Device\Harddisk0\DR0:
17:13:12.0218 3052  MBR partitions:
17:13:12.0218 3052  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2710011
17:13:12.0234 3052  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x271008F, BlocksNum 0x2375271
17:13:12.0234 3052  ============================================================
17:13:12.0250 3052  C: <-> \Device\Harddisk0\DR0\Partition1
17:13:12.0296 3052  D: <-> \Device\Harddisk0\DR0\Partition2
17:13:12.0296 3052  ============================================================
17:13:12.0296 3052  Initialize success
17:13:12.0296 3052  ============================================================
17:13:17.0984 3216  ============================================================
17:13:17.0984 3216  Scan started
17:13:17.0984 3216  Mode: Manual; SigCheck; TDLFS; 
17:13:17.0984 3216  ============================================================
17:13:19.0031 3216  ================ Scan system memory ========================
17:13:19.0703 3216  System memory - ok
17:13:19.0703 3216  ================ Scan services =============================
17:13:19.0765 3216  Abiosdsk - ok
17:13:19.0781 3216  abp480n5 - ok
17:13:19.0796 3216  [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI            C:\WINDOWS\system32\DRIVERS\ACPI.sys
17:13:20.0765 3216  ACPI - ok
17:13:20.0781 3216  [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC          C:\WINDOWS\system32\drivers\ACPIEC.sys
17:13:20.0921 3216  ACPIEC - ok
17:13:20.0968 3216  [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
17:13:20.0984 3216  AdobeFlashPlayerUpdateSvc - ok
17:13:21.0000 3216  adpu160m - ok
17:13:21.0015 3216  [ E696E749BEDCDA8B23757B8B5EA93780 ] aeaudio         C:\WINDOWS\system32\drivers\aeaudio.sys
17:13:21.0046 3216  aeaudio - ok
17:13:21.0078 3216  [ 8BED39E3C35D6A489438B8141717A557 ] aec             C:\WINDOWS\system32\drivers\aec.sys
17:13:21.0203 3216  aec - ok
17:13:21.0250 3216  [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD             C:\WINDOWS\System32\drivers\afd.sys
17:13:21.0281 3216  AFD - ok
17:13:21.0312 3216  [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440          C:\WINDOWS\system32\DRIVERS\agp440.sys
17:13:21.0453 3216  agp440 - ok
17:13:21.0453 3216  Aha154x - ok
17:13:21.0468 3216  aic78u2 - ok
17:13:21.0468 3216  aic78xx - ok
17:13:21.0515 3216  [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter         C:\WINDOWS\system32\alrsvc.dll
17:13:21.0640 3216  Alerter - ok
17:13:21.0671 3216  [ 190CD73D4984F94D823F9444980513E5 ] ALG             C:\WINDOWS\System32\alg.exe
17:13:21.0734 3216  ALG - ok
17:13:21.0750 3216  AliIde - ok
17:13:21.0750 3216  amsint - ok
17:13:21.0828 3216  [ A5569C4429D1C5494049FBFE2B2D20FF ] AntiVirSchedulerService C:\Programme\Avira\AntiVir Desktop\sched.exe
17:13:21.0843 3216  AntiVirSchedulerService - ok
17:13:21.0875 3216  [ CB7EA00A4E70DF6828EBB68633D000D2 ] AntiVirService  C:\Programme\Avira\AntiVir Desktop\avguard.exe
17:13:21.0890 3216  AntiVirService - ok
17:13:21.0921 3216  [ D45960BE52C3C610D361977057F98C54 ] AppMgmt         C:\WINDOWS\System32\appmgmts.dll
17:13:22.0015 3216  AppMgmt - ok
17:13:22.0015 3216  asc - ok
17:13:22.0031 3216  asc3350p - ok
17:13:22.0031 3216  asc3550 - ok
17:13:22.0093 3216  [ E1A1206A4FB19B675E947B29CCD25FBA ] aspnet_state    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
17:13:22.0109 3216  aspnet_state ( UnsignedFile.Multi.Generic ) - warning
17:13:22.0109 3216  aspnet_state - detected UnsignedFile.Multi.Generic (1)
17:13:22.0140 3216  [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac        C:\WINDOWS\system32\DRIVERS\asyncmac.sys
17:13:22.0265 3216  AsyncMac - ok
17:13:22.0281 3216  [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi           C:\WINDOWS\system32\DRIVERS\atapi.sys
17:13:22.0421 3216  atapi - ok
17:13:22.0421 3216  Atdisk - ok
17:13:22.0453 3216  [ 9916C1225104BA14794209CFA8012159 ] Atmarpc         C:\WINDOWS\system32\DRIVERS\atmarpc.sys
17:13:22.0578 3216  Atmarpc - ok
17:13:22.0609 3216  [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv        C:\WINDOWS\System32\audiosrv.dll
17:13:22.0750 3216  AudioSrv - ok
17:13:22.0765 3216  [ D9F724AA26C010A217C97606B160ED68 ] audstub         C:\WINDOWS\system32\DRIVERS\audstub.sys
17:13:22.0890 3216  audstub - ok
17:13:22.0906 3216  [ 680B3A1BE559B5D5AAC04C7949469DD6 ] avgntflt        C:\WINDOWS\system32\DRIVERS\avgntflt.sys
17:13:23.0015 3216  avgntflt - ok
17:13:23.0046 3216  [ 6B289080B9752DAD39C1C2B98B479DCE ] avipbb          C:\WINDOWS\system32\DRIVERS\avipbb.sys
17:13:23.0078 3216  avipbb - ok
17:13:23.0093 3216  [ FFB78D74E1EA5F811341A6E7AC547A46 ] avkmgr          C:\WINDOWS\system32\DRIVERS\avkmgr.sys
17:13:23.0109 3216  avkmgr - ok
17:13:23.0140 3216  [ 5175E788BCD1CB7345AB21F3E14369D2 ] b57w2k          C:\WINDOWS\system32\DRIVERS\b57xp32.sys
17:13:23.0171 3216  b57w2k - ok
17:13:23.0218 3216  [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep            C:\WINDOWS\system32\drivers\Beep.sys
17:13:23.0343 3216  Beep - ok
17:13:23.0375 3216  [ D6F603772A789BB3228F310D650B8BD1 ] BITS            C:\WINDOWS\system32\qmgr.dll
17:13:23.0515 3216  BITS - ok
17:13:23.0562 3216  [ 9B53D428DE0A2566A03499D7AA48DEC4 ] Blfp            C:\WINDOWS\system32\DRIVERS\baspxp32.sys
17:13:23.0593 3216  Blfp - ok
17:13:23.0625 3216  [ B71549F23736ADF83A571061C47777FD ] Browser         C:\WINDOWS\System32\browser.dll
17:13:23.0656 3216  Browser - ok
17:13:23.0687 3216  [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k         C:\WINDOWS\system32\drivers\cbidf2k.sys
17:13:23.0828 3216  cbidf2k - ok
17:13:23.0843 3216  cd20xrnt - ok
17:13:23.0875 3216  [ C1B486A7658353D33A10CC15211A873B ] Cdaudio         C:\WINDOWS\system32\drivers\Cdaudio.sys
17:13:24.0046 3216  Cdaudio - ok
17:13:24.0078 3216  [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs            C:\WINDOWS\system32\drivers\Cdfs.sys
17:13:24.0218 3216  Cdfs - ok
17:13:24.0250 3216  [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom           C:\WINDOWS\system32\DRIVERS\cdrom.sys
17:13:24.0390 3216  Cdrom - ok
17:13:24.0390 3216  Changer - ok
17:13:24.0421 3216  [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc           C:\WINDOWS\system32\cisvc.exe
17:13:24.0562 3216  CiSvc - ok
17:13:24.0578 3216  [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv         C:\WINDOWS\system32\clipsrv.exe
17:13:24.0718 3216  ClipSrv - ok
17:13:24.0718 3216  CmdIde - ok
17:13:24.0734 3216  COMSysApp - ok
17:13:24.0750 3216  Cpqarray - ok
17:13:24.0765 3216  [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc        C:\WINDOWS\System32\cryptsvc.dll
17:13:24.0906 3216  CryptSvc - ok
17:13:24.0921 3216  dac2w2k - ok
17:13:24.0921 3216  dac960nt - ok
17:13:24.0953 3216  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch      C:\WINDOWS\system32\rpcss.dll
17:13:25.0000 3216  DcomLaunch - ok
17:13:25.0015 3216  [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp            C:\WINDOWS\System32\dhcpcsvc.dll
17:13:25.0156 3216  Dhcp - ok
17:13:25.0187 3216  [ 044452051F3E02E7963599FC8F4F3E25 ] Disk            C:\WINDOWS\system32\DRIVERS\disk.sys
17:13:25.0328 3216  Disk - ok
17:13:25.0328 3216  dmadmin - ok
17:13:25.0375 3216  [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot          C:\WINDOWS\system32\drivers\dmboot.sys
17:13:25.0578 3216  dmboot - ok
17:13:25.0593 3216  [ 53720AB12B48719D00E327DA470A619A ] dmio            C:\WINDOWS\system32\drivers\dmio.sys
17:13:25.0718 3216  dmio - ok
17:13:25.0734 3216  [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload          C:\WINDOWS\system32\drivers\dmload.sys
17:13:25.0875 3216  dmload - ok
17:13:25.0890 3216  [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver        C:\WINDOWS\System32\dmserver.dll
17:13:26.0031 3216  dmserver - ok
17:13:26.0046 3216  [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic          C:\WINDOWS\system32\drivers\DMusic.sys
17:13:26.0187 3216  DMusic - ok
17:13:26.0218 3216  [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache        C:\WINDOWS\System32\dnsrslvr.dll
17:13:26.0250 3216  Dnscache - ok
17:13:26.0281 3216  [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc         C:\WINDOWS\System32\dot3svc.dll
17:13:26.0421 3216  Dot3svc - ok
17:13:26.0437 3216  [ 3E4B043F8BC6BE1D4820CC6C9C500306 ] Dot4            C:\WINDOWS\system32\DRIVERS\Dot4.sys
17:13:26.0578 3216  Dot4 - ok
17:13:26.0609 3216  [ 77CE63A8A34AE23D9FE4C7896D1DEBE7 ] Dot4Print       C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys
17:13:26.0734 3216  Dot4Print - ok
17:13:26.0750 3216  [ 29E86AF2F3457D0441348020FE3CFBD0 ] dot4usb         C:\WINDOWS\system32\DRIVERS\dot4usb.sys
17:13:26.0890 3216  dot4usb - ok
17:13:26.0906 3216  dpti2o - ok
17:13:26.0921 3216  [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud         C:\WINDOWS\system32\drivers\drmkaud.sys
17:13:27.0046 3216  drmkaud - ok
17:13:27.0125 3216  [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost         C:\WINDOWS\System32\eapsvc.dll
17:13:27.0343 3216  EapHost - ok
17:13:27.0359 3216  [ 877C18558D70587AA7823A1A308AC96B ] ERSvc           C:\WINDOWS\System32\ersvc.dll
17:13:27.0484 3216  ERSvc - ok
17:13:27.0515 3216  [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog        C:\WINDOWS\system32\services.exe
17:13:27.0531 3216  Eventlog - ok
17:13:27.0562 3216  [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem     C:\WINDOWS\system32\es.dll
17:13:27.0593 3216  EventSystem - ok
17:13:27.0609 3216  [ 38D332A6D56AF32635675F132548343E ] Fastfat         C:\WINDOWS\system32\drivers\Fastfat.sys
17:13:27.0750 3216  Fastfat - ok
17:13:27.0781 3216  [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
17:13:27.0812 3216  FastUserSwitchingCompatibility - ok
17:13:27.0828 3216  [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc             C:\WINDOWS\system32\DRIVERS\fdc.sys
17:13:27.0953 3216  Fdc - ok
17:13:28.0000 3216  [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips            C:\WINDOWS\system32\drivers\Fips.sys
17:13:28.0125 3216  Fips - ok
17:13:28.0156 3216  [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk        C:\WINDOWS\system32\DRIVERS\flpydisk.sys
17:13:28.0296 3216  Flpydisk - ok
17:13:28.0328 3216  [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr          C:\WINDOWS\system32\DRIVERS\fltMgr.sys
17:13:28.0453 3216  FltMgr - ok
17:13:28.0468 3216  [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec          C:\WINDOWS\system32\drivers\Fs_Rec.sys
17:13:28.0593 3216  Fs_Rec - ok
17:13:28.0609 3216  [ 8F1955CE42E1484714B542F341647778 ] Ftdisk          C:\WINDOWS\system32\DRIVERS\ftdisk.sys
17:13:28.0734 3216  Ftdisk - ok
17:13:28.0750 3216  [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc             C:\WINDOWS\system32\DRIVERS\msgpc.sys
17:13:28.0890 3216  Gpc - ok
17:13:28.0937 3216  [ F02A533F517EB38333CB12A9E8963773 ] gupdate         C:\Programme\Google\Update\GoogleUpdate.exe
17:13:28.0953 3216  gupdate - ok
17:13:28.0953 3216  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Programme\Google\Update\GoogleUpdate.exe
17:13:28.0968 3216  gupdatem - ok
17:13:29.0015 3216  [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc         C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
17:13:29.0140 3216  helpsvc - ok
17:13:29.0156 3216  [ B35DA85E60C0103F2E4104532DA2F12B ] HidServ         C:\WINDOWS\System32\hidserv.dll
17:13:29.0343 3216  HidServ - ok
17:13:29.0359 3216  [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb          C:\WINDOWS\system32\DRIVERS\hidusb.sys
17:13:29.0500 3216  HidUsb - ok
17:13:29.0531 3216  [ ED29F14101523A6E0E808107405D452C ] hkmsvc          C:\WINDOWS\System32\kmsvc.dll
17:13:29.0656 3216  hkmsvc - ok
17:13:29.0656 3216  hpn - ok
17:13:29.0687 3216  [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP            C:\WINDOWS\system32\Drivers\HTTP.sys
17:13:29.0734 3216  HTTP - ok
17:13:29.0750 3216  [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter      C:\WINDOWS\System32\w3ssl.dll
17:13:29.0890 3216  HTTPFilter - ok
17:13:29.0906 3216  i2omgmt - ok
17:13:29.0906 3216  i2omp - ok
17:13:29.0921 3216  [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt        C:\WINDOWS\system32\DRIVERS\i8042prt.sys
17:13:30.0062 3216  i8042prt - ok
17:13:30.0125 3216  [ 9A883C3C4D91292C0D09DE7C728E781C ] ialm            C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
17:13:30.0234 3216  ialm - ok
17:13:30.0250 3216  [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi           C:\WINDOWS\system32\DRIVERS\imapi.sys
17:13:30.0390 3216  Imapi - ok
17:13:30.0406 3216  [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService    C:\WINDOWS\system32\imapi.exe
17:13:30.0546 3216  ImapiService - ok
17:13:30.0562 3216  ini910u - ok
17:13:30.0578 3216  [ 69C4E3C9E67A1F103B94E14FDD5F3213 ] IntelIde        C:\WINDOWS\system32\DRIVERS\intelide.sys
17:13:30.0718 3216  IntelIde - ok
17:13:30.0734 3216  [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm        C:\WINDOWS\system32\DRIVERS\intelppm.sys
17:13:30.0859 3216  intelppm - ok
17:13:30.0890 3216  [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw           C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
17:13:31.0015 3216  Ip6Fw - ok
17:13:31.0046 3216  [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver  C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
17:13:31.0187 3216  IpFilterDriver - ok
17:13:31.0187 3216  [ B87AB476DCF76E72010632B5550955F5 ] IpInIp          C:\WINDOWS\system32\DRIVERS\ipinip.sys
17:13:31.0312 3216  IpInIp - ok
17:13:31.0328 3216  [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat           C:\WINDOWS\system32\DRIVERS\ipnat.sys
17:13:31.0468 3216  IpNat - ok
17:13:31.0484 3216  [ 23C74D75E36E7158768DD63D92789A91 ] IPSec           C:\WINDOWS\system32\DRIVERS\ipsec.sys
17:13:31.0625 3216  IPSec - ok
17:13:31.0656 3216  [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM          C:\WINDOWS\system32\DRIVERS\irenum.sys
17:13:31.0734 3216  IRENUM - ok
17:13:31.0765 3216  [ 6DFB88F64135C525433E87648BDA30DE ] isapnp          C:\WINDOWS\system32\DRIVERS\isapnp.sys
17:13:31.0890 3216  isapnp - ok
17:13:31.0953 3216  [ 381B25DC8E958D905B33130D500BBF29 ] JavaQuickStarterService C:\Programme\Java\jre6\bin\jqs.exe
17:13:31.0968 3216  JavaQuickStarterService - ok
17:13:32.0000 3216  [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass        C:\WINDOWS\system32\DRIVERS\kbdclass.sys
17:13:32.0125 3216  Kbdclass - ok
17:13:32.0140 3216  [ B6D6C117D771C98130497265F26D1882 ] kbdhid          C:\WINDOWS\system32\DRIVERS\kbdhid.sys
17:13:32.0265 3216  kbdhid - ok
17:13:32.0296 3216  [ 692BCF44383D056AED41B045A323D378 ] kmixer          C:\WINDOWS\system32\drivers\kmixer.sys
17:13:32.0421 3216  kmixer - ok
17:13:32.0437 3216  [ B467646C54CC746128904E1654C750C1 ] KSecDD          C:\WINDOWS\system32\drivers\KSecDD.sys
17:13:32.0484 3216  KSecDD - ok
17:13:32.0531 3216  [ 2BBDCB79900990F0716DFCB714E72DE7 ] LanmanServer    C:\WINDOWS\System32\srvsvc.dll
17:13:32.0562 3216  LanmanServer - ok
17:13:32.0578 3216  [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
17:13:32.0609 3216  lanmanworkstation - ok
17:13:32.0609 3216  lbrtfdc - ok
17:13:32.0640 3216  [ 636714B7D43C8D0C80449123FD266920 ] LmHosts         C:\WINDOWS\System32\lmhsvc.dll
17:13:32.0765 3216  LmHosts - ok
17:13:32.0781 3216  [ B7550A7107281D170CE85524B1488C98 ] Messenger       C:\WINDOWS\System32\msgsvc.dll
17:13:32.0921 3216  Messenger - ok
17:13:32.0953 3216  [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd           C:\WINDOWS\system32\drivers\mnmdd.sys
17:13:33.0078 3216  mnmdd - ok
17:13:33.0093 3216  [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc         C:\WINDOWS\system32\mnmsrvc.exe
17:13:33.0234 3216  mnmsrvc - ok
17:13:33.0265 3216  [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem           C:\WINDOWS\system32\drivers\Modem.sys
17:13:33.0406 3216  Modem - ok
17:13:33.0421 3216  [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass        C:\WINDOWS\system32\DRIVERS\mouclass.sys
17:13:33.0562 3216  Mouclass - ok
17:13:33.0593 3216  [ 66A6F73C74E1791464160A7065CE711A ] mouhid          C:\WINDOWS\system32\DRIVERS\mouhid.sys
17:13:33.0718 3216  mouhid - ok
17:13:33.0734 3216  [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr        C:\WINDOWS\system32\drivers\MountMgr.sys
17:13:33.0875 3216  MountMgr - ok
17:13:33.0921 3216  [ 8BE15F71DE6FF33FC56DCDE7B2B9EFE8 ] MozillaMaintenance C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
17:13:33.0953 3216  MozillaMaintenance - ok
17:13:33.0953 3216  mraid35x - ok
17:13:33.0984 3216  [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV          C:\WINDOWS\system32\DRIVERS\mrxdav.sys
17:13:34.0109 3216  MRxDAV - ok
17:13:34.0140 3216  [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb          C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
17:13:34.0187 3216  MRxSmb - ok
17:13:34.0218 3216  [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC           C:\WINDOWS\system32\msdtc.exe
17:13:34.0375 3216  MSDTC - ok
17:13:34.0406 3216  [ C941EA2454BA8350021D774DAF0F1027 ] Msfs            C:\WINDOWS\system32\drivers\Msfs.sys
17:13:34.0562 3216  Msfs - ok
17:13:34.0562 3216  MSIServer - ok
17:13:34.0578 3216  [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV         C:\WINDOWS\system32\drivers\MSKSSRV.sys
17:13:34.0703 3216  MSKSSRV - ok
17:13:34.0734 3216  [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK        C:\WINDOWS\system32\drivers\MSPCLOCK.sys
17:13:34.0859 3216  MSPCLOCK - ok
17:13:34.0890 3216  [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM           C:\WINDOWS\system32\drivers\MSPQM.sys
17:13:35.0015 3216  MSPQM - ok
17:13:35.0046 3216  [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios        C:\WINDOWS\system32\DRIVERS\mssmbios.sys
17:13:35.0171 3216  mssmbios - ok
17:13:35.0187 3216  [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup             C:\WINDOWS\system32\drivers\Mup.sys
17:13:35.0218 3216  Mup - ok
17:13:35.0250 3216  [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent        C:\WINDOWS\System32\qagentrt.dll
17:13:35.0390 3216  napagent - ok
17:13:35.0406 3216  [ 1DF7F42665C94B825322FAE71721130D ] NDIS            C:\WINDOWS\system32\drivers\NDIS.sys
17:13:35.0531 3216  NDIS - ok
17:13:35.0546 3216  [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi        C:\WINDOWS\system32\DRIVERS\ndistapi.sys
17:13:35.0578 3216  NdisTapi - ok
17:13:35.0609 3216  [ F927A4434C5028758A842943EF1A3849 ] Ndisuio         C:\WINDOWS\system32\DRIVERS\ndisuio.sys
17:13:35.0734 3216  Ndisuio - ok
17:13:35.0750 3216  [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan         C:\WINDOWS\system32\DRIVERS\ndiswan.sys
17:13:35.0890 3216  NdisWan - ok
17:13:35.0906 3216  [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy         C:\WINDOWS\system32\drivers\NDProxy.sys
17:13:35.0937 3216  NDProxy - ok
17:13:35.0984 3216  [ A081CB6FB9A12668F233EB5414BE3A0E ] Net Driver HPZ12 C:\WINDOWS\system32\HPZinw12.dll
17:13:35.0984 3216  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
17:13:35.0984 3216  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
17:13:36.0015 3216  [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS         C:\WINDOWS\system32\DRIVERS\netbios.sys
17:13:36.0156 3216  NetBIOS - ok
17:13:36.0171 3216  [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT           C:\WINDOWS\system32\DRIVERS\netbt.sys
17:13:36.0296 3216  NetBT - ok
17:13:36.0328 3216  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE          C:\WINDOWS\system32\netdde.exe
17:13:36.0468 3216  NetDDE - ok
17:13:36.0468 3216  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm      C:\WINDOWS\system32\netdde.exe
17:13:36.0593 3216  NetDDEdsdm - ok
17:13:36.0609 3216  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon        C:\WINDOWS\system32\lsass.exe
17:13:36.0734 3216  Netlogon - ok
17:13:36.0765 3216  [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman          C:\WINDOWS\System32\netman.dll
17:13:36.0906 3216  Netman - ok
17:13:36.0937 3216  [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla             C:\WINDOWS\System32\mswsock.dll
17:13:36.0953 3216  Nla - ok
17:13:36.0968 3216  [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs            C:\WINDOWS\system32\drivers\Npfs.sys
17:13:37.0109 3216  Npfs - ok
17:13:37.0140 3216  [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs            C:\WINDOWS\system32\drivers\Ntfs.sys
17:13:37.0296 3216  Ntfs - ok
17:13:37.0312 3216  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp         C:\WINDOWS\system32\lsass.exe
17:13:37.0437 3216  NtLmSsp - ok
17:13:37.0468 3216  [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc         C:\WINDOWS\system32\ntmssvc.dll
17:13:37.0625 3216  NtmsSvc - ok
17:13:37.0656 3216  [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null            C:\WINDOWS\system32\drivers\Null.sys
17:13:37.0781 3216  Null - ok
17:13:37.0953 3216  [ 8E72E452B9CC1E455D19E3C9FA964D37 ] nv              C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
17:13:38.0250 3216  nv - ok
17:13:38.0281 3216  [ 934833B3CD462A6F8A96F64D024C8B20 ] NVSvc           C:\WINDOWS\system32\nvsvc32.exe
17:13:38.0312 3216  NVSvc - ok
17:13:38.0328 3216  [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt        C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
17:13:38.0468 3216  NwlnkFlt - ok
17:13:38.0484 3216  [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd        C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
17:13:38.0609 3216  NwlnkFwd - ok
17:13:38.0656 3216  [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose             C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
17:13:38.0671 3216  ose - ok
17:13:38.0828 3216  [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc         C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
17:13:39.0093 3216  osppsvc - ok
17:13:39.0125 3216  [ F84785660305B9B903FB3BCA8BA29837 ] Parport         C:\WINDOWS\system32\DRIVERS\parport.sys
17:13:39.0250 3216  Parport - ok
17:13:39.0265 3216  [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr         C:\WINDOWS\system32\drivers\PartMgr.sys
17:13:39.0406 3216  PartMgr - ok
17:13:39.0421 3216  [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm          C:\WINDOWS\system32\drivers\ParVdm.sys
17:13:39.0578 3216  ParVdm - ok
17:13:39.0593 3216  [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI             C:\WINDOWS\system32\DRIVERS\pci.sys
17:13:39.0750 3216  PCI - ok
17:13:39.0765 3216  PCIDump - ok
17:13:39.0781 3216  [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde          C:\WINDOWS\system32\drivers\PCIIde.sys
17:13:39.0921 3216  PCIIde - ok
17:13:39.0953 3216  [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia          C:\WINDOWS\system32\drivers\Pcmcia.sys
17:13:40.0078 3216  Pcmcia - ok
17:13:40.0093 3216  PDCOMP - ok
17:13:40.0093 3216  PDFRAME - ok
17:13:40.0109 3216  PDRELI - ok
17:13:40.0109 3216  PDRFRAME - ok
17:13:40.0125 3216  perc2 - ok
17:13:40.0125 3216  perc2hib - ok
17:13:40.0156 3216  [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay        C:\WINDOWS\system32\services.exe
17:13:40.0171 3216  PlugPlay - ok
17:13:40.0203 3216  [ 65BC271F337637731D3C71455AE1F476 ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.dll
17:13:40.0218 3216  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
17:13:40.0218 3216  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
17:13:40.0234 3216  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent     C:\WINDOWS\system32\lsass.exe
17:13:40.0359 3216  PolicyAgent - ok
17:13:40.0359 3216  [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport    C:\WINDOWS\system32\DRIVERS\raspptp.sys
17:13:40.0500 3216  PptpMiniport - ok
17:13:40.0500 3216  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
17:13:40.0625 3216  ProtectedStorage - ok
17:13:40.0656 3216  [ 09298EC810B07E5D582CB3A3F9255424 ] PSched          C:\WINDOWS\system32\DRIVERS\psched.sys
17:13:40.0765 3216  PSched - ok
17:13:40.0781 3216  [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink         C:\WINDOWS\system32\DRIVERS\ptilink.sys
17:13:40.0921 3216  Ptilink - ok
17:13:40.0921 3216  ql1080 - ok
17:13:40.0937 3216  Ql10wnt - ok
17:13:40.0937 3216  ql12160 - ok
17:13:40.0953 3216  ql1240 - ok
17:13:40.0953 3216  ql1280 - ok
17:13:40.0984 3216  [ 0087F01D35A65B32393CC8BBA46EE4A6 ] QV2KUX          C:\WINDOWS\system32\DRIVERS\qv2kux.sys
17:13:41.0125 3216  QV2KUX - ok
17:13:41.0140 3216  [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd          C:\WINDOWS\system32\DRIVERS\rasacd.sys
17:13:41.0265 3216  RasAcd - ok
17:13:41.0296 3216  [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto         C:\WINDOWS\System32\rasauto.dll
17:13:41.0437 3216  RasAuto - ok
17:13:41.0453 3216  [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp         C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
17:13:41.0578 3216  Rasl2tp - ok
17:13:41.0609 3216  [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan          C:\WINDOWS\System32\rasmans.dll
17:13:41.0734 3216  RasMan - ok
17:13:41.0750 3216  [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe        C:\WINDOWS\system32\DRIVERS\raspppoe.sys
17:13:41.0890 3216  RasPppoe - ok
17:13:41.0906 3216  [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti          C:\WINDOWS\system32\DRIVERS\raspti.sys
17:13:42.0046 3216  Raspti - ok
17:13:42.0062 3216  [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss           C:\WINDOWS\system32\DRIVERS\rdbss.sys
17:13:42.0187 3216  Rdbss - ok
17:13:42.0187 3216  [ 4912D5B403614CE99C28420F75353332 ] RDPCDD          C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
17:13:42.0328 3216  RDPCDD - ok
17:13:42.0343 3216  [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr           C:\WINDOWS\system32\DRIVERS\rdpdr.sys
17:13:42.0468 3216  rdpdr - ok
17:13:42.0515 3216  [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD           C:\WINDOWS\system32\drivers\RDPWD.sys
17:13:42.0546 3216  RDPWD - ok
17:13:42.0609 3216  [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr       C:\WINDOWS\system32\sessmgr.exe
17:13:42.0734 3216  RDSessMgr - ok
17:13:42.0750 3216  [ ED761D453856F795A7FE056E42C36365 ] redbook         C:\WINDOWS\system32\DRIVERS\redbook.sys
17:13:42.0890 3216  redbook - ok
17:13:42.0906 3216  [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess    C:\WINDOWS\System32\mprdim.dll
17:13:43.0046 3216  RemoteAccess - ok
17:13:43.0062 3216  [ E4CD1F3D84E1C2CA0B8CF7501E201593 ] RemoteRegistry  C:\WINDOWS\system32\regsvc.dll
17:13:43.0187 3216  RemoteRegistry - ok
17:13:43.0218 3216  [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator      C:\WINDOWS\system32\locator.exe
17:13:43.0359 3216  RpcLocator - ok
17:13:43.0375 3216  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs           C:\WINDOWS\system32\rpcss.dll
17:13:43.0406 3216  RpcSs - ok
17:13:43.0437 3216  [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP            C:\WINDOWS\system32\rsvp.exe
17:13:43.0578 3216  RSVP - ok
17:13:43.0609 3216  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs           C:\WINDOWS\system32\lsass.exe
17:13:43.0718 3216  SamSs - ok
17:13:43.0750 3216  [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr        C:\WINDOWS\System32\SCardSvr.exe
17:13:43.0890 3216  SCardSvr - ok
17:13:43.0921 3216  [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule        C:\WINDOWS\system32\schedsvc.dll
17:13:44.0062 3216  Schedule - ok
17:13:44.0093 3216  [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv          C:\WINDOWS\system32\DRIVERS\secdrv.sys
17:13:44.0156 3216  Secdrv - ok
17:13:44.0171 3216  [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon        C:\WINDOWS\System32\seclogon.dll
17:13:44.0312 3216  seclogon - ok
17:13:44.0328 3216  [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS            C:\WINDOWS\system32\sens.dll
17:13:44.0453 3216  SENS - ok
17:13:44.0468 3216  [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum         C:\WINDOWS\system32\DRIVERS\serenum.sys
17:13:44.0593 3216  serenum - ok
17:13:44.0609 3216  [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial          C:\WINDOWS\system32\DRIVERS\serial.sys
17:13:44.0765 3216  Serial - ok
17:13:44.0781 3216  [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy         C:\WINDOWS\system32\drivers\Sfloppy.sys
17:13:44.0937 3216  Sfloppy - ok
17:13:44.0968 3216  [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess    C:\WINDOWS\System32\ipnathlp.dll
17:13:45.0125 3216  SharedAccess - ok
17:13:45.0156 3216  [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
17:13:45.0171 3216  ShellHWDetection - ok
17:13:45.0171 3216  Simbad - ok
17:13:45.0203 3216  [ FA3368A7039F5ABAA4B933703AC34763 ] smwdm           C:\WINDOWS\system32\drivers\smwdm.sys
17:13:45.0250 3216  smwdm - ok
17:13:45.0281 3216  [ 3978F082274F723AD5A0A8058C2417DD ] SoundMAX Agent Service (default) C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
17:13:45.0281 3216  SoundMAX Agent Service (default) ( UnsignedFile.Multi.Generic ) - warning
17:13:45.0281 3216  SoundMAX Agent Service (default) - detected UnsignedFile.Multi.Generic (1)
17:13:45.0281 3216  Sparrow - ok
17:13:45.0296 3216  [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter        C:\WINDOWS\system32\drivers\splitter.sys
17:13:45.0437 3216  splitter - ok
17:13:45.0468 3216  [ 60784F891563FB1B767F70117FC2428F ] Spooler         C:\WINDOWS\system32\spoolsv.exe
17:13:45.0500 3216  Spooler - ok
17:13:45.0531 3216  [ 50FA898F8C032796D3B1B9951BB5A90F ] sr              C:\WINDOWS\system32\DRIVERS\sr.sys
17:13:45.0609 3216  sr - ok
17:13:45.0625 3216  [ FE77A85495065F3AD59C5C65B6C54182 ] srservice       C:\WINDOWS\system32\srsvc.dll
17:13:45.0703 3216  srservice - ok
17:13:45.0734 3216  [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv             C:\WINDOWS\system32\DRIVERS\srv.sys
17:13:45.0796 3216  Srv - ok
17:13:45.0812 3216  [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV         C:\WINDOWS\System32\ssdpsrv.dll
17:13:45.0890 3216  SSDPSRV - ok
17:13:45.0937 3216  [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv          C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
17:13:45.0953 3216  ssmdrv - ok
17:13:45.0953 3216  SSPORT - ok
17:13:45.0968 3216  [ A2DBCC4C8860449DF1AB758EA28B4DE0 ] StillCam        C:\WINDOWS\system32\DRIVERS\serscan.sys
17:13:46.0093 3216  StillCam - ok
17:13:46.0125 3216  [ BC2C5985611C5356B24AEB370953DED9 ] stisvc          C:\WINDOWS\system32\wiaservc.dll
17:13:46.0281 3216  stisvc - ok
17:13:46.0296 3216  [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum          C:\WINDOWS\system32\DRIVERS\swenum.sys
17:13:46.0421 3216  swenum - ok
17:13:46.0453 3216  [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi          C:\WINDOWS\system32\drivers\swmidi.sys
17:13:46.0578 3216  swmidi - ok
17:13:46.0593 3216  SwPrv - ok
17:13:46.0593 3216  symc810 - ok
17:13:46.0593 3216  symc8xx - ok
17:13:46.0609 3216  sym_hi - ok
17:13:46.0609 3216  sym_u3 - ok
17:13:46.0625 3216  [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio        C:\WINDOWS\system32\drivers\sysaudio.sys
17:13:46.0750 3216  sysaudio - ok
17:13:46.0781 3216  [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog       C:\WINDOWS\system32\smlogsvc.exe
17:13:46.0921 3216  SysmonLog - ok
17:13:46.0953 3216  [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv         C:\WINDOWS\System32\tapisrv.dll
17:13:47.0093 3216  TapiSrv - ok
17:13:47.0109 3216  [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip           C:\WINDOWS\system32\DRIVERS\tcpip.sys
17:13:47.0140 3216  Tcpip - ok
17:13:47.0187 3216  [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE          C:\WINDOWS\system32\drivers\TDPIPE.sys
17:13:47.0312 3216  TDPIPE - ok
17:13:47.0328 3216  [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP           C:\WINDOWS\system32\drivers\TDTCP.sys
17:13:47.0453 3216  TDTCP - ok
17:13:47.0484 3216  [ 88155247177638048422893737429D9E ] TermDD          C:\WINDOWS\system32\DRIVERS\termdd.sys
17:13:47.0625 3216  TermDD - ok
17:13:47.0640 3216  [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService     C:\WINDOWS\System32\termsrv.dll
17:13:47.0781 3216  TermService - ok
17:13:47.0796 3216  [ 2DB7D303C36DDD055215052F118E8E75 ] Themes          C:\WINDOWS\System32\shsvcs.dll
17:13:47.0812 3216  Themes - ok
17:13:47.0843 3216  [ 03681A1CE77F51586903869A5AB1DEAB ] TlntSvr         C:\WINDOWS\system32\tlntsvr.exe
17:13:47.0921 3216  TlntSvr - ok
17:13:47.0937 3216  TosIde - ok
17:13:47.0953 3216  [ 626504572B175867F30F3215C04B3E2F ] TrkWks          C:\WINDOWS\system32\trkwks.dll
17:13:48.0093 3216  TrkWks - ok
17:13:48.0109 3216  [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs            C:\WINDOWS\system32\drivers\Udfs.sys
17:13:48.0234 3216  Udfs - ok
17:13:48.0250 3216  ultra - ok
17:13:48.0281 3216  [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update          C:\WINDOWS\system32\DRIVERS\update.sys
17:13:48.0421 3216  Update - ok
17:13:48.0453 3216  [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost        C:\WINDOWS\System32\upnphost.dll
17:13:48.0546 3216  upnphost - ok
17:13:48.0562 3216  [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS             C:\WINDOWS\System32\ups.exe
17:13:48.0687 3216  UPS - ok
17:13:48.0718 3216  [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp         C:\WINDOWS\system32\DRIVERS\usbccgp.sys
17:13:48.0843 3216  usbccgp - ok
17:13:48.0875 3216  [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci         C:\WINDOWS\system32\DRIVERS\usbehci.sys
17:13:49.0015 3216  usbehci - ok
17:13:49.0031 3216  [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub          C:\WINDOWS\system32\DRIVERS\usbhub.sys
17:13:49.0171 3216  usbhub - ok
17:13:49.0187 3216  [ A717C8721046828520C9EDF31288FC00 ] usbprint        C:\WINDOWS\system32\DRIVERS\usbprint.sys
17:13:49.0312 3216  usbprint - ok
17:13:49.0328 3216  [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR         C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
17:13:49.0468 3216  USBSTOR - ok
17:13:49.0484 3216  [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci         C:\WINDOWS\system32\DRIVERS\usbuhci.sys
17:13:49.0609 3216  usbuhci - ok
17:13:49.0625 3216  [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave         C:\WINDOWS\System32\drivers\vga.sys
17:13:49.0750 3216  VgaSave - ok
17:13:49.0750 3216  ViaIde - ok
17:13:49.0765 3216  [ A5A712F4E880874A477AF790B5186E1D ] VolSnap         C:\WINDOWS\system32\drivers\VolSnap.sys
17:13:49.0906 3216  VolSnap - ok
17:13:49.0953 3216  [ 68F106273BE29E7B7EF8266977268E78 ] VSS             C:\WINDOWS\System32\vssvc.exe
17:13:50.0062 3216  VSS - ok
17:13:50.0093 3216  [ 7B353059E665F8B7AD2BBEAEF597CF45 ] W32Time         C:\WINDOWS\system32\w32time.dll
17:13:50.0203 3216  W32Time - ok
17:13:50.0218 3216  [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp          C:\WINDOWS\system32\DRIVERS\wanarp.sys
17:13:50.0359 3216  Wanarp - ok
17:13:50.0359 3216  WDICA - ok
17:13:50.0375 3216  [ 6768ACF64B18196494413695F0C3A00F ] wdmaud          C:\WINDOWS\system32\drivers\wdmaud.sys
17:13:50.0500 3216  wdmaud - ok
17:13:50.0531 3216  [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient       C:\WINDOWS\System32\webclnt.dll
17:13:50.0656 3216  WebClient - ok
17:13:50.0703 3216  [ 6F3F3973D97714CC5F906A19FE883729 ] winmgmt         C:\WINDOWS\system32\wbem\WMIsvc.dll
17:13:50.0828 3216  winmgmt - ok
17:13:50.0890 3216  [ 6E18978B749F0696A774DE3F2CB142DD ] WmdmPmSN        C:\WINDOWS\system32\mspmsnsv.dll
17:13:51.0015 3216  WmdmPmSN - ok
17:13:51.0062 3216  [ FFA4D901D46D07A5BAB2D8307FBB51A6 ] Wmi             C:\WINDOWS\System32\advapi32.dll
17:13:51.0125 3216  Wmi - ok
17:13:51.0156 3216  [ 93908111BA57A6E60EC2FA2DE202105C ] WmiApSrv        C:\WINDOWS\system32\wbem\wmiapsrv.exe
17:13:51.0281 3216  WmiApSrv - ok
17:13:51.0296 3216  [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL         C:\WINDOWS\System32\drivers\ws2ifsl.sys
17:13:51.0421 3216  WS2IFSL - ok
17:13:51.0453 3216  [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc          C:\WINDOWS\system32\wscsvc.dll
17:13:51.0593 3216  wscsvc - ok
17:13:51.0593 3216  WSearch - ok
17:13:51.0609 3216  [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv        C:\WINDOWS\system32\wuauserv.dll
17:13:51.0750 3216  wuauserv - ok
17:13:51.0781 3216  [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC          C:\WINDOWS\System32\wzcsvc.dll
17:13:51.0921 3216  WZCSVC - ok
17:13:51.0953 3216  [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov         C:\WINDOWS\System32\xmlprov.dll
17:13:52.0078 3216  xmlprov - ok
17:13:52.0093 3216  ================ Scan global ===============================
17:13:52.0109 3216  [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll
17:13:52.0140 3216  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
17:13:52.0187 3216  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
17:13:52.0203 3216  [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe
17:13:52.0203 3216  [Global] - ok
17:13:52.0203 3216  ================ Scan MBR ==================================
17:13:52.0218 3216  [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk0\DR0
17:13:52.0500 3216  \Device\Harddisk0\DR0 - ok
17:13:52.0500 3216  ================ Scan VBR ==================================
17:13:52.0515 3216  [ 89DD79D2F124A000831697A2246A247C ] \Device\Harddisk0\DR0\Partition1
17:13:52.0531 3216  \Device\Harddisk0\DR0\Partition1 - ok
17:13:52.0546 3216  [ 2248DC44663A185F45200B8E73439789 ] \Device\Harddisk0\DR0\Partition2
17:13:52.0546 3216  \Device\Harddisk0\DR0\Partition2 - ok
17:13:52.0546 3216  ============================================================
17:13:52.0546 3216  Scan finished
17:13:52.0546 3216  ============================================================
17:13:52.0656 3112  Detected object count: 4
17:13:52.0656 3112  Actual detected object count: 4
17:14:55.0250 3112  aspnet_state ( UnsignedFile.Multi.Generic ) - skipped by user
17:14:55.0250 3112  aspnet_state ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:14:55.0250 3112  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
17:14:55.0250 3112  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:14:55.0250 3112  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
17:14:55.0250 3112  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
17:14:55.0250 3112  SoundMAX Agent Service (default) ( UnsignedFile.Multi.Generic ) - skipped by user
17:14:55.0265 3112  SoundMAX Agent Service (default) ( UnsignedFile.Multi.Generic ) - User select action: Skip
         
aswMBR.txt:
Code:
ATTFilter
C-Partition
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-14 13:45:52
-----------------------------
13:45:52.515    OS Version: Windows 5.1.2600 Service Pack 3
13:45:52.515    Number of processors: 2 586 0x304
13:45:52.515    ComputerName: HENRYFORD  UserName: BinnebMa
13:45:53.078    Initialize success
13:54:09.515    AVAST engine defs: 12111400
13:54:20.312    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
13:54:20.328    Disk 0 Vendor: WDC_WD400BB-22HEA1 14.03G14 Size: 38166MB BusType: 3
13:54:20.343    Disk 0 MBR read successfully
13:54:20.343    Disk 0 MBR scan
13:54:20.421    Disk 0 Windows XP default MBR code
13:54:20.453    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        20000 MB offset 63
13:54:20.468    Disk 0 Partition - 00     0F Extended LBA             18154 MB offset 40960080
13:54:20.484    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS        18154 MB offset 40960143
13:54:20.500    Disk 0 scanning sectors +78140160
13:54:20.625    Disk 0 scanning C:\WINDOWS\system32\drivers
13:54:31.656    Service scanning
13:55:21.968    Modules scanning
13:55:59.281    Disk 0 trace - called modules:
13:55:59.296    
13:56:01.187    AVAST engine scan C:\
14:59:34.656    Scan finished successfully

D-Partition
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-14 15:17:18
-----------------------------
15:17:18.453    OS Version: Windows 5.1.2600 Service Pack 3
15:17:18.453    Number of processors: 2 586 0x304
15:17:18.453    ComputerName: HENRYFORD  UserName: BinnebMa
15:17:18.984    Initialize success
15:17:33.015    AVAST engine defs: 12111400
15:17:41.500    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
15:17:41.500    Disk 0 Vendor: WDC_WD400BB-22HEA1 14.03G14 Size: 38166MB BusType: 3
15:17:41.578    Disk 0 MBR read successfully
15:17:41.578    Disk 0 MBR scan
15:17:41.671    Disk 0 Windows XP default MBR code
15:17:41.703    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        20000 MB offset 63
15:17:41.703    Disk 0 Partition - 00     0F Extended LBA             18154 MB offset 40960080
15:17:41.765    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS        18154 MB offset 40960143
15:17:41.828    Disk 0 scanning sectors +78140160
15:17:42.218    Disk 0 scanning C:\WINDOWS\system32\drivers
15:18:04.375    Service scanning
15:18:22.078    Modules scanning
15:18:54.515    Disk 0 trace - called modules:
15:18:54.546    
15:18:54.734    AVAST engine scan D:\
15:26:40.937    Scan finished successfully
         
OTL.txt:
Code:
ATTFilter
OTL logfile created on: 15.11.2012 16:18:33 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Dokumente und Einstellungen\BinnebMa\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,50 Gb Total Physical Memory | 1,04 Gb Available Physical Memory | 69,27% Memory free
3,35 Gb Paging File | 2,91 Gb Available in Paging File | 86,85% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 19,53 Gb Total Space | 0,96 Gb Free Space | 4,89% Space Free | Partition Type: NTFS
Drive D: | 17,73 Gb Total Space | 16,05 Gb Free Space | 90,51% Space Free | Partition Type: NTFS
Drive K: | 4613,45 Gb Total Space | 1910,35 Gb Free Space | 41,41% Space Free | Partition Type: NTFS
Drive P: | 4613,45 Gb Total Space | 1910,35 Gb Free Space | 41,41% Space Free | Partition Type: NTFS
Drive V: | 4613,45 Gb Total Space | 1910,35 Gb Free Space | 41,41% Space Free | Partition Type: NTFS
 
Computer Name: HENRYFORD | User Name: BinnebMa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.11.15 16:13:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\OTL.exe
PRC - [2012.11.06 18:29:54 | 000,384,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.10.16 17:06:12 | 000,084,256 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.10.16 16:57:04 | 000,108,320 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.09.19 18:20:40 | 000,079,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.01.02 09:07:56 | 000,843,712 | R--- | M] (Adobe Systems Incorporated) -- C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
PRC - [2011.06.09 13:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
PRC - [2009.07.14 16:15:50 | 000,622,592 | ---- | M] () -- C:\WINDOWS\Xerox\PanelMgr\SSMMgr.exe
PRC - [2009.04.09 11:04:50 | 000,266,240 | ---- | M] (XEROX) -- C:\Programme\xerox\NetworkScan\NSCSysUI_XEROX.exe
PRC - [2008.04.14 13:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2003.05.08 10:34:32 | 000,069,632 | ---- | M] (adi) -- C:\Programme\Analog Devices\SoundMAX\DrvLsnr.exe
PRC - [2003.05.05 07:57:30 | 000,143,360 | ---- | M] (Analog Devices, Inc.) -- C:\Programme\Analog Devices\SoundMAX\SMTray.exe
PRC - [2002.09.20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.09.19 18:17:40 | 000,397,088 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2009.07.14 16:15:50 | 000,622,592 | ---- | M] () -- C:\WINDOWS\Xerox\PanelMgr\SSMMgr.exe
MOD - [2009.04.02 09:21:58 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\XeroxFaxPort.dll
MOD - [2008.06.05 13:45:36 | 000,026,624 | ---- | M] () -- C:\WINDOWS\system32\ssh1ml3.dll
MOD - [2001.10.28 16:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012.10.29 13:00:25 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.10.16 17:06:12 | 000,084,256 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.10.16 16:57:04 | 000,108,320 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.10.09 10:14:07 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2002.09.20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\SSPORT.sys -- (SSPORT)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2012.11.07 16:03:24 | 000,133,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.11.07 16:03:24 | 000,083,432 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.11.07 16:03:24 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012.08.27 14:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.07.25 00:18:32 | 000,176,640 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2008.06.06 08:15:40 | 000,098,816 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\baspxp32.sys -- (Blfp)
DRV - [2001.08.17 13:53:32 | 000,003,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qv2kux.sys -- (QV2KUX)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C6 B5 A7 E6 6E 68 CC 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{16625B85-803E-40E9-ABD1-BF0523AB2971}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-W1&o=100000080&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=JM&apn_dtid=YYYYYYYYDE&apn_uid=5c2e7b71-3484-404e-9953-27561c9c7a2a&apn_sauid=21D19F8A-A283-4BA7-B3B6-C600C2343C03
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: D:\Programme\Mozilla Firefox\components [2012.10.29 13:00:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins [2012.10.29 13:00:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: D:\Programme\Mozilla Thunderbird\components [2011.08.31 14:37:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Plugins: D:\Programme\Mozilla Thunderbird\plugins
 
[2011.08.31 14:52:48 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Mozilla\Extensions
[2012.10.23 07:47:51 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Mozilla\Firefox\Profiles\ovh7ib34.default\extensions
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage: hxxp://www.google.com
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Programme\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Programme\Google\Chrome\Application\23.0.1271.64\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Programme\Google\Chrome\Application\23.0.1271.64\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programme\Windows Media Player\npdsplay.dll
CHR - plugin: Adobe Acrobat (Disabled) = D:\Programme\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL
CHR - Extension: YouTube = C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google-Suche = C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Google Mail = C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2008.04.14 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DrvLsnr] C:\Programme\Analog Devices\SoundMAX\DrvLsnr.exe (adi)
O4 - HKLM..\Run: [NSCSysTrayUI_XEROX] C:\Programme\XEROX\NetworkScan\NSCSysUI_XEROX.exe (XEROX)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Xerox PanelMgr] C:\WINDOWS\Xerox\PanelMgr\SSMMgr.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An OneNote s&enden - D:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - D:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1253616306953 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F1022C60-21E0-4736-9D47-1C9CD19E09C7}: NameServer = 194.25.2.129,192.168.1.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.09.22 09:11:54 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.15 16:13:32 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\OTL.exe
[2012.11.15 08:10:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2012.11.14 16:23:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Avira
[2012.11.14 16:17:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
[2012.11.14 16:16:56 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2012.11.14 16:16:46 | 000,133,824 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.11.14 16:16:46 | 000,083,432 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012.11.14 16:16:46 | 000,036,552 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012.11.14 16:16:45 | 000,000,000 | ---D | C] -- C:\Programme\Avira
[2012.11.14 16:16:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
[2012.11.14 13:24:31 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2012.11.14 13:04:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Windows Search
[2012.10.18 11:29:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\Romans Testordner
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.15 16:17:15 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\BinnebMa\defogger_reenable
[2012.11.15 16:16:23 | 000,174,706 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012.11.15 16:16:21 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.11.15 16:16:20 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.11.15 16:14:25 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\jzg664rc.exe
[2012.11.15 16:13:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\OTL.exe
[2012.11.15 16:13:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.11.15 16:12:50 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\Defogger.exe
[2012.11.15 15:46:00 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.11.15 08:06:07 | 000,000,322 | ---- | M] () -- C:\WINDOWS\tasks\zxowq.job
[2012.11.15 08:05:50 | 000,000,320 | ---- | M] () -- C:\WINDOWS\tasks\UHQKZPYVER.job
[2012.11.15 08:05:48 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.11.12 10:28:02 | 000,122,880 | RHS- | M] () -- C:\WINDOWS\System32\msfeedsm.dll
[2012.11.12 10:28:02 | 000,122,880 | RHS- | M] () -- C:\WINDOWS\System32\dmviewb.dll
[2012.11.07 16:03:24 | 000,133,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.11.07 16:03:24 | 000,083,432 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012.11.07 16:03:24 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012.10.29 11:31:19 | 000,419,334 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.10.29 11:31:19 | 000,383,254 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.10.29 11:31:19 | 000,074,396 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.10.29 11:31:19 | 000,053,608 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.15 16:17:15 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\BinnebMa\defogger_reenable
[2012.11.15 16:14:23 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\jzg664rc.exe
[2012.11.15 16:12:49 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\Defogger.exe
[2012.11.12 10:28:02 | 000,122,880 | RHS- | C] () -- C:\WINDOWS\System32\msfeedsm.dll
[2012.11.12 10:28:02 | 000,122,880 | RHS- | C] () -- C:\WINDOWS\System32\dmviewb.dll
[2012.11.12 10:28:02 | 000,000,322 | ---- | C] () -- C:\WINDOWS\tasks\zxowq.job
[2012.11.12 10:28:02 | 000,000,320 | ---- | C] () -- C:\WINDOWS\tasks\UHQKZPYVER.job
[2012.02.16 17:39:46 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.09.22 14:14:34 | 000,007,646 | ---- | C] () -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\XeroxFaxOptions.xml
[2011.09.20 13:22:42 | 000,018,944 | ---- | C] () -- C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.17 07:48:39 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\SecSNMP.dll
[2011.08.17 07:48:38 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\XeroxFaxPort.dll
[2011.08.17 07:48:19 | 000,483,328 | ---- | C] () -- C:\WINDOWS\ssndii.exe
[2011.08.17 07:47:53 | 000,110,592 | ---- | C] () -- C:\WINDOWS\Wiainst.exe
[2011.08.17 07:47:38 | 000,138,240 | ---- | C] () -- C:\WINDOWS\System32\Ssuiext.dll
[2011.08.17 07:47:37 | 000,265,216 | ---- | C] () -- C:\WINDOWS\System32\Sswiadrv.dll
[2011.08.17 07:47:37 | 000,139,776 | ---- | C] () -- C:\WINDOWS\System32\WIAEH.dll
[2011.08.17 07:47:37 | 000,116,736 | ---- | C] () -- C:\WINDOWS\System32\WIAIPH.dll
[2011.08.17 07:47:37 | 000,087,040 | ---- | C] () -- C:\WINDOWS\System32\WIASTIIO.dll
[2011.08.17 07:47:34 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\ssh1ml3.dll
[2010.11.22 15:17:15 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
 
========== ZeroAccess Check ==========
 
[2009.10.21 16:46:27 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2009.07.18 17:03:13 | 001,509,888 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 13:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.07.04 11:10:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Thunderbird
[2011.11.07 10:44:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Windows Desktop Search
[2012.11.14 13:04:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Windows Search
[2011.09.22 14:14:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Xerox
 
========== Purity Check ==========
 
 

< End of report >
         
EXTRAS.txt:
Code:
ATTFilter
OTL Extras logfile created on: 15.11.2012 16:18:33 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Dokumente und Einstellungen\BinnebMa\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,50 Gb Total Physical Memory | 1,04 Gb Available Physical Memory | 69,27% Memory free
3,35 Gb Paging File | 2,91 Gb Available in Paging File | 86,85% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 19,53 Gb Total Space | 0,96 Gb Free Space | 4,89% Space Free | Partition Type: NTFS
Drive D: | 17,73 Gb Total Space | 16,05 Gb Free Space | 90,51% Space Free | Partition Type: NTFS
Drive K: | 4613,45 Gb Total Space | 1910,35 Gb Free Space | 41,41% Space Free | Partition Type: NTFS
Drive P: | 4613,45 Gb Total Space | 1910,35 Gb Free Space | 41,41% Space Free | Partition Type: NTFS
Drive V: | 4613,45 Gb Total Space | 1910,35 Gb Free Space | 41,41% Space Free | Partition Type: NTFS
 
Computer Name: HENRYFORD | User Name: BinnebMa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "D:\Programme\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Temp\hp_LJ3050-3052-3055-3390-3392_Full_Solution\setup\hppniprint01.exe" = C:\Temp\hp_LJ3050-3052-3055-3390-3392_Full_Solution\setup\hppniprint01.exe:*:Enabled:hppniprint01.exe -- (Hewlett-Packard)
"C:\Temp\hp_LJ3050-3052-3055-3390-3392_Full_Solution\setup\hpntwkexe.exe" = C:\Temp\hp_LJ3050-3052-3055-3390-3392_Full_Solution\setup\hpntwkexe.exe:*:Enabled:hpntwkexe.exe -- (Hewlett-Packard)
"C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\RarSFX0\Windows Utilities\Installer32\InstallationManager.exe" = C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\RarSFX0\Windows Utilities\Installer32\InstallationManager.exe:*:Enabled:Xerox Windows Common Installer
"D:\Programme\totalcmd\TOTALCMD.EXE" = D:\Programme\totalcmd\TOTALCMD.EXE:*:Disabled:Total Commander 32 bit -- (Ghisler Software GmbH)
"D:\Programme\Microsoft Office\Office14\ONENOTE.EXE" = D:\Programme\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote -- (Microsoft Corporation)
"D:\Programme\Microsoft Office\Office14\OUTLOOK.EXE" = D:\Programme\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Programme\xerox\NetworkScan\NSCSysUI_XEROX.exe" = C:\Programme\xerox\NetworkScan\NSCSysUI_XEROX.exe:*:Enabled:SysTrayUI Module -- (XEROX)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5BA1655E-6CF5-47C7-95F0-311D4F676021}" = 
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{7BB045C3-D5E4-4620-B536-DC11AACD5942}" = Broadcom Management Programs
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
"{90140000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 14
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C5725B7-2219-410C-A364-90767F71F00C}" = Network Scan
"{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F870B987-18BC-45FC-9BE8-35C02DCDA10F}" = Broadcom NetXtreme Ethernet Controller
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Avira AntiVir Desktop" = Avira Free Antivirus
"Google Chrome" = Google Chrome
"ie8" = Windows Internet Explorer 8
"IrfanView" = IrfanView (remove only)
"KONICA MINOLTA magicolor 5570 Installer" = KONICA MINOLTA magicolor 5570
"Lightscreen" = Lightscreen
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
"Mozilla Thunderbird (2.0.0.24)" = Mozilla Thunderbird (2.0.0.24)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.SingleImage" = Microsoft Office Home and Business 2010
"Scan2PDF_is1" = Scan2PDF 1.6
"Totalcmd" = Total Commander (Remove or Repair)
"VLC media player" = VLC media player 2.0.1
"Xerox Phaser 3300MFP" = Xerox Phaser 3300MFP
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 12.11.2012 07:57:12 | Computer Name = HENRYFORD | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x4ebb74b2.
 
[ System Events ]
Error - 12.11.2012 02:59:16 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 13.11.2012 03:13:41 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 14.11.2012 04:34:54 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 14.11.2012 08:28:00 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 14.11.2012 08:28:00 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   PCIIde
 
Error - 14.11.2012 08:38:47 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 14.11.2012 10:47:11 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 14.11.2012 10:51:54 | Computer Name = HENRYFORD | Source = Print | ID = 19
Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker KONICA MINOLTA
 mc5570 PCL6, Freigabename Drucker4.
 
Error - 14.11.2012 10:53:14 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 15.11.2012 03:07:28 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
 
< End of report >
         
Gmer.txt:
Code:
ATTFilter
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-11-15 17:55:11
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD400BB-22HEA1 rev.14.03G14
Running: jzg664rc.exe; Driver: C:\DOKUME~1\BinnebMa\LOKALE~1\Temp\fwriapob.sys


---- System - GMER 1.0.15 ----

SSDT   F7A79784                                                           ZwClose
SSDT   F7A7973E                                                           ZwCreateKey
SSDT   F7A7978E                                                           ZwCreateSection
SSDT   F7A79734                                                           ZwCreateThread
SSDT   F7A79743                                                           ZwDeleteKey
SSDT   F7A7974D                                                           ZwDeleteValueKey
SSDT   F7A7977F                                                           ZwDuplicateObject
SSDT   F7A79752                                                           ZwLoadKey
SSDT   F7A79720                                                           ZwOpenProcess
SSDT   F7A79725                                                           ZwOpenThread
SSDT   F7A797A7                                                           ZwQueryValueKey
SSDT   F7A7975C                                                           ZwReplaceKey
SSDT   F7A79798                                                           ZwRequestWaitReplyPort
SSDT   F7A79757                                                           ZwRestoreKey
SSDT   F7A79793                                                           ZwSetContextThread
SSDT   F7A7979D                                                           ZwSetSecurityObject
SSDT   F7A79748                                                           ZwSetValueKey
SSDT   F7A797A2                                                           ZwSystemDebugControl
SSDT   F7A7972F                                                           ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text  C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                           section is writeable [0xB9985360, 0x372FAD, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text  C:\WINDOWS\system32\SearchIndexer.exe[368] kernel32.dll!WriteFile  7C810E27 7 Bytes  JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----
         
Ich hoffe das hilft erstmal als 1. Anhaltspunkt und auch, dass ihr mir weiterhelfen könnt!

Danke schonmal im Vorraus!

lebierle

Alt 19.11.2012, 23:47   #2
Swisstreasure
/// Malwareteam
 
Umleitung auf ihavenet.com - Standard

Umleitung auf ihavenet.com





Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
  • Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
  • Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
  • Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1
  • Starte bitte die OTL.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere nun den Inhalt in die Textbox.
Code:
ATTFilter
:OTL
[2012.11.15 08:06:07 | 000,000,322 | ---- | M] () -- C:\WINDOWS\tasks\zxowq.job
[2012.11.15 08:05:50 | 000,000,320 | ---- | M] () -- C:\WINDOWS\tasks\UHQKZPYVER.job
[2012.11.12 10:28:02 | 000,122,880 | RHS- | C] () -- C:\WINDOWS\System32\msfeedsm.dll
[2012.11.12 10:28:02 | 000,122,880 | RHS- | C] () -- C:\WINDOWS\System32\dmviewb.dll
[2012.11.12 10:28:02 | 000,000,322 | ---- | C] () -- C:\WINDOWS\tasks\zxowq.job
[2012.11.12 10:28:02 | 000,000,320 | ---- | C] () -- C:\WINDOWS\tasks\UHQKZPYVER.job
:Commands
[purity]
[emptytemp]
         
  • Schliesse bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread


Schritt 2

Downloade Dir bitte Malwarebytes
  • Installiere das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.
__________________


Alt 20.11.2012, 16:12   #3
lebierle
 
Umleitung auf ihavenet.com - Standard

Umleitung auf ihavenet.com



Danke schonmal für die schnell Antwort! Habe beides gemacht aber bei dem Scan mit Malewarebytes hat es nichts gefunden, was aber auch im Logfile steht.

Bei den spontanen Tests jetzt grade hat die Umleitung über Google einwandfrei funktioniert (Firefox / IE / Chrome) aber ich werde es weiter beobachten und mich nochmal melden (kann ja grade nur Zufall sein).

OTL:
Code:
ATTFilter
All processes killed
========== OTL ==========
C:\WINDOWS\tasks\zxowq.job moved successfully.
C:\WINDOWS\tasks\UHQKZPYVER.job moved successfully.
C:\WINDOWS\system32\msfeedsm.dll moved successfully.
C:\WINDOWS\system32\dmviewb.dll moved successfully.
File C:\WINDOWS\tasks\zxowq.job not found.
File C:\WINDOWS\tasks\UHQKZPYVER.job not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 132006520 bytes
->Temporary Internet Files folder emptied: 17263678 bytes
->FireFox cache emptied: 4264723 bytes
->Flash cache emptied: 592 bytes
 
User: All Users
 
User: BinnebMa
->Temp folder emptied: 136081551 bytes
->Temporary Internet Files folder emptied: 507965316 bytes
->Java cache emptied: 18227871 bytes
->FireFox cache emptied: 284818303 bytes
->Google Chrome cache emptied: 6391524 bytes
->Flash cache emptied: 16156 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: ******
->Temp folder emptied: 123480510 bytes
->Temporary Internet Files folder emptied: 342572984 bytes
->FireFox cache emptied: 58682941 bytes
->Flash cache emptied: 14825 bytes
 
User: *****
->Temp folder emptied: 455344 bytes
->Temporary Internet Files folder emptied: 91403434 bytes
->FireFox cache emptied: 99184983 bytes
->Flash cache emptied: 2012 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 98706 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 17209027 bytes
%systemroot%\System32 .tmp files removed: 21968263 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 74708722 bytes
RecycleBin emptied: 11939592 bytes
 
Total Files Cleaned = 1.859,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 11202012_153814

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         
Malewarebytes:
Code:
ATTFilter
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.20.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
BinnebMa :: HENRYFORD [Administrator]

20.11.2012 15:51:18
mbam-log-2012-11-20 (15-51-18).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 258199
Laufzeit: 3 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         
Danke und Gruss
lebierle
__________________

Alt 20.11.2012, 22:08   #4
Swisstreasure
/// Malwareteam
 
Umleitung auf ihavenet.com - Standard

Umleitung auf ihavenet.com



Schritt 1


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Antwort

Themen zu Umleitung auf ihavenet.com
.com, 32 bit, aswmbr, avira, bho, browser, computer, desktop, error, firefox, flash player, format, helper, homepage, iexplore.exe, lanmanworkstation, object, policyagent, problem, rootkit, rundll, scan, security, senden, trojaner, trojaner board, unsignedfile.multi.generic, usb, windows, windows internet, windows xp, wsearch



Ähnliche Themen: Umleitung auf ihavenet.com


  1. Trojaner - Umleitung bei Google-Suche (ihavenet)
    Log-Analyse und Auswertung - 30.09.2013 (30)
  2. ihavenet auf XP
    Log-Analyse und Auswertung - 27.08.2013 (11)
  3. Firefox Google Newsbuster/Ihavenet Umleitung
    Log-Analyse und Auswertung - 29.07.2013 (13)
  4. Newsbuster- ihavenet-Umleitung
    Log-Analyse und Auswertung - 25.07.2013 (15)
  5. Umleitung auf ihavenet & newsbusters und andere Seiten
    Plagegeister aller Art und deren Bekämpfung - 04.07.2013 (9)
  6. Umleitung auf "ihavenet", "newsbusters" und andere Seiten
    Plagegeister aller Art und deren Bekämpfung - 06.04.2013 (21)
  7. ihavenet.com google Umleitung
    Plagegeister aller Art und deren Bekämpfung - 04.04.2013 (14)
  8. Ihavenet.com Trojaner/Virus mit Umleitung von google-Suchanfragen - Verzweiflung
    Plagegeister aller Art und deren Bekämpfung - 21.03.2013 (15)
  9. Google Umleitung auf "ihavenet.com"
    Log-Analyse und Auswertung - 16.03.2013 (9)
  10. Google Umleitung ihavenet sporadisch
    Log-Analyse und Auswertung - 11.03.2013 (1)
  11. ihavenet / Umleitung falsche Internetseiten
    Plagegeister aller Art und deren Bekämpfung - 02.01.2013 (15)
  12. Problem mit ihavenet google-Umleitung im Firefox
    Log-Analyse und Auswertung - 24.12.2012 (12)
  13. Ihavenet Virus - Umleitung bei Googlesuchanfragen
    Plagegeister aller Art und deren Bekämpfung - 21.12.2012 (16)
  14. ihavenet.com II
    Plagegeister aller Art und deren Bekämpfung - 19.12.2012 (11)
  15. ihavenet.com
    Plagegeister aller Art und deren Bekämpfung - 18.12.2012 (48)
  16. Ihavenet.com
    Log-Analyse und Auswertung - 27.11.2012 (5)
  17. Ihavenet.com Browser Hijacker- bei Googlesuche öffnen sich andere Seiten (Weiterleitung über Ihavenet.com)
    Log-Analyse und Auswertung - 21.11.2012 (13)

Zum Thema Umleitung auf ihavenet.com - Hallo liebes Trojaner Board! Mein Computer hat seit kurzem das Problem, dass man sobald man auf einen Link im Google-Suchergebnis klickt auf "ihavenet.com" oder manchmal auch andere Seiten weitergeleitet wird. - Umleitung auf ihavenet.com...
Archiv
Du betrachtest: Umleitung auf ihavenet.com auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.