Trojaner-Board - Weißer Sperrbildschirm - Kein Zugriff auf den Rechner mehr

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Weißer Sperrbildschirm - Kein Zugriff auf den Rechner mehr (https://www.trojaner-board.de/115988-weisser-sperrbildschirm-kein-zugriff-rechner-mehr.html)

Weißer Sperrbildschirm - Kein Zugriff auf den Rechner mehr

Hallo

habe seit zwei Tagen einen weißen Sperrbildschirm mit der Meldung: "Bitte warten, die Verbindung wird hergestellt" (das Ganze dann auch noch mal auf English).

Der Bildschirm wird für alle Benutzer sowohl im normalen, als auch im abgesicherten Modus direkt nach dem Log - In gesperrt und ich kann keinen Zugriff mehr auf den Rechner bekommen. Im abgesicherten Modus mit Eingabeaufforderung kann ich nicht so schnell tippen, wie der Bildschirm wieder gesperrt wird.

Ich habe mir die OTLPE CD von einem sauberen Rechner aus runter geladen, den gesperrten Rechner damit gescannt.

Ich bewege mich erstmalig in einem solchen Forum. Wenn mir jemand mit den unten gezeigten Auswertungsdaten meines gesperrten Rechners weiterhelfen kann, wäre ich super dankbar, damit ich den Rechner wieder gängig bekomme.

Herzlichen Dank für die Hilfe schon jetzt!

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O4 - HKLM..\Run: [B64Fu7wxCKTba7x] C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe ()

O4 - HKU\Administrator_ON_C..\Run: [B64Fu7wxCKTba7x] C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe ()

O4 - HKU\Administrator_ON_C..\Run: [sdsetup2011 (1)]  File not found

O4 - HKU\Lutz_ON_C..\Run: [B64Fu7wxCKTba7x] C:\Dokumente und Einstellungen\Lutz\Anwendungsdaten\ArchiverforWin.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]

O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Lutz_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Lutz_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKU\Lutz_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\Lutz_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O7 - HKU\mbecker_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe) - C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe ()

O20 - HKLM Winlogon: UserInit - (C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe) - C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe ()

O20 - HKU\Administrator_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe) - C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe ()

O20 - HKU\Administrator_ON_C Winlogon: UserInit - (C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe) - C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe ()

O20 - HKU\Lutz_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\Lutz\Anwendungsdaten\ArchiverforWin.exe) - C:\Dokumente und Einstellungen\Lutz\Anwendungsdaten\ArchiverforWin.exe ()

O20 - HKU\Lutz_ON_C Winlogon: UserInit - (C:\Dokumente und Einstellungen\Lutz\Anwendungsdaten\ArchiverforWin.exe) - C:\Dokumente und Einstellungen\Lutz\Anwendungsdaten\ArchiverforWin.exe ()

O27 - HKLM IFEO\afwserv.exe: Debugger - svchost.exe (Microsoft Corporation)

O27 - HKLM IFEO\avastsvc.exe: Debugger - svchost.exe (Microsoft Corporation)

O27 - HKLM IFEO\avastui.exe: Debugger - svchost.exe (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2005/04/16 13:25:10 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

O33 - MountPoints2\{d1ca0a56-c479-11d9-ba1b-00115046ccc4}\Shell\AutoRun\command - "" = E:\starter.exe

@Alternate Data Stream - 928 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:C65F2A88

:Files

C:\Dokumente und Einstellungen\Lutz\Anwendungsdaten\ArchiverforWin.exe

C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Hallo,

das Ergebnis war nach der von Dir angeratenen Vorgehensweise das im Anhang mitgeschickte.

Es kam die Meldung das "C:" nicht aufzufinden sei. Nachdem der Rechner neu gestartet wurde, konnte das Nutzerprofil Administrator nicht gefunden werden (andere Konten ebenfalls nicht). Die Meldung lautete:
"Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit standardmäßigen Profil für das System angemeldet.
Details - Das System kannn die angegebene Datei nicht finden."

Ich schaue auf einen blauen Bildschirm und kann zunmindest schon wieder über den Taskmanager verfügen. Herzlichen Dank für die schnelle Antwort erstmal!!!

Was soll ich jetzt tun?

Also ich hab den Eindruck du hast das Fixscript nicht 1:1 abkopiert :confused:

Funktioniert noch der abgesicherte Modus mit Netzwerktreibern? Mit Internetverbindung?

Abgesicherter Modus zur Bereinigung

Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

Nein, auch im abgesicherten Modus mit Netzwerktreibern keine große Veränderung. Das Sicherheitsprogramm meldet sich, will scannen bricht aber sofort wieder ab. Ich hab nach wie vor nur Zugrifff auf den Taskmanager.

Dann brauch ich wohl ein neues Log mit OTLPE :pfeiff:

Habe jetzt zunmindest das Sicheheitsprogramm im abgesicherten Modus mit Netzwerktreibern ans Laufen bekommen. Der Scan läuft gerade. Wenn der durch ist mache ich ein neues Log?

Nein, wenn das im abgesicherten Modus mit OTL klappt dann so

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

O.k. bin so vorgegangen. Hier das Ergebnis:

Code:

OTL logfile created on: 5/31/2012 11:51:25 PM - Run 

OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE

Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM

Internet Explorer (Version = 8.0.6001.18702)

Locale:  | Country:  | Language:  | Date Format: 

 

1,014.00 Mb Total Physical Memory | 836.00 Mb Available Physical Memory | 82.00% Memory free

902.00 Mb Paging File | 845.00 Mb Available in Paging File | 94.00% Paging File free

Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 74.50 Gb Total Space | 18.54 Gb Free Space | 24.89% Space Free | Partition Type: NTFS

Drive D: | 3.73 Gb Total Space | 3.68 Gb Free Space | 98.79% Space Free | Partition Type: FAT32

Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

 

Computer Name: REATOGO | User Name: SYSTEM

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

Using ControlSet: ControlSet001

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [On_Demand] --  -- (B-Service)

SRV - [2012/03/22 13:29:08 | 000,361,976 | ---- | M] (McAfee, Inc.) [On_Demand] -- C:\Programme\McAfee\VirusScan\mcods.exe -- (McODS)

SRV - [2012/03/20 07:11:32 | 000,151,880 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe -- (mfevtp)

SRV - [2012/03/20 07:05:00 | 000,161,632 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfefire.exe -- (mfefire)

SRV - [2012/03/20 07:04:32 | 000,166,288 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mcshield.exe -- (McShield)

SRV - [2012/01/13 06:21:10 | 000,095,200 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)

SRV - [2011/01/27 12:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe -- (MSK80Service)

SRV - [2011/01/27 12:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe -- (McProxy)

SRV - [2011/01/27 12:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe -- (McNASvc)

SRV - [2011/01/27 12:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe -- (McNaiAnn)

SRV - [2011/01/27 12:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe -- (mcmscsvc)

SRV - [2011/01/27 12:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe -- (McMPFSvc)

SRV - [2010/02/05 15:14:42 | 000,229,688 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\McAfee Online Backup\MOBKbackup.exe -- (MOBKbackup)

SRV - [2008/02/24 20:00:00 | 000,364,544 | ---- | M] (AVM Berlin) [Auto] -- C:\Programme\avmwlanstick\WLanNetService.exe -- (AVM WLAN Connection Service)

SRV - [2005/04/03 18:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)

SRV - [2003/08/28 08:01:22 | 000,061,440 | ---- | M] () [Auto] -- C:\Programme\Analog Devices\SoundMAX\spkrmon.exe -- (spkrmon)

SRV - [2003/07/28 06:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand] --  -- (WDICA)

DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)

DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)

DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)

DRV - File not found [Kernel | System] --  -- (PCIDump)

DRV - File not found [Kernel | System] --  -- (lbrtfdc)

DRV - File not found [Kernel | System] --  -- (i2omgmt)

DRV - File not found [Kernel | On_Demand] --  -- (GTNDIS5)

DRV - File not found [Kernel | System] --  -- (Changer)

DRV - [2012/02/22 07:29:46 | 000,464,304 | ---- | M] (McAfee, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)

DRV - [2012/02/22 07:29:46 | 000,340,920 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfefirek.sys -- (mfefirek)

DRV - [2012/02/22 07:29:46 | 000,180,848 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)

DRV - [2012/02/22 07:29:46 | 000,121,544 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfeapfk.sys -- (mfeapfk)

DRV - [2012/02/22 07:29:46 | 000,089,792 | ---- | M] (McAfee, Inc.) [Kernel | System] -- C:\WINDOWS\system32\drivers\mfetdi2k.sys -- (mfetdi2k)

DRV - [2012/02/22 07:29:46 | 000,087,656 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mferkdet.sys -- (mferkdet)

DRV - [2012/02/22 07:29:46 | 000,083,856 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendiskmp)

DRV - [2012/02/22 07:29:46 | 000,083,856 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendisk)

DRV - [2012/02/22 07:29:46 | 000,059,456 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)

DRV - [2012/02/22 07:29:46 | 000,057,600 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\cfwids.sys -- (cfwids)

DRV - [2010/02/05 15:13:48 | 000,054,776 | ---- | M] (Mozy, Inc.) [File_System | System] -- C:\WINDOWS\system32\drivers\MOBK.sys -- (MOBKFilter)

DRV - [2009/09/16 04:22:48 | 000,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfesmfk.sys -- (mfesmfk)

DRV - [2009/09/16 04:22:14 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mferkdk.sys -- (mferkdk)

DRV - [2007/12/18 20:00:00 | 000,401,920 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\fwlanusbn.sys -- (fwlanusbn)

DRV - [2007/11/06 21:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\avmeject.sys -- (avmeject)

DRV - [2005/05/12 20:00:00 | 000,452,736 | R--- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\fwlanusb.sys -- (FWLANUSB)

DRV - [2004/07/16 05:14:30 | 000,140,416 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\rt2500usb.sys -- (bkn50USB)

DRV - [2004/04/29 12:55:42 | 000,186,112 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)

DRV - [2004/01/07 11:04:00 | 000,339,488 | ---- | M] (Cisco-Linksys, LLC.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WUSB20XP.sys -- (PRISM_A02)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie

IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

 

IE - HKU\mbecker_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: C:\Programme\McAfee\MSC\npMcSnFFPl.dll ()

FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Programme\McAfee\SiteAdvisor\NPMcFFPlg32.dll (McAfee, Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Programme\McAfee\SiteAdvisor [2012/02/24 02:10:30 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Programme\Gemeinsame Dateien\McAfee\SystemCore [2012/05/31 14:16:53 | 000,000,000 | ---D | M]

 

 

O1 HOSTS File: ([2012/05/31 15:43:56 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} -  File not found

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\ScriptSn.20120503122005.dll (McAfee, Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)

O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin)

O4 - HKLM..\Run: [B64Fu7wxCKTba7x]  File not found

O4 - HKLM..\Run: [mcui_exe] C:\Programme\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)

O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)

O4 - HKLM..\RunOnce: [*Restore] C:\WINDOWS\System32\restore\rstrui.exe (Microsoft Corporation)

O4 - Startup: Error locating startup folders.

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Administrator.PHYSIOCARE-1.001_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149

O7 - HKU\LocalService.NT-AUTORITÄT_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149

O7 - HKU\Lutz_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149

O7 - HKU\mbecker_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149

O7 - HKU\NetworkService.NT-AUTORITÄT_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149

O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} hxxp://sib1.od2.com/common/Member/ClientInstall/9.20.0002/OCI/setup.exe ()

O16 - DPF: {59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} https://stream.web.de/mail/activex/mail_upload_11213.cab (Attachment Upload Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} hxxp://img.od2.com/Installation/PluginName/MusicManager/MusicManagerPlugin.CAB (Music Manager)

O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)

O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Java Plug-in 1.5.0_10)

O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.10.1

O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - C:\Programme\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe) -  File not found

O20 - HKLM Winlogon: UserInit - (C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe) -  File not found

O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)

O27 - HKLM IFEO\afwserv.exe: Debugger - svchost.exe (Microsoft Corporation)

O27 - HKLM IFEO\avastsvc.exe: Debugger - svchost.exe (Microsoft Corporation)

O27 - HKLM IFEO\avastui.exe: Debugger - svchost.exe (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/01/01 02:21:30 | 000,000,065 | ---- | M] () - D:\Autorun.inf -- [ FAT32 ]

O32 - AutoRun File - [2009/12/14 11:00:22 | 000,008,192 | ---- | M] (Microsoft) - D:\AutoOff.exe -- [ FAT32 ]

O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

 

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: mcmscsvc - C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)

SafeBootMin: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vds - Service

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: McMPFSvc - C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)

SafeBootNet: mcmscsvc - C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)

SafeBootNet: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)

SafeBootNet: mfefire - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)

SafeBootNet: mfefirek - C:\WINDOWS\system32\drivers\mfefirek.sys (McAfee, Inc.)

SafeBootNet: mfefirek.sys - C:\WINDOWS\system32\drivers\mfefirek.sys (McAfee, Inc.)

SafeBootNet: mfehidk - C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)

SafeBootNet: mfehidk.sys - C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)

SafeBootNet: mfevtp - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)

SafeBootNet: MpfService - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {gNlHvcTl-X3Rf-glhX-zEHE-R7LhQcT46ee6} - 

ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012/05/31 15:34:41 | 002,237,440 | R--- | C] (OldTimer Tools) -- C:\OTLPE.exe

[2012/05/31 15:34:37 | 000,000,000 | ---D | C] -- C:\_OTL

[2012/05/31 14:43:16 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\mbecker\PrivacIE

[2012/05/31 14:43:02 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\mbecker\Favoriten

[2012/05/31 14:36:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\mbecker\Anwendungsdaten\Microsoft

[2012/05/31 14:36:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\mbecker\Anwendungsdaten

[2012/05/31 14:36:50 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\mbecker\Vorlagen

[2012/05/31 14:36:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\mbecker\Startmenü

[2012/05/31 14:36:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\mbecker\Lokale Einstellungen\Anwendungsdaten\Microsoft

[2012/05/31 14:36:48 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\mbecker\IETldCache

[2012/05/31 14:36:48 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\mbecker\Cookies

[2012/05/31 14:36:48 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\mbecker\Lokale Einstellungen

[2012/05/31 14:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Startmenü

[2012/05/31 14:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Startmenü

[2012/05/31 14:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Anwendungsdaten\Microsoft

[2012/05/31 14:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Anwendungsdaten\Microsoft

[2012/05/31 14:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Anwendungsdaten

[2012/05/31 14:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Anwendungsdaten

[2012/05/31 13:20:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Lutz\Lokale Einstellungen\Anwendungsdaten\Microsoft

[2012/05/31 11:58:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Lokale Einstellungen\Anwendungsdaten\Microsoft

[2012/05/31 11:58:22 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\IETldCache

[2012/05/31 11:58:22 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Cookies

[2012/05/31 11:58:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Lokale Einstellungen

[2012/05/31 11:58:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Lokale Einstellungen\Anwendungsdaten\Microsoft

[2012/05/31 11:58:18 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\IETldCache

[2012/05/31 11:58:18 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Cookies

[2012/05/31 11:58:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Lokale Einstellungen

[2012/05/31 11:52:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen\Anwendungsdaten\Microsoft

[2012/05/31 09:55:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Windows Genuine Advantage

[2012/05/31 09:53:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\McAfee

[2012/05/31 09:51:42 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft

[2012/05/31 09:51:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten

 
 ========== Files - Modified Within 30 Days ==========

 

[2012/05/31 16:20:04 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012/05/31 14:36:56 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012/05/31 14:14:19 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2012/05/31 11:51:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2012/05/25 03:40:23 | 000,003,147 | R--- | M] () -- C:\WINDOWS\THERAPIE.LIC

[2012/05/15 03:47:17 | 000,007,168 | ---- | M] () -- C:\ads_err.adi

[2012/05/15 03:47:14 | 000,269,044 | ---- | M] () -- C:\ads_err.adt

[2012/05/14 10:36:30 | 000,117,360 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2012/05/14 05:12:26 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2012/05/02 03:52:04 | 000,005,492 | ---- | M] () -- C:\WINDOWS\mozy.blk

[2012/05/02 03:52:04 | 000,003,618 | ---- | M] () -- C:\WINDOWS\mozy.flt

 
 ========== Files Created - No Company Name ==========

 

[2012/02/16 10:27:58 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2011/07/17 14:48:30 | 000,001,052 | R--- | C] () -- \reatogoMenu.ini

[2011/07/17 14:43:36 | 000,000,000 | R--- | C] () -- \WIN51IP.SP2

[2011/07/17 14:43:36 | 000,000,000 | R--- | C] () -- \WIN51IP

[2011/05/18 09:20:37 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/03/06 12:00:10 | 000,001,172 | ---- | C] () -- C:\WINDOWS\OXMLWTCH.INI

[2010/03/06 10:40:07 | 000,015,573 | ---- | C] () -- C:\WINDOWS\System32\drivers\fwlanusbn.bin

[2008/02/10 06:57:23 | 000,000,000 | ---- | C] () -- C:\WINDOWS\DVEXTINF.INI

[2007/04/24 04:05:53 | 000,000,062 | ---- | C] () -- C:\WINDOWS\dcmvwr.INI

[2007/03/02 11:00:50 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD-Start.INI

[2006/03/24 07:06:41 | 000,000,053 | R--- | C] () -- \AUTORUN.INF

[2005/08/13 11:10:08 | 000,097,392 | R--- | C] () -- C:\WINDOWS\System32\drivers\Fwusb1b.bin

[2005/07/16 17:36:50 | 000,240,128 | R--- | C] () -- \reatogoMenu.exe

[2005/07/03 07:06:16 | 000,000,076 | ---- | C] () -- C:\WINDOWS\DVWIN32.INI

[2005/06/26 06:50:09 | 000,000,066 | ---- | C] () -- C:\WINDOWS\JcAdmin32.ini

[2005/06/26 06:49:42 | 000,000,040 | ---- | C] () -- C:\WINDOWS\nscatch.ini

[2005/06/25 06:48:08 | 000,000,217 | ---- | C] () -- C:\WINDOWS\TOBITADD.INI

[2005/06/25 06:45:51 | 000,114,688 | ---- | C] () -- C:\WINDOWS\DVGRF.DLL

[2005/06/25 06:45:51 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\IMGMSGMO.dll

[2005/06/25 06:45:45 | 000,000,821 | ---- | C] () -- C:\WINDOWS\Tobit.ini

[2005/06/25 06:45:40 | 000,000,023 | ---- | C] () -- C:\WINDOWS\AVFD.INI

[2005/06/25 06:45:06 | 001,724,416 | ---- | C] () -- C:\WINDOWS\TOBITCLT.DLL

[2005/05/28 14:23:24 | 000,000,049 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2005/05/23 05:27:25 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat

[2005/05/14 09:24:17 | 000,040,960 | ---- | C] () -- C:\Programme\Uninstall_CDS.exe

[2005/05/05 10:31:13 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2005/04/17 01:49:40 | 000,000,133 | ---- | C] () -- C:\WINDOWS\ADS.INI

[2005/04/17 01:49:28 | 000,000,222 | ---- | C] () -- C:\WINDOWS\THERAPIE.INI

[2005/04/17 01:49:27 | 000,307,200 | ---- | C] () -- C:\WINDOWS\System32\ExportModdeller.dll

[2005/04/17 01:49:27 | 000,049,223 | ---- | C] () -- C:\WINDOWS\System32\CRTSLV.DLL

[2005/04/17 01:49:25 | 000,100,352 | ---- | C] () -- C:\WINDOWS\System32\PG32CONV.DLL

[2005/04/17 00:24:49 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\GTW32N50.dll

[2005/04/16 13:55:26 | 000,004,338 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2005/04/16 13:54:19 | 000,117,360 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2005/04/16 13:48:15 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat

[2005/04/16 13:39:56 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2005/04/16 13:27:24 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2005/04/16 13:22:07 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2004/12/13 09:39:31 | 000,008,665 | ---- | C] () -- C:\WINDOWS\System32\SETUP.INI

[2004/08/16 14:33:22 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2004/08/16 14:33:21 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2004/08/16 14:24:55 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2004/08/16 14:23:05 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2004/08/16 14:23:05 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2004/08/16 14:23:04 | 000,391,000 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2004/08/16 14:23:04 | 000,380,350 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2004/08/16 14:23:03 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2004/08/16 14:23:03 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2004/08/16 14:23:02 | 000,063,580 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2004/08/16 14:23:02 | 000,052,764 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2004/08/16 14:22:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2004/08/16 14:19:13 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2004/08/16 14:19:06 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2004/08/16 14:16:09 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2004/08/16 14:15:47 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

 
 ========== LOP Check ==========

 

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 

Invalid Environment Variable: %ALLUSERSPROFILE%\Application Data\*.

 

Invalid Environment Variable: %ALLUSERSPROFILE%\Application Data\*.exe

 

Invalid Environment Variable: %APPDATA%\*.

 

Invalid Environment Variable: %APPDATA%\*.exe

 
 < %SYSTEMDRIVE%\*.exe >

[2005/06/19 11:20:25 | 002,629,120 | ---- | M] (Microsoft Corporation) -- C:\F5D7050_v2_uk.EXE

[2007/12/27 18:24:08 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe

[2011/07/12 22:55:05 | 002,237,440 | R--- | M] (OldTimer Tools) -- C:\OTLPE.exe

 

 
 < MD5 for: AGP440.SYS  >

[2004/08/16 14:26:20 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2010/03/23 09:53:02 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2010/03/23 09:53:02 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\dllcache\agp440.sys

[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

 
 < MD5 for: ATAPI.SYS  >

[2004/08/16 14:26:20 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2010/03/23 09:53:02 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2010/03/23 09:53:02 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys

[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2004/08/16 14:14:42 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2008/04/13 22:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008/04/13 22:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll

[2008/04/13 22:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll

[2004/08/16 14:16:17 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

 
 < MD5 for: IASTOR.SYS  >

[2004/08/16 14:33:30 | 000,467,200 | ---- | M] (Intel Corporation) MD5=F26BFD48B1C314E0F23BF77ACFA75940 -- C:\WINDOWS\dell\iastor\iastor.sys

 
 < MD5 for: NETLOGON.DLL  >

[2008/04/13 22:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008/04/13 22:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll

[2008/04/13 22:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll

[2004/08/16 14:21:34 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

[2009/02/06 14:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll

[2009/02/06 14:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008/04/13 22:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008/04/13 22:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll

[2008/04/13 22:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll

[2004/08/16 14:24:42 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2005/03/02 14:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll

[2007/03/08 11:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll

[2005/03/02 14:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll

[2004/08/16 14:28:49 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll

[2007/03/08 11:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll

[2008/04/13 22:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll

[2008/04/13 22:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll

[2008/04/13 22:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008/04/13 22:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008/04/13 22:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe

[2008/04/13 22:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

[2004/08/16 14:28:50 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2004/08/16 14:30:47 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2008/04/13 22:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008/04/13 22:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe

[2008/04/13 22:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2004/08/16 14:31:54 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2004/08/16 14:31:54 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2005/04/16 14:53:36 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav

[2005/04/16 14:53:36 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav

[2005/04/16 14:53:35 | 000,434,176 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2011/03/03 02:54:43 | 000,149,504 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dnsapi.dll

[2012/03/02 00:00:10 | 011,082,752 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ieframe.dll

[2012/03/01 07:00:08 | 002,000,384 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iertutil.dll

[2008/04/13 22:22:18 | 000,280,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\mstask.dll

[2008/04/13 22:22:20 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ntdsapi.dll

[2011/01/21 10:44:10 | 008,503,296 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shell32.dll

 
 < CREATERESTOREPOINT >

< End of report >

Wieso denn jetzt wieder OTLPE? Der abgesicherte Modus ging doch noch, da solltest du OTL ausführen und nicht OTLPE

Entschuldigung! Ich hab mich mißverständlich ausgedrückt, sorry! Das Sicherheitsprogramm konnte im abgesicherten Modus mit Netzwerktreibern gestartet werden (scan war ergebnislos). Ich habe trotzdem keinen Zugriff auf den Desktop und kann ebenfalls keine Internetverbindung herstellen.

Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

SRV - File not found [On_Demand] --  -- (B-Service)

O4 - HKLM..\Run: [B64Fu7wxCKTba7x]  File not found

O4 - Startup: Error locating startup folders.

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Administrator.PHYSIOCARE-1.001_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149

O7 - HKU\LocalService.NT-AUTORITÄT_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149

O7 - HKU\Lutz_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149

O7 - HKU\mbecker_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149

O7 - HKU\NetworkService.NT-AUTORITÄT_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149

O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe) -  File not found

O20 - HKLM Winlogon: UserInit - (C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ArchiverforWin.exe) -  File not found

O27 - HKLM IFEO\afwserv.exe: Debugger - svchost.exe (Microsoft Corporation)

O27 - HKLM IFEO\avastsvc.exe: Debugger - svchost.exe (Microsoft Corporation)

O27 - HKLM IFEO\avastui.exe: Debugger - svchost.exe (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/01/01 02:21:30 | 000,000,065 | ---- | M] () - D:\Autorun.inf -- [ FAT32 ]

O32 - AutoRun File - [2009/12/14 11:00:22 | 000,008,192 | ---- | M] (Microsoft) - D:\AutoOff.exe -- [ FAT32 ]

O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

[2007/12/27 18:24:08 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe

:Commands

[purity]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

Hallo, ich habe Deine letzte Annweisung noch nicht ausgeführt, weil ich sie glaube ich, nicht richtig verstanden habe, bzw. evtl. ein weiteres Problem habe:

Ich kann momentan auf OTLPE durch die anfangs gebrannnte CD zugreifen und kann damit den REATOGO -X-PE Desktop herstellen.

OTL habe ich auf einem USB von wo aus sich dies aber auf dem kranken Rechner auf dem REATOGO -X-PE Desktop nicht starten läßt.

Auf einem gesunden Rechner läßt sich die gleiche OTL aber starten.

Ich habe Dich so verstanden, das ich zunächst OTL starten soll um dort dann das Fix zu erstellen. Wenn das so sein soll, bekomme ich das aus o.g. Grund nicht hin.

Ich wär dankbar, wenn sich das Problem lösen ließe!

Zitat:

OTL habe ich auf einem USB von wo aus sich dies aber auf dem kranken Rechner auf dem REATOGO -X-PE Desktop nicht starten läßt.

Versteh ich nicht!
Den kranken Rechner konntest du doch aus mit OTLPE starten wieso soll das jetzt nicht mehr gehen?
Oder ist das ein Log von einem ganz anderen Rechner?
Du verwirrst mich :confused:

Also, auf einem gesunden Rechner habe ich OTLPE heruntergeladen und gebrannt. Außerdem hab ich ebenfalls die relevanten tools (z. b. OTL) von einem gesunden Rechner aus runtergelden und auf USB kopiert.

Alle Logs, die ich bisher gepostet habe stammen vom kranken Rechner.

Macht es Sinn, nochmal mit der Übermittlung von Run Scan Daten zu beginnen, damit wir das Ganze nochmal angehen können?

...:dankeschoen:

Zitat:

Alle Logs, die ich bisher gepostet habe stammen vom kranken Rechner.

Und warum kannst du jetzt nicht den kranken Rechner nochmal mit OTLPE booten?

Das kann ich. Auf dem kranken Rechner ist die Oberfläche von OTLPE by OldTimer - Version 3.148.0 vor mir.

Hier stehen die Funktionen Run Scan, Quick Scan, Run Fix und None zu Verfügung.

Jedoch kann ich vom USB aus auf dem kranken Rechner OTL by OldTimer - Version 3.2.44.0 nicht starten.

Das sollst du ja auch nicht. Mein Fixscript sollst du über das OTL was in OTLPE (reatogo) ist ausführen

Hab ich gemacht. Werde, nach dem Processing complete unten angezeigt wird, gefragt ob ich den Rechner neu starten will. Hab ich bejat. Rechner startet aber nicht neu.

Dann sollte man das vllt mal selbst tun :pfeiff:
Und schauen ob sich Windows wieder normalen starten lässt

:applaus: Ja, Windows läßt sich starten. Hab Zugriff auf das Startmenü. Am Desktop gibt es nur den Papierkorb. Wie bekomme ich denn jetzt noch die Desktopsymbole bzw. den Zugriff auf die Programme wieder?

Dawar noch so ein Upload den du tätigen solltest :pfeiff:

Na, das war ja mal wieder klar... Hab die movedfiles aus OTL in eine Datei gezippt und versucht im UploadChannel hochzuladen. Mit ausgeschaltetem Virenscanner usw. Und: bei mir funktioniert das natürlich wieder nicht.....der Upload bleibt irgendwo hängen.

Dann lad es hier hoch => http://file-upload.net
und poste hier den Link

O.k. Das hat geklappt. Hier der link
File-Upload.net -...

Link entfernt! Bin da über einige Private Sachen von dir gestolpert, das muss nun wirklich nicht öffentlich sein! Bitte lösch die Datei auch vom Server von File-Upload, du müsstest einen Löschlink bekommen haben //cosinus

Nee, lieber so! Sorry!

Auha, ist ja auch 74 MB groß :D
Dann passt das nicht in den Upchannel

Bitte jetzt routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

hier erstmal das log vom malwarebytes scan

Code:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org
 

Database version: v2012.06.05.02
 

Windows XP Service Pack 3 x86 FAT32

Internet Explorer 8.0.6001.18702

Administrator :: PHYSIOCARE-1 [administrator]
 

05.06.2012 07:03:19

mbam-log-2012-06-05 (08-41-43).txt
 

Scan type: Full scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 285332

Time elapsed: 1 hour(s), 30 minute(s), 30 second(s)
 

Memory Processes Detected: 0

(No malicious items detected)
 

Memory Modules Detected: 0

(No malicious items detected)
 

Registry Keys Detected: 1

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{gNlHvcTl-X3Rf-glhX-zEHE-R7LhQcT46ee6} (Backdoor.Agent) -> No action taken.
 

Registry Values Detected: 0

(No malicious items detected)
 

Registry Data Items Detected: 2

HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
 

Folders Detected: 0

(No malicious items detected)
 

Files Detected: 0

(No malicious items detected)
 

(end)

Ich kann ESET nicht ans Laufen bekommen, weil das Programm die Komponenten nicht herunterläd.

Bitte prüfen

Falsche Proxy Einstellungen entfernen

Klicke im Start-Menü unter "Einstellungen" auf "Systemsteuerung" -> "Internetoptionen".
Wähle die Karteikarte "Verbindungen->Lan-Einstellungen“ und überprüfe ob bei Proxyserver ein Häkchen steht,
wenn ja -> Entfernen, dann -> OK (sofern nicht richtige Eintragung)

O.k. beim Proxyserver war kein Häckchen.

Aber der Haken, der bei "Automatische Suche der Einstellungen" gestzt sein sollte läßt sich nicht mit O.k. bestätigen. ESET läuft weiterhin nicht.

ESET hast du nur mit ienem Browser getestet? IE und FF sind möglich!

O.k. versuche es mit FFzu testen...

Mit FF konnte ich ESET runterladen. Aber bei der Scaninitialisierung bricht ESET bei Schritt 1 ab und fragt ob ein Proy eingerichtet ist und meldet, dass die Updates nicht funktionieren.

Die Einstellungen im FF zeigen das kein Proxy eingerichtet ist. Und das soll doch auch so sein, oder?

So, danke daß Du Dich meinem Problem nochmal animmst. Hier das log vom ESET:

Code:

ESETSmartInstaller@High as downloader log:

all ok

esets_scanner_update returned -1 esets_gle=1

esets_scanner_update returned -1 esets_gle=1

esets_scanner_update returned -1 esets_gle=1

esets_scanner_update returned -1 esets_gle=1

esets_scanner_update returned -1 esets_gle=1

esets_scanner_update returned -1 esets_gle=1

esets_scanner_update returned -1 esets_gle=45315

esets_scanner_update returned -1 esets_gle=1

esets_scanner_update returned -1 esets_gle=1

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=534a8bcf7d979d4789566cc69755af3c

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2012-06-08 05:21:26

# local_time=2012-06-08 07:21:26 (+0100, Westeuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=5121 16777045 83 75 678347 39660738 0 0

# compatibility_mode=8192 67108863 100 0 253753 253753 0 0

# scanned=83971

# found=1

# cleaned=0

# scan_time=6812

C:\_OTL\MovedFiles\Neuer Ordner\05312012_153437\C_Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\7CPYQAK7\xxxpornxxx_serveuser_com[1].htm        HTML/Iframe.B.Gen Virus (Säubern nicht möglich)        00000000000000000000000000000000        I

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

zu Frage 1: Ich weiß nicht genau was Du mit uneingeschränkt meinst. Also ich kann mich wieder normal als Admin anmelden, ja.

zu Frage 2: Unter alle Programme ist tatsächlich alles leer, lediglich den IE konnte ich wieder herstellen. Also eigentlich vermisse ich alle Programme, ja.

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

So, ich hab unhide.exe ausgeführt. Ich habe danach leider noch immer die Dateien und Ordner nicht wieder. hier das log vom unhide:

Code:

Unhide by Lawrence Abrams (Grinler)

hxxp://www.bleepingcomputer.com/

Copyright 2008-2012 BleepingComputer.com

More Information about Unhide.exe can be found at this link:

  hxxp://www.bleepingcomputer.com/forums/topic405109.html
 

Program started at: 06/09/2012 03:53:40 PM

Windows Version: Windows XP
 

Please be patient while your files are made visible again.
 

Processing the C:\ drive

Finished processing the C:\ drive. 90997 files processed.
 

The C:\WINDOWS\TEMP\smtmp\ folder does not exist!!

Unhide cannot restore your missing shortcuts!!

Please see this topic in order to learn how to restore default

Start Menu shortcuts: hxxp://www.bleepingcomputer.com/forums/topic405109.html
 

Searching for Windows Registry changes made by FakeHDD rogues.

 - Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

  * NoRun policy was found and deleted!

 - Checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
 

Restarting Explorer.exe in order to apply changes.
 

Program finished at: 06/09/2012 03:59:03 PM

Execution time: 0 hours(s), 5 minute(s), and 23 seconds(s)

Ich freue mich, wenn Du noch was Weiteres weißt um die Daten wiederherzustellen.

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Guten Morgen,
hier das neue otl log:

Code:

OTL logfile created on: 10.06.2012 08:22:31 - Run 1

OTL by OldTimer - Version 3.2.44.0     Folder = C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale:  | Country:  | Language:  | Date Format: 

 

1014,07 Mb Total Physical Memory | 711,99 Mb Available Physical Memory | 70,21% Memory free

2,38 Gb Paging File | 1,93 Gb Available in Paging File | 81,07% Paging File free

Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 74,50 Gb Total Space | 17,92 Gb Free Space | 24,05% Space Free | Partition Type: NTFS

 

Computer Name: PHYSIOCARE-1 | User Name: Administrator | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.05.29 23:33:14 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Desktop\OTL.exe

PRC - [2012.03.22 19:29:22 | 000,308,392 | ---- | M] (McAfee, Inc.) -- c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe

PRC - [2012.03.21 21:16:10 | 001,318,816 | ---- | M] (McAfee, Inc.) -- c:\PROGRA~1\mcafee.com\agent\mcagent.exe

PRC - [2012.03.20 13:11:32 | 000,151,880 | ---- | M] (McAfee, Inc.) -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe

PRC - [2012.03.20 13:05:00 | 000,161,632 | ---- | M] (McAfee, Inc.) -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfefire.exe

PRC - [2012.03.20 13:04:32 | 000,166,288 | ---- | M] (McAfee, Inc.) -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mcshield.exe

PRC - [2012.01.13 12:21:10 | 000,095,200 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\SiteAdvisor\McSACore.exe

PRC - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe

PRC - [2010.02.05 21:14:42 | 000,229,688 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Online Backup\MOBKbackup.exe

PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE

PRC - [2008.02.25 02:00:00 | 000,364,544 | ---- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WlanNetService.exe

PRC - [2003.08.28 14:01:22 | 000,061,440 | ---- | M] () -- C:\Programme\Analog Devices\SoundMAX\spkrmon.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2010.02.05 21:14:42 | 000,077,624 | ---- | M] () -- C:\Programme\McAfee Online Backup\librs2.dll

MOD - [2009.02.27 18:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU

MOD - [2008.11.14 13:25:24 | 000,071,696 | ---- | M] () -- c:\Programme\McAfee\SiteAdvisor\mcfrmwk.dll

MOD - [2008.11.14 13:25:20 | 000,207,376 | ---- | M] () -- c:\Programme\McAfee\SiteAdvisor\cntscan.dll

MOD - [2008.11.14 13:25:18 | 000,117,264 | ---- | M] () -- c:\Programme\McAfee\SiteAdvisor\apengine.dll

MOD - [2004.09.01 15:20:32 | 000,073,728 | ---- | M] () -- C:\WINDOWS\system32\IMGMSGMO.dll

MOD - [2003.08.28 14:01:22 | 000,061,440 | ---- | M] () -- C:\Programme\Analog Devices\SoundMAX\spkrmon.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [On_Demand | Stopped] --  -- (MSDTC)

SRV - [2012.06.01 17:37:22 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.03.22 19:29:08 | 000,361,976 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee\VirusScan\mcods.exe -- (McODS)

SRV - [2012.03.20 13:11:32 | 000,151,880 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe -- (mfevtp)

SRV - [2012.03.20 13:05:00 | 000,161,632 | ---- | M] () [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mfefire.exe -- (mfefire)

SRV - [2012.03.20 13:04:32 | 000,166,288 | ---- | M] () [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mcshield.exe -- (McShield)

SRV - [2012.01.13 12:21:10 | 000,095,200 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)

SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe -- (MSK80Service)

SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe -- (McProxy)

SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe -- (McNASvc)

SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe -- (McNaiAnn)

SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe -- (mcmscsvc)

SRV - [2011.01.27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe -- (McMPFSvc)

SRV - [2010.02.05 21:14:42 | 000,229,688 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\McAfee Online Backup\MOBKbackup.exe -- (MOBKbackup)

SRV - [2008.04.14 04:23:03 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\System32\tlntsvr.exe -- (TlntSvr)

SRV - [2008.04.14 04:22:55 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\System32\netdde.exe -- (NetDDEdsdm)

SRV - [2008.04.14 04:22:55 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\System32\netdde.exe -- (NetDDE)

SRV - [2008.04.14 04:22:38 | 000,033,280 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\System32\clipsrv.exe -- (ClipSrv)

SRV - [2008.04.14 04:22:33 | 000,483,840 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\wzcsvc.dll -- (WZCSVC)

SRV - [2008.04.14 04:22:16 | 000,033,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\msgsvc.dll -- (Messenger)

SRV - [2008.04.14 04:22:15 | 000,053,248 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\mprdim.dll -- (RemoteAccess)

SRV - [2008.04.14 04:22:07 | 000,017,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\alrsvc.dll -- (Alerter)

SRV - [2008.02.25 02:00:00 | 000,364,544 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Programme\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service)

SRV - [2005.04.04 00:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)

SRV - [2003.08.28 14:01:22 | 000,061,440 | ---- | M] () [Auto | Running] -- C:\Programme\Analog Devices\SoundMAX\spkrmon.exe -- (spkrmon)

SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)

DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)

DRV - File not found [Kernel | On_Demand | Unknown] --  -- (mfeavfk01)

DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)

DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\GTNDIS5.SYS -- (GTNDIS5)

DRV - File not found [Kernel | System | Stopped] --  -- (Changer)

DRV - [2012.02.22 13:29:46 | 000,464,304 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\mfehidk.sys -- (mfehidk)

DRV - [2012.02.22 13:29:46 | 000,340,920 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\mfefirek.sys -- (mfefirek)

DRV - [2012.02.22 13:29:46 | 000,180,848 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\mfeavfk.sys -- (mfeavfk)

DRV - [2012.02.22 13:29:46 | 000,121,544 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\mfeapfk.sys -- (mfeapfk)

DRV - [2012.02.22 13:29:46 | 000,089,792 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\mfetdi2k.sys -- (mfetdi2k)

DRV - [2012.02.22 13:29:46 | 000,087,656 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\mferkdet.sys -- (mferkdet)

DRV - [2012.02.22 13:29:46 | 000,083,856 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\mfendisk.sys -- (mfendiskmp)

DRV - [2012.02.22 13:29:46 | 000,083,856 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\mfendisk.sys -- (mfendisk)

DRV - [2012.02.22 13:29:46 | 000,059,456 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\mfebopk.sys -- (mfebopk)

DRV - [2012.02.22 13:29:46 | 000,057,600 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\cfwids.sys -- (cfwids)

DRV - [2010.02.05 21:13:48 | 000,054,776 | ---- | M] (Mozy, Inc.) [File_System | System | Running] -- C:\WINDOWS\System32\DRIVERS\MOBK.sys -- (MOBKFilter)

DRV - [2009.09.16 10:22:48 | 000,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\mfesmfk.sys -- (mfesmfk)

DRV - [2009.09.16 10:22:14 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\mferkdk.sys -- (mferkdk)

DRV - [2008.04.14 04:02:16 | 000,120,576 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\pcmcia.sys -- (Pcmcia)

DRV - [2008.04.14 03:58:13 | 000,800,384 | ---- | M] (Microsoft Corp., Veritas Software) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\dmboot.sys -- (dmboot)

DRV - [2008.04.13 20:32:36 | 000,066,048 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\udfs.sys -- (Udfs)

DRV - [2007.12.19 02:00:00 | 000,401,920 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\fwlanusbn.sys -- (fwlanusbn)

DRV - [2007.11.07 03:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\avmeject.sys -- (avmeject)

DRV - [2005.05.13 02:00:00 | 000,452,736 | R--- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\fwlanusb.sys -- (FWLANUSB)

DRV - [2004.08.16 20:14:53 | 000,013,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\cbidf2k.sys -- (cbidf2k)

DRV - [2004.08.16 20:14:32 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\acpiec.sys -- (ACPIEC)

DRV - [2004.07.16 11:14:30 | 000,140,416 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\rt2500usb.sys -- (bkn50USB)

DRV - [2004.04.29 18:55:42 | 000,186,112 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\DRIVERS\b57xp32.sys -- (b57w2k)

DRV - [2004.01.07 17:04:00 | 000,339,488 | ---- | M] (Cisco-Linksys, LLC.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\WUSB20XP.sys -- (PRISM_A02)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

 
 ========== FireFox ==========

 

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()

FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Programme\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Programme\McAfee\SiteAdvisor [2012.02.24 08:10:30 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Programme\Gemeinsame Dateien\McAfee\SystemCore [2012.06.10 08:12:51 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.06.09 17:51:08 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins

 

[2012.06.05 18:53:21 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2012.06.01 17:38:43 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2012.06.01 18:33:00 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.06.01 18:33:00 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2012.06.01 18:33:00 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2012.06.01 18:33:00 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.06.01 18:33:00 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.06.01 18:33:00 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2012.06.04 04:37:18 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not found

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\ScriptSn.20120608164640.dll (McAfee, Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)

O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\wlangui.exe (AVM Berlin)

O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found

O4 - HKLM..\Run: [mcui_exe] C:\Programme\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)

O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe (Ahead Software Gmbh)

O4 - HKLM..\RunOnce: [*Restore] C:\WINDOWS\System32\restore\rstrui.exe (Microsoft Corporation)

O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Desktop [2012.05.31 21:40:24 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1\Cookies [2012.05.31 15:51:42 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1\Lokale Einstellungen [2012.05.31 15:51:42 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1\ntuser.ini ()

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.000\Cookies [2012.05.31 15:57:10 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.000\Lokale Einstellungen [2012.05.31 15:57:10 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.000\ntuser.ini ()

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten [2012.06.05 18:54:20 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Cookies [2012.05.31 15:58:39 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Desktop [2012.06.10 08:11:31 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Eigene Dateien [2012.06.05 18:56:29 | 000,000,000 | R--D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Favoriten [2012.06.05 10:25:26 | 000,000,000 | R--D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen [2012.05.31 20:12:00 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\NTUSER.DAT ()

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\NTUSER.DAT ()

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\ntuser.ini ()

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Recent [2012.06.03 23:08:24 | 000,000,000 | R--D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Startmenü [2012.06.03 23:08:24 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Vorlagen [2012.05.31 17:52:47 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten [2012.06.09 17:50:27 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Desktop [2012.06.09 17:51:08 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Dokumente [2012.06.09 17:50:33 | 000,000,000 | R--D | M]

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü [2012.06.03 23:09:00 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Vorlagen [2012.06.09 17:52:45 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Default User\Cookies [2012.05.31 15:59:24 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\Default User\IETldCache [2012.05.31 15:59:25 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen [2012.05.31 15:59:24 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten [2012.05.31 20:12:00 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\LocalService\Cookies [2012.05.31 15:59:24 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\LocalService\IETldCache [2012.05.31 15:59:25 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen [2012.05.31 17:52:34 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\LocalService\ntuser.dat ()

O4 - Startup: C:\Dokumente und Einstellungen\LocalService\ntuser.dat ()

O4 - Startup: C:\Dokumente und Einstellungen\LocalService\ntuser.ini ()

O4 - Startup: C:\Dokumente und Einstellungen\LocalService\Startmenü [2012.05.31 20:12:00 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Anwendungsdaten [2012.05.31 20:12:00 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Cookies [2012.05.31 15:59:24 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\IETldCache [2012.05.31 15:59:25 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Lokale Einstellungen [2012.05.31 17:58:21 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\ntuser.dat ()

O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\ntuser.dat ()

O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\ntuser.ini ()

O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Startmenü [2012.05.31 20:12:00 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Lutz\Cookies [2012.05.31 15:55:21 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Lutz\Lokale Einstellungen [2012.05.31 20:11:59 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Lutz\NTUSER.DAT ()

O4 - Startup: C:\Dokumente und Einstellungen\Lutz\NTUSER.DAT ()

O4 - Startup: C:\Dokumente und Einstellungen\Lutz\ntuser.ini ()

O4 - Startup: C:\Dokumente und Einstellungen\Lutz\Vorlagen [2012.05.31 19:20:02 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\mbecker\Anwendungsdaten [2012.05.31 20:36:52 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\mbecker\Cookies [2012.05.31 15:59:24 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\mbecker\Favoriten [2012.05.31 20:43:04 | 000,000,000 | R--D | M]

O4 - Startup: C:\Dokumente und Einstellungen\mbecker\IETldCache [2012.05.31 15:59:25 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\mbecker\Lokale Einstellungen [2012.05.31 20:36:52 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\mbecker\ntuser.dat ()

O4 - Startup: C:\Dokumente und Einstellungen\mbecker\ntuser.dat ()

O4 - Startup: C:\Dokumente und Einstellungen\mbecker\ntuser.ini ()

O4 - Startup: C:\Dokumente und Einstellungen\mbecker\PrivacIE [2012.05.31 20:43:16 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\mbecker\Startmenü [2012.05.31 20:36:50 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\mbecker\Vorlagen [2012.05.31 20:36:50 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten [2012.05.31 20:12:00 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\Cookies [2012.05.31 15:59:24 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\IETldCache [2012.05.31 15:59:25 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen [2012.05.31 17:52:30 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\ntuser.dat ()

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\ntuser.dat ()

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\ntuser.ini ()

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService\Startmenü [2012.05.31 20:12:00 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Anwendungsdaten [2012.05.31 20:12:00 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Cookies [2012.05.31 15:59:24 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\IETldCache [2012.05.31 15:59:25 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Lokale Einstellungen [2012.05.31 17:58:17 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\ntuser.dat ()

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\ntuser.dat ()

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\ntuser.ini ()

O4 - Startup: C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Startmenü [2012.05.31 20:12:00 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0

O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} hxxp://sib1.od2.com/common/Member/ClientInstall/9.20.0002/OCI/setup.exe ()

O16 - DPF: {59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} https://stream.web.de/mail/activex/mail_upload_11213.cab (Attachment Upload Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} hxxp://img.od2.com/Installation/PluginName/MusicManager/MusicManagerPlugin.CAB (Music Manager)

O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)

O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Java Plug-in 1.5.0_10)

O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.10.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3486EE17-1791-47F3-A629-4603B1A51AB8}: DhcpNameServer = 192.168.10.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7BAC5297-EA7A-4E44-AA7A-B205632F1459}: NameServer = 192.168.10.1

O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Programme\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (c:\windows\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 

NetSvcs: 6to4 -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

 

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: mcmscsvc - C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)

SafeBootMin: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vds - Service

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: McMPFSvc - C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)

SafeBootNet: mcmscsvc - C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)

SafeBootNet: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)

SafeBootNet: mfefire - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mfefire.exe ()

SafeBootNet: mfefirek - C:\WINDOWS\System32\drivers\mfefirek.sys (McAfee, Inc.)

SafeBootNet: mfefirek.sys - C:\WINDOWS\System32\drivers\mfefirek.sys (McAfee, Inc.)

SafeBootNet: mfehidk - C:\WINDOWS\System32\drivers\mfehidk.sys (McAfee, Inc.)

SafeBootNet: mfehidk.sys - C:\WINDOWS\System32\drivers\mfehidk.sys (McAfee, Inc.)

SafeBootNet: mfevtp - C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)

SafeBootNet: MpfService - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.06.09 17:52:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Vorlagen

[2012.06.09 17:51:08 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service

[2012.06.09 17:50:33 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente

[2012.06.09 17:50:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google

[2012.06.09 17:21:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss

[2012.06.08 17:16:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen\Anwendungsdaten\Adobe

[2012.06.08 16:54:16 | 000,000,000 | ---D | C] -- C:\GoogleChromePortable

[2012.06.08 16:54:16 | 000,000,000 | ---D | C] -- \GoogleChromePortable

[2012.06.05 18:58:43 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2012.06.05 18:54:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen\Anwendungsdaten\Mozilla

[2012.06.05 18:53:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla

[2012.06.05 18:53:16 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox

[2012.06.05 10:25:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen\Anwendungsdaten\Google

[2012.06.05 06:40:44 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2012.06.05 06:40:44 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2012.06.05 06:39:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

[2012.06.05 06:39:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Desktop

[2012.06.04 23:40:30 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Eigene Dateien

[2012.06.04 17:59:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten

[2012.06.04 12:24:54 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip

[2012.06.03 23:09:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü

[2012.06.03 23:08:25 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Favoriten

[2012.06.03 23:08:24 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Recent

[2012.06.03 23:08:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Startmenü

[2012.06.03 23:08:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Desktop

[2012.05.31 21:34:41 | 002,237,440 | R--- | C] (OldTimer Tools) -- C:\OTLPE.exe

[2012.05.31 21:34:37 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.05.31 21:34:37 | 000,000,000 | ---D | C] -- \_OTL

[2012.05.31 20:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Startmenü

[2012.05.31 20:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Startmenü

[2012.05.31 20:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten

[2012.05.31 20:12:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten

[2012.05.31 17:52:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Vorlagen

[2012.05.31 17:52:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen\Anwendungsdaten\Microsoft

[2012.05.31 17:52:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Microsoft

[2012.05.31 17:52:35 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\LocalService\IETldCache

[2012.05.31 17:52:35 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\LocalService\Cookies

[2012.05.31 17:52:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen

[2012.05.31 17:52:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Microsoft

[2012.05.31 17:52:30 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\NetworkService\IETldCache

[2012.05.31 17:52:30 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\NetworkService\Cookies

[2012.05.31 17:52:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen

[2012.05.31 15:58:38 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Cookies

[2012.05.31 15:58:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen

[2012.05.31 15:55:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Windows Genuine Advantage

[2012.05.31 15:53:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\McAfee

[2012.05.31 15:51:42 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft

[2012.05.31 15:51:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.06.10 08:09:45 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012.06.10 08:09:29 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2012.06.10 08:09:17 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012.06.09 16:51:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2012.06.05 18:53:35 | 000,000,696 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk

[2012.06.05 06:40:57 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2012.05.25 09:40:23 | 000,003,147 | R--- | M] () -- C:\WINDOWS\THERAPIE.LIC

[2012.05.15 09:47:17 | 000,007,168 | ---- | M] () -- C:\ads_err.adi

[2012.05.15 09:47:14 | 000,269,044 | ---- | M] () -- C:\ads_err.adt

[2012.05.14 16:36:30 | 000,117,360 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2012.05.14 11:15:36 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

 
 ========== Files Created - No Company Name ==========

 

[2012.06.05 18:53:35 | 000,000,696 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk

[2012.06.05 06:40:56 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2012.05.31 21:34:41 | 002,237,440 | R--- | C] () -- \OTLPE.exe

[2012.02.16 16:27:58 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2011.05.18 15:20:37 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

 
 ========== LOP Check ==========

 

[2012.05.31 21:40:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Desktop

[2012.05.31 15:51:42 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1\Cookies

[2012.05.31 15:51:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1\Lokale Einstellungen

[2012.05.31 15:57:10 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.000\Cookies

[2012.05.31 15:57:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.000\Lokale Einstellungen

[2012.06.05 18:54:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten

[2012.05.31 15:58:39 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Cookies

[2012.06.10 08:11:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Desktop

[2012.06.05 18:56:29 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Eigene Dateien

[2012.06.05 10:25:26 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Favoriten

[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Lokale Einstellungen

[2012.06.03 23:08:24 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Recent

[2012.06.03 23:08:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Startmenü

[2012.05.31 17:52:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Vorlagen

[2012.06.09 17:50:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten

[2012.06.09 17:51:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Desktop

[2012.06.09 17:50:33 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\All Users\Dokumente

[2012.06.03 23:09:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü

[2012.06.09 17:52:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Vorlagen

[2012.05.31 15:59:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Default User\Cookies

[2012.05.31 15:59:25 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Default User\IETldCache

[2012.05.31 15:59:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen

[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten

[2012.05.31 15:59:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\LocalService\Cookies

[2012.05.31 15:59:25 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\LocalService\IETldCache

[2012.05.31 17:52:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen

[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Startmenü

[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Anwendungsdaten

[2012.05.31 15:59:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Cookies

[2012.05.31 15:59:25 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\IETldCache

[2012.05.31 17:58:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Lokale Einstellungen

[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Startmenü

[2012.05.31 15:55:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lutz\Cookies

[2012.05.31 20:11:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lutz\Lokale Einstellungen

[2012.05.31 19:20:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lutz\Vorlagen

[2012.05.31 20:36:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\mbecker\Anwendungsdaten

[2012.05.31 15:59:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\mbecker\Cookies

[2012.05.31 20:43:04 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\mbecker\Favoriten

[2012.05.31 15:59:25 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\mbecker\IETldCache

[2012.05.31 20:36:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\mbecker\Lokale Einstellungen

[2012.05.31 20:43:16 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\mbecker\PrivacIE

[2012.05.31 20:36:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\mbecker\Startmenü

[2012.05.31 20:36:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\mbecker\Vorlagen

[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten

[2012.05.31 15:59:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\NetworkService\Cookies

[2012.05.31 15:59:25 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\NetworkService\IETldCache

[2012.05.31 17:52:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen

[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Startmenü

[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Anwendungsdaten

[2012.05.31 15:59:24 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Cookies

[2012.05.31 15:59:25 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\IETldCache

[2012.05.31 17:58:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Lokale Einstellungen

[2012.05.31 20:12:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService.NT-AUTORITÄT\Startmenü

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.06.09 17:50:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten\Adobe

[2012.06.05 10:51:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten\Google

[2012.06.05 18:18:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten\Macromedia

[2012.06.05 06:41:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten\Malwarebytes

[2012.06.09 17:52:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten\Microsoft

[2012.06.09 17:51:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.PHYSIOCARE-1.001\Anwendungsdaten\Mozilla

 
 < %APPDATA%\*.exe /s >

 
 < %SYSTEMDRIVE%\*.exe >

[2005.06.19 17:20:25 | 002,629,120 | ---- | M] (Microsoft Corporation) -- C:\F5D7050_v2_uk.EXE

[2011.07.13 04:55:05 | 002,237,440 | R--- | M] (OldTimer Tools) -- C:\OTLPE.exe

 
 < MD5 for: AGP440.SYS  >

[2004.08.16 20:26:20 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2010.03.23 15:53:02 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2010.03.23 15:53:02 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\dllcache\agp440.sys

[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

 
 < MD5 for: ATAPI.SYS  >

[2004.08.16 20:26:20 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2010.03.23 15:53:02 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2010.03.23 15:53:02 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys

[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2004.08.16 20:14:42 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll

[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll

[2004.08.16 20:16:17 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

 
 < MD5 for: IASTOR.SYS  >

[2004.08.16 20:33:30 | 000,467,200 | ---- | M] (Intel Corporation) MD5=F26BFD48B1C314E0F23BF77ACFA75940 -- C:\WINDOWS\dell\iastor\iastor.sys

 
 < MD5 for: NETLOGON.DLL  >

[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll

[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll

[2004.08.16 20:21:34 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll

[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll

[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll

[2004.08.16 20:24:42 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2005.03.02 20:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll

[2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll

[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll

[2004.08.16 20:28:49 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll

[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll

[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll

[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll

[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe

[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

[2004.08.16 20:28:50 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2004.08.16 20:30:47 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe

[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2004.08.16 20:31:54 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2004.08.16 20:31:54 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2005.04.16 20:53:36 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav

[2005.04.16 20:53:36 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav

[2005.04.16 20:53:35 | 000,434,176 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 <           >
 

< End of report >

Das Log sieht merkwürdig aus. Die ganzen Startmenü-Einträge in der O4-Sektio sind mir so noch nie untergekommen :wtf:
Hier ein Auszug

Code:

O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\ntuser.ini ()

O4 - Startup: C:\Dokumente und Einstellungen\LocalService.NT-AUTORITÄT\Startmenü [2012.05.31 20:12:00 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Lutz\Cookies [2012.05.31 15:55:21 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Lutz\Lokale Einstellungen [2012.05.31 20:11:59 | 000,000,000 | ---D | M]

O4 - Startup: C:\Dokumente und Einstellungen\Lutz\NTUSER.DAT ()

O4 - Startup: C:\Dokumente und Einstellungen\Lutz\NTUSER.DAT ()

O4 - Startup: C:\Dokumente und Einstellungen\Lutz\ntuser.ini ()

Normalweise müssten sich wild o.g. Ordner und Dateien bei jedem Einloggen öffnen, merkst du davon was?

Nein davon hab ich noch nix bemerkt. Was mach ich nun:confused:

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

o. k. hier das log vom tdss

Code:

2012/06/11 20:41:31.0781 2448        TDSS rootkit removing tool 2.5.5.0 Jun 16 2011 15:25:15

2012/06/11 20:41:36.0812 2448        ================================================================================

2012/06/11 20:41:36.0812 2448        SystemInfo:

2012/06/11 20:41:36.0812 2448        

2012/06/11 20:41:36.0812 2448        OS Version: 5.1.2600 ServicePack: 3.0

2012/06/11 20:41:36.0812 2448        Product type: Workstation

2012/06/11 20:41:36.0812 2448        ComputerName: PHYSIOCARE-1

2012/06/11 20:41:36.0812 2448        UserName: Administrator

2012/06/11 20:41:36.0812 2448        Windows directory: C:\WINDOWS

2012/06/11 20:41:36.0812 2448        System windows directory: C:\WINDOWS

2012/06/11 20:41:36.0812 2448        Processor architecture: Intel x86

2012/06/11 20:41:36.0812 2448        Number of processors: 1

2012/06/11 20:41:36.0812 2448        Page size: 0x1000

2012/06/11 20:41:36.0812 2448        Boot type: Normal boot

2012/06/11 20:41:36.0812 2448        ================================================================================

2012/06/11 20:41:38.0890 2448        Initialize success

2012/06/11 20:42:25.0281 2992        ================================================================================

2012/06/11 20:42:25.0281 2992        Scan started

2012/06/11 20:42:25.0281 2992        Mode: Manual; 

2012/06/11 20:42:25.0281 2992        ================================================================================

2012/06/11 20:42:25.0937 2992        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2012/06/11 20:42:26.0000 2992        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys

2012/06/11 20:42:26.0281 2992        aeaudio         (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys

2012/06/11 20:42:26.0453 2992        aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2012/06/11 20:42:26.0515 2992        AFD             (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

2012/06/11 20:42:26.0750 2992        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2012/06/11 20:42:26.0828 2992        atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2012/06/11 20:42:26.0890 2992        Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2012/06/11 20:42:26.0953 2992        audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2012/06/11 20:42:27.0015 2992        avmeject        (263cf9d248fd5e020a1333ed4f7eaa88) C:\WINDOWS\system32\drivers\avmeject.sys

2012/06/11 20:42:27.0234 2992        b57w2k          (4826fcf97c47b361a2e2f68cd487a19e) C:\WINDOWS\system32\DRIVERS\b57xp32.sys

2012/06/11 20:42:27.0406 2992        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2012/06/11 20:42:27.0468 2992        bkn50USB        (6d39682a1051a5be7437ec99f1bf9921) C:\WINDOWS\system32\DRIVERS\rt2500usb.sys

2012/06/11 20:42:27.0640 2992        cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2012/06/11 20:42:27.0703 2992        Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2012/06/11 20:42:27.0765 2992        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2012/06/11 20:42:27.0796 2992        Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2012/06/11 20:42:27.0906 2992        cfwids          (1c7b1e36f3ced9e4b0b13385e627fe8b) C:\WINDOWS\system32\drivers\cfwids.sys

2012/06/11 20:42:28.0187 2992        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2012/06/11 20:42:28.0296 2992        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys

2012/06/11 20:42:28.0546 2992        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys

2012/06/11 20:42:28.0578 2992        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2012/06/11 20:42:28.0640 2992        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2012/06/11 20:42:28.0703 2992        drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2012/06/11 20:42:28.0765 2992        Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2012/06/11 20:42:28.0796 2992        Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

2012/06/11 20:42:28.0843 2992        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys

2012/06/11 20:42:29.0156 2992        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

2012/06/11 20:42:29.0203 2992        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

2012/06/11 20:42:29.0234 2992        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2012/06/11 20:42:29.0265 2992        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2012/06/11 20:42:29.0343 2992        FWLANUSB        (41077d927c3654fd2d71549763525d75) C:\WINDOWS\system32\DRIVERS\fwlanusb.sys

2012/06/11 20:42:29.0515 2992        fwlanusbn       (fc06a5be1ab381cd47af3d69006e88f0) C:\WINDOWS\system32\DRIVERS\fwlanusbn.sys

2012/06/11 20:42:29.0859 2992        Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2012/06/11 20:42:29.0937 2992        hidusb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2012/06/11 20:42:30.0031 2992        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

2012/06/11 20:42:30.0156 2992        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\drivers\i8042prt.sys

2012/06/11 20:42:30.0343 2992        ialm            (0acebb31989cbf9a5663fe4a33d28d21) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys

2012/06/11 20:42:30.0437 2992        Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2012/06/11 20:42:30.0515 2992        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys

2012/06/11 20:42:30.0546 2992        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2012/06/11 20:42:30.0765 2992        Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

2012/06/11 20:42:30.0828 2992        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2012/06/11 20:42:30.0859 2992        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2012/06/11 20:42:30.0890 2992        IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2012/06/11 20:42:30.0937 2992        IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2012/06/11 20:42:30.0968 2992        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2012/06/11 20:42:31.0000 2992        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2012/06/11 20:42:31.0015 2992        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2012/06/11 20:42:31.0250 2992        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

2012/06/11 20:42:31.0390 2992        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2012/06/11 20:42:31.0453 2992        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

2012/06/11 20:42:31.0546 2992        MBAMSwissArmy   (0db7527db188c7d967a37bb51bbf3963) C:\WINDOWS\system32\drivers\mbamswissarmy.sys

2012/06/11 20:42:31.0750 2992        mfeapfk         (43c31bdf404a6d7a7ac1bfd5ead2a566) C:\WINDOWS\system32\drivers\mfeapfk.sys

2012/06/11 20:42:31.0921 2992        mfeavfk         (c1dc5f42d3367f33b6451be78b38bd46) C:\WINDOWS\system32\drivers\mfeavfk.sys

2012/06/11 20:42:32.0093 2992        mfebopk         (0435c43f4c2be01b84868ad2a906397b) C:\WINDOWS\system32\drivers\mfebopk.sys

2012/06/11 20:42:32.0296 2992        mfefirek        (4ea6ff90015424517843e931448e00f1) C:\WINDOWS\system32\drivers\mfefirek.sys

2012/06/11 20:42:32.0484 2992        mfehidk         (d1e998748ba24a731106611d535c6bbf) C:\WINDOWS\system32\drivers\mfehidk.sys

2012/06/11 20:42:32.0531 2992        mfendisk        (26c76d10ed650e6492800d6f081ecfba) C:\WINDOWS\system32\DRIVERS\mfendisk.sys

2012/06/11 20:42:32.0625 2992        mfendiskmp      (26c76d10ed650e6492800d6f081ecfba) C:\WINDOWS\system32\DRIVERS\mfendisk.sys

2012/06/11 20:42:32.0671 2992        mferkdet        (f454a13377f0a006d20a8c14a753c432) C:\WINDOWS\system32\drivers\mferkdet.sys

2012/06/11 20:42:32.0859 2992        mferkdk         (41fe2f288e05a6c8ab85dd56770ffbad) C:\WINDOWS\system32\drivers\mferkdk.sys

2012/06/11 20:42:33.0031 2992        mfesmfk         (096b52ea918aa909ba5903d79e129005) C:\WINDOWS\system32\drivers\mfesmfk.sys

2012/06/11 20:42:33.0187 2992        mfetdi2k        (070d3faf2eac417c59d8674a8752f7a6) C:\WINDOWS\system32\drivers\mfetdi2k.sys

2012/06/11 20:42:33.0343 2992        mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2012/06/11 20:42:33.0421 2992        MOBKFilter      (e896775837a8bce436348df460522394) C:\WINDOWS\system32\DRIVERS\MOBK.sys

2012/06/11 20:42:33.0468 2992        Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys

2012/06/11 20:42:33.0625 2992        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2012/06/11 20:42:33.0765 2992        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys

2012/06/11 20:42:33.0937 2992        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2012/06/11 20:42:34.0000 2992        mozyFilter      (8e5f185f04d4ff203afbb0fd2b609e88) C:\WINDOWS\system32\DRIVERS\mozy.sys

2012/06/11 20:42:34.0046 2992        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2012/06/11 20:42:34.0125 2992        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2012/06/11 20:42:34.0187 2992        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2012/06/11 20:42:34.0234 2992        MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2012/06/11 20:42:34.0265 2992        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2012/06/11 20:42:34.0296 2992        MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2012/06/11 20:42:34.0328 2992        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2012/06/11 20:42:34.0421 2992        Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

2012/06/11 20:42:34.0484 2992        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2012/06/11 20:42:34.0531 2992        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2012/06/11 20:42:34.0593 2992        Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2012/06/11 20:42:34.0656 2992        NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2012/06/11 20:42:34.0718 2992        NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

2012/06/11 20:42:34.0750 2992        NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2012/06/11 20:42:34.0796 2992        NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2012/06/11 20:42:34.0859 2992        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2012/06/11 20:42:34.0921 2992        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2012/06/11 20:42:34.0953 2992        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2012/06/11 20:42:35.0015 2992        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2012/06/11 20:42:35.0062 2992        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2012/06/11 20:42:35.0109 2992        Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys

2012/06/11 20:42:35.0406 2992        PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2012/06/11 20:42:35.0453 2992        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys

2012/06/11 20:42:35.0593 2992        PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys

2012/06/11 20:42:35.0671 2992        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\drivers\PCIIde.sys

2012/06/11 20:42:35.0718 2992        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys

2012/06/11 20:42:35.0984 2992        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2012/06/11 20:42:36.0046 2992        PRISM_A02       (57e95881e5f014816a8a53ad94ee0c48) C:\WINDOWS\system32\DRIVERS\WUSB20XP.sys

2012/06/11 20:42:36.0187 2992        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2012/06/11 20:42:36.0218 2992        Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2012/06/11 20:42:36.0359 2992        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2012/06/11 20:42:36.0406 2992        Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2012/06/11 20:42:36.0437 2992        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2012/06/11 20:42:36.0468 2992        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2012/06/11 20:42:36.0500 2992        Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2012/06/11 20:42:36.0531 2992        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2012/06/11 20:42:36.0562 2992        rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2012/06/11 20:42:36.0640 2992        RDPWD           (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys

2012/06/11 20:42:36.0687 2992        redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys

2012/06/11 20:42:36.0953 2992        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2012/06/11 20:42:37.0015 2992        serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

2012/06/11 20:42:37.0062 2992        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys

2012/06/11 20:42:37.0203 2992        Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys

2012/06/11 20:42:37.0312 2992        smwdm           (4aa922332433cdeb8b82c072c212e32e) C:\WINDOWS\system32\drivers\smwdm.sys

2012/06/11 20:42:37.0375 2992        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2012/06/11 20:42:37.0421 2992        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys

2012/06/11 20:42:37.0468 2992        Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

2012/06/11 20:42:37.0531 2992        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2012/06/11 20:42:37.0578 2992        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2012/06/11 20:42:37.0718 2992        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2012/06/11 20:42:37.0796 2992        Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2012/06/11 20:42:37.0843 2992        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2012/06/11 20:42:37.0890 2992        TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2012/06/11 20:42:37.0937 2992        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2012/06/11 20:42:38.0031 2992        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2012/06/11 20:42:38.0125 2992        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2012/06/11 20:42:38.0171 2992        usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2012/06/11 20:42:38.0203 2992        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2012/06/11 20:42:38.0250 2992        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

2012/06/11 20:42:38.0281 2992        USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2012/06/11 20:42:38.0328 2992        usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2012/06/11 20:42:38.0359 2992        VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2012/06/11 20:42:38.0421 2992        VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys

2012/06/11 20:42:38.0468 2992        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2012/06/11 20:42:38.0531 2992        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2012/06/11 20:42:38.0656 2992        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\Drivers\wpdusb.sys

2012/06/11 20:42:38.0781 2992        WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

2012/06/11 20:42:38.0875 2992        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

2012/06/11 20:42:38.0937 2992        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

2012/06/11 20:42:39.0000 2992        MBR (0x1B8)     (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0

2012/06/11 20:42:39.0265 2992        ================================================================================

2012/06/11 20:42:39.0265 2992        Scan finished

2012/06/11 20:42:39.0265 2992        ================================================================================

2012/06/11 20:42:39.0281 1940        Detected object count: 0

2012/06/11 20:42:39.0281 1940        Actual detected object count: 0

Vielen Dank, das Du da drüber guckst!

Zitat:

TDSS rootkit removing tool 2.5.5.0 Jun 16 2011 15:25:15

Warum nimmst du so eine Uraltversion von diesem Tool?

Oh ha! Na das ist mal peinlich! So, hier nun ein aktuelles TDSS log aus einer aktuellen Version. Hab alle Funde mit skip behandelt, noch nix gelöscht.

Code:

19:59:29.0529 2880        TDSS rootkit removing tool 2.7.34.0 May  2 2012 09:59:18

19:59:46.0967 2880        ============================================================

19:59:46.0967 2880        Current date / time: 2012/06/12 19:59:46.0967

19:59:46.0967 2880        SystemInfo:

19:59:46.0982 2880        

19:59:46.0982 2880        OS Version: 5.1.2600 ServicePack: 3.0

19:59:46.0982 2880        Product type: Workstation

19:59:46.0982 2880        ComputerName: PHYSIOCARE-1

19:59:46.0982 2880        UserName: Administrator

19:59:46.0982 2880        Windows directory: C:\WINDOWS

19:59:46.0982 2880        System windows directory: C:\WINDOWS

19:59:46.0982 2880        Processor architecture: Intel x86

19:59:46.0982 2880        Number of processors: 1

19:59:46.0982 2880        Page size: 0x1000

19:59:46.0982 2880        Boot type: Normal boot

19:59:46.0982 2880        ============================================================

19:59:48.0529 2880        Drive \Device\Harddisk0\DR0 - Size: 0x12A05F2000 (74.51 Gb), SectorSize: 0x200, Cylinders: 0x25FE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

19:59:48.0529 2880        Drive \Device\Harddisk1\DR2 - Size: 0xEEF00000 (3.73 Gb), SectorSize: 0x200, Cylinders: 0x1E7, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

19:59:48.0529 2880        ============================================================

19:59:48.0529 2880        \Device\Harddisk0\DR0:

19:59:48.0529 2880        MBR partitions:

19:59:48.0529 2880        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x94FE97E

19:59:48.0529 2880        \Device\Harddisk1\DR2:

19:59:48.0529 2880        MBR partitions:

19:59:48.0529 2880        \Device\Harddisk1\DR2\Partition0: MBR, Type 0xB, StartLBA 0x20, BlocksNum 0x7777E0

19:59:48.0529 2880        ============================================================

19:59:48.0576 2880        C: <-> \Device\Harddisk0\DR0\Partition0

19:59:48.0576 2880        ============================================================

19:59:48.0576 2880        Initialize success

19:59:48.0576 2880        ============================================================

20:00:06.0123 3232        ============================================================

20:00:06.0123 3232        Scan started

20:00:06.0123 3232        Mode: Manual; SigCheck; TDLFS; 

20:00:06.0123 3232        ============================================================

20:00:06.0310 3232        Abiosdsk - ok

20:00:06.0310 3232        abp480n5 - ok

20:00:06.0373 3232        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys

20:00:07.0857 3232        ACPI - ok

20:00:07.0904 3232        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys

20:00:08.0060 3232        ACPIEC - ok

20:00:08.0060 3232        adpu160m - ok

20:00:08.0092 3232        aeaudio         (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys

20:00:08.0154 3232        aeaudio - ok

20:00:08.0185 3232        aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

20:00:08.0357 3232        aec - ok

20:00:08.0404 3232        AFD             (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

20:00:08.0513 3232        AFD - ok

20:00:08.0513 3232        Aha154x - ok

20:00:08.0529 3232        aic78u2 - ok

20:00:08.0529 3232        aic78xx - ok

20:00:08.0560 3232        Alerter         (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll

20:00:08.0717 3232        Alerter - ok

20:00:08.0732 3232        ALG             (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe

20:00:08.0810 3232        ALG - ok

20:00:08.0826 3232        AliIde - ok

20:00:08.0826 3232        amsint - ok

20:00:08.0873 3232        AppMgmt         (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll

20:00:08.0982 3232        AppMgmt - ok

20:00:08.0982 3232        asc - ok

20:00:08.0998 3232        asc3350p - ok

20:00:08.0998 3232        asc3550 - ok

20:00:09.0092 3232        aspnet_state    (e1a1206a4fb19b675e947b29ccd25fba) C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe

20:00:09.0123 3232        aspnet_state ( UnsignedFile.Multi.Generic ) - warning

20:00:09.0123 3232        aspnet_state - detected UnsignedFile.Multi.Generic (1)

20:00:09.0154 3232        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

20:00:09.0295 3232        AsyncMac - ok

20:00:09.0326 3232        atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

20:00:09.0482 3232        atapi - ok

20:00:09.0482 3232        Atdisk - ok

20:00:09.0529 3232        Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

20:00:09.0670 3232        Atmarpc - ok

20:00:09.0717 3232        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll

20:00:09.0873 3232        AudioSrv - ok

20:00:09.0951 3232        audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

20:00:10.0076 3232        audstub - ok

20:00:10.0185 3232        AVM WLAN Connection Service (06c3528e0686a58701367749b0145a4a) C:\Programme\avmwlanstick\WlanNetService.exe

20:00:10.0373 3232        AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - warning

20:00:10.0373 3232        AVM WLAN Connection Service - detected UnsignedFile.Multi.Generic (1)

20:00:10.0388 3232        avmeject        (263cf9d248fd5e020a1333ed4f7eaa88) C:\WINDOWS\system32\drivers\avmeject.sys

20:00:10.0420 3232        avmeject ( UnsignedFile.Multi.Generic ) - warning

20:00:10.0420 3232        avmeject - detected UnsignedFile.Multi.Generic (1)

20:00:10.0467 3232        b57w2k          (4826fcf97c47b361a2e2f68cd487a19e) C:\WINDOWS\system32\DRIVERS\b57xp32.sys

20:00:10.0592 3232        b57w2k - ok

20:00:10.0607 3232        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

20:00:10.0763 3232        Beep - ok

20:00:10.0826 3232        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll

20:00:11.0060 3232        BITS - ok

20:00:11.0107 3232        bkn50USB        (6d39682a1051a5be7437ec99f1bf9921) C:\WINDOWS\system32\DRIVERS\rt2500usb.sys

20:00:11.0138 3232        bkn50USB ( UnsignedFile.Multi.Generic ) - warning

20:00:11.0138 3232        bkn50USB - detected UnsignedFile.Multi.Generic (1)

20:00:11.0170 3232        Browser         (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll

20:00:11.0326 3232        Browser - ok

20:00:11.0373 3232        cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

20:00:11.0529 3232        cbidf2k - ok

20:00:11.0545 3232        cd20xrnt - ok

20:00:11.0576 3232        Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

20:00:11.0717 3232        Cdaudio - ok

20:00:11.0763 3232        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

20:00:11.0951 3232        Cdfs - ok

20:00:11.0967 3232        Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

20:00:12.0138 3232        Cdrom - ok

20:00:12.0170 3232        cfwids          (1c7b1e36f3ced9e4b0b13385e627fe8b) C:\WINDOWS\system32\drivers\cfwids.sys

20:00:21.0998 3232        cfwids - ok

20:00:21.0998 3232        Changer - ok

20:00:22.0029 3232        CiSvc           (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe

20:00:22.0185 3232        CiSvc - ok

20:00:22.0201 3232        ClipSrv         (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe

20:00:22.0357 3232        ClipSrv - ok

20:00:22.0357 3232        CmdIde - ok

20:00:22.0357 3232        COMSysApp - ok

20:00:22.0373 3232        Cpqarray - ok

20:00:22.0404 3232        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll

20:00:22.0545 3232        CryptSvc - ok

20:00:22.0560 3232        dac2w2k - ok

20:00:22.0560 3232        dac960nt - ok

20:00:22.0623 3232        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll

20:00:22.0717 3232        DcomLaunch - ok

20:00:22.0763 3232        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll

20:00:22.0935 3232        Dhcp - ok

20:00:22.0982 3232        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

20:00:23.0123 3232        Disk - ok

20:00:23.0123 3232        dmadmin - ok

20:00:23.0170 3232        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys

20:00:23.0373 3232        dmboot - ok

20:00:23.0388 3232        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys

20:00:23.0545 3232        dmio - ok

20:00:23.0560 3232        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

20:00:23.0717 3232        dmload - ok

20:00:23.0920 3232        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll

20:00:24.0107 3232        dmserver - ok

20:00:24.0185 3232        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

20:00:24.0342 3232        DMusic - ok

20:00:24.0623 3232        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll

20:00:24.0873 3232        Dnscache - ok

20:00:25.0154 3232        Dot3svc         (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll

20:00:25.0295 3232        Dot3svc - ok

20:00:25.0295 3232        dpti2o - ok

20:00:25.0326 3232        drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

20:00:25.0467 3232        drmkaud - ok

20:00:25.0498 3232        EapHost         (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll

20:00:25.0654 3232        EapHost - ok

20:00:25.0685 3232        ERSvc           (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll

20:00:25.0842 3232        ERSvc - ok

20:00:25.0888 3232        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe

20:00:25.0920 3232        Eventlog - ok

20:00:25.0982 3232        EventSystem     (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll

20:00:26.0092 3232        EventSystem - ok

20:00:26.0138 3232        Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

20:00:26.0295 3232        Fastfat - ok

20:00:26.0326 3232        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll

20:00:26.0451 3232        FastUserSwitchingCompatibility - ok

20:00:26.0467 3232        Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

20:00:26.0607 3232        Fdc - ok

20:00:26.0638 3232        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys

20:00:26.0779 3232        Fips - ok

20:00:26.0810 3232        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

20:00:26.0951 3232        Flpydisk - ok

20:00:26.0982 3232        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

20:00:27.0138 3232        FltMgr - ok

20:00:27.0185 3232        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

20:00:27.0326 3232        Fs_Rec - ok

20:00:27.0357 3232        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

20:00:27.0498 3232        Ftdisk - ok

20:00:27.0545 3232        FWLANUSB        (41077d927c3654fd2d71549763525d75) C:\WINDOWS\system32\DRIVERS\fwlanusb.sys

20:00:27.0623 3232        FWLANUSB - ok

20:00:27.0685 3232        fwlanusbn       (fc06a5be1ab381cd47af3d69006e88f0) C:\WINDOWS\system32\DRIVERS\fwlanusbn.sys

20:00:27.0810 3232        fwlanusbn - ok

20:00:27.0857 3232        Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

20:00:27.0998 3232        Gpc - ok

20:00:28.0013 3232        GTNDIS5 - ok

20:00:28.0107 3232        gupdate         (8f0de4fef8201e306f9938b0905ac96a) C:\Programme\Google\Update\GoogleUpdate.exe

20:00:28.0138 3232        gupdate - ok

20:00:28.0138 3232        gupdatem        (8f0de4fef8201e306f9938b0905ac96a) C:\Programme\Google\Update\GoogleUpdate.exe

20:00:28.0154 3232        gupdatem - ok

20:00:28.0217 3232        gusvc           (cc839e8d766cc31a7710c9f38cf3e375) C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

20:00:28.0248 3232        gusvc - ok

20:00:28.0373 3232        helpsvc         (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

20:00:28.0576 3232        helpsvc - ok

20:00:28.0607 3232        HidServ         (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll

20:00:28.0748 3232        HidServ - ok

20:00:28.0779 3232        hidusb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

20:00:28.0920 3232        hidusb - ok

20:00:28.0967 3232        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll

20:00:29.0107 3232        hkmsvc - ok

20:00:29.0107 3232        hpn - ok

20:00:29.0170 3232        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

20:00:29.0217 3232        HTTP - ok

20:00:29.0248 3232        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll

20:00:29.0388 3232        HTTPFilter - ok

20:00:29.0404 3232        i2omgmt - ok

20:00:29.0404 3232        i2omp - ok

20:00:29.0451 3232        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\drivers\i8042prt.sys

20:00:29.0592 3232        i8042prt - ok

20:00:29.0638 3232        ialm            (0acebb31989cbf9a5663fe4a33d28d21) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys

20:00:29.0717 3232        ialm ( UnsignedFile.Multi.Generic ) - warning

20:00:29.0717 3232        ialm - detected UnsignedFile.Multi.Generic (1)

20:00:29.0826 3232        IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

20:00:29.0967 3232        IDriverT ( UnsignedFile.Multi.Generic ) - warning

20:00:29.0967 3232        IDriverT - detected UnsignedFile.Multi.Generic (1)

20:00:29.0982 3232        Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

20:00:30.0107 3232        Imapi - ok

20:00:30.0154 3232        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe

20:00:30.0295 3232        ImapiService - ok

20:00:30.0295 3232        ini910u - ok

20:00:30.0326 3232        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys

20:00:30.0467 3232        IntelIde - ok

20:00:30.0498 3232        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys

20:00:30.0638 3232        intelppm - ok

20:00:30.0654 3232        Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

20:00:30.0795 3232        Ip6Fw - ok

20:00:30.0842 3232        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

20:00:30.0967 3232        IpFilterDriver - ok

20:00:31.0013 3232        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

20:00:31.0138 3232        IpInIp - ok

20:00:31.0170 3232        IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

20:00:31.0342 3232        IpNat - ok

20:00:31.0357 3232        IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

20:00:31.0482 3232        IPSec - ok

20:00:31.0513 3232        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

20:00:31.0592 3232        IRENUM - ok

20:00:31.0623 3232        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys

20:00:31.0763 3232        isapnp - ok

20:00:31.0888 3232        JavaQuickStarterService (5fd5865dc1a2100f8d4cf000ee5409a3) C:\Programme\Java\jre6\bin\jqs.exe

20:00:31.0998 3232        JavaQuickStarterService - ok

20:00:32.0029 3232        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

20:00:32.0154 3232        Kbdclass - ok

20:00:32.0185 3232        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

20:00:32.0310 3232        kbdhid - ok

20:00:32.0342 3232        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

20:00:32.0482 3232        kmixer - ok

20:00:32.0513 3232        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

20:00:32.0623 3232        KSecDD - ok

20:00:32.0685 3232        lanmanserver    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll

20:00:32.0763 3232        lanmanserver - ok

20:00:32.0826 3232        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll

20:00:32.0935 3232        lanmanworkstation - ok

20:00:32.0935 3232        lbrtfdc - ok

20:00:32.0998 3232        LmHosts         (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll

20:00:33.0138 3232        LmHosts - ok

20:00:33.0170 3232        MBAMSwissArmy   (0db7527db188c7d967a37bb51bbf3963) C:\WINDOWS\system32\drivers\mbamswissarmy.sys

20:00:33.0185 3232        MBAMSwissArmy - ok

20:00:33.0295 3232        McAfee SiteAdvisor Service (6c3d154fff0a97a6c3d9f78d60c41655) C:\Programme\McAfee\SiteAdvisor\McSACore.exe

20:00:33.0576 3232        McAfee SiteAdvisor Service - ok

20:00:33.0701 3232        McMPFSvc        (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe

20:00:33.0810 3232        McMPFSvc - ok

20:00:33.0826 3232        mcmscsvc        (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe

20:00:33.0857 3232        mcmscsvc - ok

20:00:33.0857 3232        McNaiAnn        (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe

20:00:33.0873 3232        McNaiAnn - ok

20:00:33.0888 3232        McNASvc         (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe

20:00:33.0904 3232        McNASvc - ok

20:00:33.0998 3232        McODS           (42117cbc4849a5cf11129912dabbdeca) C:\Programme\McAfee\VirusScan\mcods.exe

20:00:34.0045 3232        McODS - ok

20:00:34.0045 3232        McProxy         (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe

20:00:34.0076 3232        McProxy - ok

20:00:34.0170 3232        McShield        (593fa4c378818ece76ba64a11ad56cf2) C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mcshield.exe

20:00:34.0295 3232        McShield - ok

20:00:34.0326 3232        Messenger       (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll

20:00:34.0467 3232        Messenger - ok

20:00:34.0513 3232        mfeapfk         (43c31bdf404a6d7a7ac1bfd5ead2a566) C:\WINDOWS\system32\drivers\mfeapfk.sys

20:00:34.0545 3232        mfeapfk - ok

20:00:34.0576 3232        mfeavfk         (c1dc5f42d3367f33b6451be78b38bd46) C:\WINDOWS\system32\drivers\mfeavfk.sys

20:00:34.0607 3232        mfeavfk - ok

20:00:34.0607 3232        mfeavfk01 - ok

20:00:34.0623 3232        mfebopk         (0435c43f4c2be01b84868ad2a906397b) C:\WINDOWS\system32\drivers\mfebopk.sys

20:00:34.0670 3232        mfebopk - ok

20:00:34.0701 3232        mfefire         (7e1f8b1bdc8240f08bd358b3a466c005) C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mfefire.exe

20:00:34.0810 3232        mfefire - ok

20:00:34.0857 3232        mfefirek        (4ea6ff90015424517843e931448e00f1) C:\WINDOWS\system32\drivers\mfefirek.sys

20:00:34.0873 3232        mfefirek - ok

20:00:34.0935 3232        mfehidk         (d1e998748ba24a731106611d535c6bbf) C:\WINDOWS\system32\drivers\mfehidk.sys

20:00:34.0982 3232        mfehidk - ok

20:00:35.0045 3232        mfendisk        (26c76d10ed650e6492800d6f081ecfba) C:\WINDOWS\system32\DRIVERS\mfendisk.sys

20:00:35.0060 3232        mfendisk - ok

20:00:35.0060 3232        mfendiskmp      (26c76d10ed650e6492800d6f081ecfba) C:\WINDOWS\system32\DRIVERS\mfendisk.sys

20:00:35.0092 3232        mfendiskmp - ok

20:00:35.0123 3232        mferkdet        (f454a13377f0a006d20a8c14a753c432) C:\WINDOWS\system32\drivers\mferkdet.sys

20:00:35.0154 3232        mferkdet - ok

20:00:35.0185 3232        mferkdk         (41fe2f288e05a6c8ab85dd56770ffbad) C:\WINDOWS\system32\drivers\mferkdk.sys

20:00:35.0201 3232        mferkdk - ok

20:00:35.0248 3232        mfesmfk         (096b52ea918aa909ba5903d79e129005) C:\WINDOWS\system32\drivers\mfesmfk.sys

20:00:35.0263 3232        mfesmfk - ok

20:00:35.0279 3232        mfetdi2k        (070d3faf2eac417c59d8674a8752f7a6) C:\WINDOWS\system32\drivers\mfetdi2k.sys

20:00:35.0295 3232        mfetdi2k - ok

20:00:35.0388 3232        mfevtp          (b10c4efd40810c08f4b44df2efcb54f7) C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe

20:00:35.0498 3232        mfevtp - ok

20:00:35.0529 3232        mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

20:00:35.0670 3232        mnmdd - ok

20:00:35.0717 3232        mnmsrvc         (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe

20:00:35.0842 3232        mnmsrvc - ok

20:00:35.0935 3232        MOBKbackup      (aea8691282dd0afb4b753e378c5501f5) C:\Programme\McAfee Online Backup\MOBKbackup.exe

20:00:36.0045 3232        MOBKbackup - ok

20:00:36.0076 3232        MOBKFilter      (e896775837a8bce436348df460522394) C:\WINDOWS\system32\DRIVERS\MOBK.sys

20:00:36.0092 3232        MOBKFilter - ok

20:00:36.0123 3232        Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys

20:00:36.0263 3232        Modem - ok

20:00:36.0279 3232        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys

20:00:36.0420 3232        Mouclass - ok

20:00:36.0467 3232        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys

20:00:36.0592 3232        mouhid - ok

20:00:36.0607 3232        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

20:00:36.0732 3232        MountMgr - ok

20:00:36.0779 3232        MozillaMaintenance (6380ff81dd4d78b23398752d2f46ea43) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe

20:00:36.0920 3232        MozillaMaintenance - ok

20:00:37.0013 3232        mozybackup      (55b717af54ac492fbd275835e5b485ad) C:\Programme\MozyHome\mozybackup.exe

20:00:37.0029 3232        mozybackup - ok

20:00:37.0029 3232        mozyFilter      (8e5f185f04d4ff203afbb0fd2b609e88) C:\WINDOWS\system32\DRIVERS\mozy.sys

20:00:37.0045 3232        mozyFilter - ok

20:00:37.0060 3232        mraid35x - ok

20:00:37.0076 3232        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

20:00:37.0217 3232        MRxDAV - ok

20:00:37.0279 3232        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

20:00:37.0420 3232        MRxSmb - ok

20:00:37.0451 3232        MSDTC           (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe

20:00:37.0607 3232        MSDTC - ok

20:00:37.0623 3232        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

20:00:37.0763 3232        Msfs - ok

20:00:37.0779 3232        MSIServer - ok

20:00:37.0842 3232        MSK80Service    (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe

20:00:37.0857 3232        MSK80Service - ok

20:00:37.0904 3232        MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

20:00:38.0045 3232        MSKSSRV - ok

20:00:38.0045 3232        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

20:00:38.0170 3232        MSPCLOCK - ok

20:00:38.0217 3232        MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

20:00:38.0342 3232        MSPQM - ok

20:00:38.0357 3232        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

20:00:38.0498 3232        mssmbios - ok

20:00:38.0529 3232        Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

20:00:38.0607 3232        Mup - ok

20:00:38.0670 3232        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll

20:00:38.0826 3232        napagent - ok

20:00:38.0842 3232        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

20:00:38.0982 3232        NDIS - ok

20:00:39.0013 3232        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

20:00:39.0092 3232        NdisTapi - ok

20:00:39.0123 3232        Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

20:00:39.0263 3232        Ndisuio - ok

20:00:39.0310 3232        NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

20:00:39.0451 3232        NdisWan - ok

20:00:39.0467 3232        NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

20:00:39.0545 3232        NDProxy - ok

20:00:39.0560 3232        NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

20:00:39.0685 3232        NetBIOS - ok

20:00:39.0701 3232        NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

20:00:39.0873 3232        NetBT - ok

20:00:39.0935 3232        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe

20:00:40.0060 3232        NetDDE - ok

20:00:40.0076 3232        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe

20:00:40.0217 3232        NetDDEdsdm - ok

20:00:40.0232 3232        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

20:00:40.0357 3232        Netlogon - ok

20:00:40.0388 3232        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll

20:00:40.0545 3232        Netman - ok

20:00:40.0576 3232        Nla             (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll

20:00:40.0638 3232        Nla - ok

20:00:40.0670 3232        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

20:00:40.0795 3232        Npfs - ok

20:00:40.0857 3232        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

20:00:41.0013 3232        Ntfs - ok

20:00:41.0029 3232        NtLmSsp         (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

20:00:41.0154 3232        NtLmSsp - ok

20:00:41.0201 3232        NtmsSvc         (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll

20:00:41.0373 3232        NtmsSvc - ok

20:00:41.0404 3232        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

20:00:41.0545 3232        Null - ok

20:00:41.0576 3232        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

20:00:41.0701 3232        NwlnkFlt - ok

20:00:41.0717 3232        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

20:00:41.0873 3232        NwlnkFwd - ok

20:00:41.0998 3232        ose             (7a56cf3e3f12e8af599963b16f50fb6a) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE

20:00:42.0045 3232        ose - ok

20:00:42.0092 3232        Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys

20:00:42.0217 3232        Parport - ok

20:00:42.0232 3232        PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

20:00:42.0373 3232        PartMgr - ok

20:00:42.0404 3232        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys

20:00:42.0545 3232        ParVdm - ok

20:00:42.0560 3232        PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys

20:00:42.0717 3232        PCI - ok

20:00:42.0732 3232        PCIDump - ok

20:00:42.0779 3232        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\drivers\PCIIde.sys

20:00:42.0904 3232        PCIIde - ok

20:00:42.0951 3232        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys

20:00:43.0092 3232        Pcmcia - ok

20:00:43.0107 3232        PDCOMP - ok

20:00:43.0123 3232        PDFRAME - ok

20:00:43.0123 3232        PDRELI - ok

20:00:43.0138 3232        PDRFRAME - ok

20:00:43.0154 3232        perc2 - ok

20:00:43.0154 3232        perc2hib - ok

20:00:43.0217 3232        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe

20:00:43.0232 3232        PlugPlay - ok

20:00:43.0248 3232        PolicyAgent     (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

20:00:43.0373 3232        PolicyAgent - ok

20:00:43.0388 3232        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

20:00:43.0529 3232        PptpMiniport - ok

20:00:43.0576 3232        PRISM_A02       (57e95881e5f014816a8a53ad94ee0c48) C:\WINDOWS\system32\DRIVERS\WUSB20XP.sys

20:00:43.0607 3232        PRISM_A02 ( UnsignedFile.Multi.Generic ) - warning

20:00:43.0607 3232        PRISM_A02 - detected UnsignedFile.Multi.Generic (1)

20:00:43.0623 3232        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

20:00:43.0748 3232        ProtectedStorage - ok

20:00:43.0779 3232        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

20:00:43.0904 3232        PSched - ok

20:00:43.0951 3232        Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

20:00:44.0092 3232        Ptilink - ok

20:00:44.0092 3232        ql1080 - ok

20:00:44.0107 3232        Ql10wnt - ok

20:00:44.0107 3232        ql12160 - ok

20:00:44.0123 3232        ql1240 - ok

20:00:44.0123 3232        ql1280 - ok

20:00:44.0154 3232        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

20:00:44.0279 3232        RasAcd - ok

20:00:44.0326 3232        RasAuto         (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll

20:00:44.0482 3232        RasAuto - ok

20:00:44.0513 3232        Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

20:00:44.0638 3232        Rasl2tp - ok

20:00:44.0701 3232        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll

20:00:44.0857 3232        RasMan - ok

20:00:44.0873 3232        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

20:00:44.0998 3232        RasPppoe - ok

20:00:45.0013 3232        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

20:00:45.0154 3232        Raspti - ok

20:00:45.0201 3232        Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

20:00:45.0357 3232        Rdbss - ok

20:00:45.0373 3232        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

20:00:45.0498 3232        RDPCDD - ok

20:00:45.0545 3232        rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

20:00:45.0685 3232        rdpdr - ok

20:00:45.0748 3232        RDPWD           (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys

20:00:45.0826 3232        RDPWD - ok

20:00:45.0857 3232        RDSessMgr       (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe

20:00:46.0013 3232        RDSessMgr - ok

20:00:46.0045 3232        redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys

20:00:46.0170 3232        redbook - ok

20:00:46.0217 3232        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll

20:00:46.0342 3232        RemoteAccess - ok

20:00:46.0373 3232        RemoteRegistry  (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll

20:00:46.0513 3232        RemoteRegistry - ok

20:00:46.0545 3232        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe

20:00:46.0670 3232        RpcLocator - ok

20:00:46.0732 3232        RpcSs           (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll

20:00:46.0779 3232        RpcSs - ok

20:00:46.0842 3232        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe

20:00:46.0998 3232        RSVP - ok

20:00:47.0045 3232        SamSs           (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

20:00:47.0170 3232        SamSs - ok

20:00:47.0185 3232        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe

20:00:47.0342 3232        SCardSvr - ok

20:00:47.0404 3232        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll

20:00:47.0545 3232        Schedule - ok

20:00:47.0560 3232        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

20:00:47.0638 3232        Secdrv - ok

20:00:47.0654 3232        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll

20:00:47.0795 3232        seclogon - ok

20:00:47.0810 3232        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll

20:00:47.0951 3232        SENS - ok

20:00:47.0982 3232        serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

20:00:48.0107 3232        serenum - ok

20:00:48.0123 3232        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys

20:00:48.0263 3232        Serial - ok

20:00:48.0295 3232        Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys

20:00:48.0420 3232        Sfloppy - ok

20:00:48.0482 3232        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll

20:00:48.0638 3232        SharedAccess - ok

20:00:48.0685 3232        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll

20:00:48.0717 3232        ShellHWDetection - ok

20:00:48.0732 3232        Simbad - ok

20:00:48.0795 3232        smwdm           (4aa922332433cdeb8b82c072c212e32e) C:\WINDOWS\system32\drivers\smwdm.sys

20:00:48.0857 3232        smwdm - ok

20:00:48.0873 3232        Sparrow - ok

20:00:48.0935 3232        spkrmon         (4a205d78d17e6234986ddcd0da2761e9) C:\Programme\Analog Devices\SoundMAX\spkrmon.exe

20:00:49.0060 3232        spkrmon ( UnsignedFile.Multi.Generic ) - warning

20:00:49.0060 3232        spkrmon - detected UnsignedFile.Multi.Generic (1)

20:00:49.0107 3232        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

20:00:49.0232 3232        splitter - ok

20:00:49.0279 3232        Spooler         (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe

20:00:49.0310 3232        Spooler - ok

20:00:49.0342 3232        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys

20:00:49.0420 3232        sr - ok

20:00:49.0482 3232        srservice       (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll

20:00:49.0592 3232        srservice - ok

20:00:49.0638 3232        Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

20:00:49.0748 3232        Srv - ok

20:00:49.0795 3232        SSDPSRV         (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll

20:00:49.0873 3232        SSDPSRV - ok

20:00:49.0904 3232        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll

20:00:50.0076 3232        stisvc - ok

20:00:50.0107 3232        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

20:00:50.0248 3232        swenum - ok

20:00:50.0263 3232        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

20:00:50.0388 3232        swmidi - ok

20:00:50.0404 3232        SwPrv - ok

20:00:50.0404 3232        symc810 - ok

20:00:50.0420 3232        symc8xx - ok

20:00:50.0420 3232        sym_hi - ok

20:00:50.0435 3232        sym_u3 - ok

20:00:50.0467 3232        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

20:00:50.0638 3232        sysaudio - ok

20:00:50.0670 3232        SysmonLog       (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe

20:00:50.0795 3232        SysmonLog - ok

20:00:50.0826 3232        TapiSrv         (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll

20:00:50.0998 3232        TapiSrv - ok

20:00:51.0045 3232        Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

20:00:51.0076 3232        Tcpip - ok

20:00:51.0107 3232        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

20:00:51.0232 3232        TDPIPE - ok

20:00:51.0263 3232        TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

20:00:51.0404 3232        TDTCP - ok

20:00:51.0420 3232        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

20:00:51.0545 3232        TermDD - ok

20:00:51.0592 3232        TermService     (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll

20:00:51.0748 3232        TermService - ok

20:00:51.0795 3232        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll

20:00:51.0826 3232        Themes - ok

20:00:51.0873 3232        TlntSvr         (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\system32\tlntsvr.exe

20:00:51.0951 3232        TlntSvr - ok

20:00:51.0951 3232        TosIde - ok

20:00:51.0998 3232        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll

20:00:52.0123 3232        TrkWks - ok

20:00:52.0170 3232        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

20:00:52.0326 3232        Udfs - ok

20:00:52.0326 3232        ultra - ok

20:00:52.0388 3232        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

20:00:52.0576 3232        Update - ok

20:00:52.0607 3232        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll

20:00:52.0732 3232        upnphost - ok

20:00:52.0779 3232        UPS             (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe

20:00:52.0904 3232        UPS - ok

20:00:52.0920 3232        usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

20:00:53.0138 3232        usbehci - ok

20:00:53.0217 3232        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

20:00:53.0529 3232        usbhub - ok

20:00:53.0545 3232        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

20:00:53.0795 3232        usbprint - ok

20:00:53.0810 3232        USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

20:00:53.0935 3232        USBSTOR - ok

20:00:53.0967 3232        usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

20:00:54.0092 3232        usbuhci - ok

20:00:54.0107 3232        VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

20:00:54.0232 3232        VgaSave - ok

20:00:54.0248 3232        ViaIde - ok

20:00:54.0263 3232        VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys

20:00:54.0388 3232        VolSnap - ok

20:00:54.0451 3232        VSS             (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe

20:00:54.0545 3232        VSS - ok

20:00:54.0576 3232        W32Time         (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll

20:00:54.0732 3232        W32Time - ok

20:00:54.0748 3232        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

20:00:54.0920 3232        Wanarp - ok

20:00:54.0935 3232        WDICA - ok

20:00:54.0951 3232        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

20:00:55.0107 3232        wdmaud - ok

20:00:55.0138 3232        WebClient       (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll

20:00:55.0279 3232        WebClient - ok

20:00:56.0263 3232        winmgmt         (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll

20:00:56.0623 3232        winmgmt - ok

20:00:56.0670 3232        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll

20:00:56.0763 3232        WmdmPmSN - ok

20:00:56.0826 3232        Wmi             (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll

20:00:56.0888 3232        Wmi - ok

20:00:56.0935 3232        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe

20:00:57.0123 3232        WmiApSrv - ok

20:00:57.0279 3232        WMPNetworkSvc   (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe

20:00:57.0498 3232        WMPNetworkSvc - ok

20:00:57.0545 3232        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\Drivers\wpdusb.sys

20:00:57.0592 3232        WpdUsb - ok

20:00:57.0638 3232        WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

20:00:57.0763 3232        WS2IFSL - ok

20:00:57.0810 3232        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll

20:00:57.0935 3232        wscsvc - ok

20:00:57.0982 3232        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll

20:00:58.0107 3232        wuauserv - ok

20:00:58.0138 3232        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

20:00:58.0201 3232        WudfPf - ok

20:00:58.0217 3232        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

20:00:58.0263 3232        WudfRd - ok

20:00:58.0295 3232        WudfSvc         (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll

20:00:58.0326 3232        WudfSvc - ok

20:00:58.0373 3232        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll

20:00:58.0560 3232        WZCSVC - ok

20:00:58.0592 3232        xmlprov         (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll

20:00:58.0748 3232        xmlprov - ok

20:00:58.0779 3232        MBR (0x1B8)     (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0

20:00:58.0810 3232        \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - infected

20:00:58.0810 3232        \Device\Harddisk0\DR0 - detected Rootkit.Boot.Sinowal.b (0)

20:00:58.0842 3232        MBR (0x1B8)     (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR2

20:00:58.0967 3232        \Device\Harddisk1\DR2 - ok

20:00:58.0967 3232        Boot (0x1200)   (beaff209fcf932c1d7ff731f54d95dc9) \Device\Harddisk0\DR0\Partition0

20:00:58.0982 3232        \Device\Harddisk0\DR0\Partition0 - ok

20:00:58.0982 3232        Boot (0x1200)   (03db26b74f1015c63ae2e7b6cbcb7005) \Device\Harddisk1\DR2\Partition0

20:00:58.0982 3232        \Device\Harddisk1\DR2\Partition0 - ok

20:00:58.0982 3232        ============================================================

20:00:58.0982 3232        Scan finished

20:00:58.0982 3232        ============================================================

20:00:58.0998 3112        Detected object count: 9

20:00:58.0998 3112        Actual detected object count: 9

20:34:53.0857 3112        aspnet_state ( UnsignedFile.Multi.Generic ) - skipped by user

20:34:53.0982 3112        aspnet_state ( UnsignedFile.Multi.Generic ) - User select action: Skip 

20:34:53.0982 3112        AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - skipped by user

20:34:53.0982 3112        AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 

20:34:53.0997 3112        avmeject ( UnsignedFile.Multi.Generic ) - skipped by user

20:34:53.0997 3112        avmeject ( UnsignedFile.Multi.Generic ) - User select action: Skip 

20:34:53.0997 3112        bkn50USB ( UnsignedFile.Multi.Generic ) - skipped by user

20:34:53.0997 3112        bkn50USB ( UnsignedFile.Multi.Generic ) - User select action: Skip 

20:34:53.0997 3112        ialm ( UnsignedFile.Multi.Generic ) - skipped by user

20:34:53.0997 3112        ialm ( UnsignedFile.Multi.Generic ) - User select action: Skip 

20:34:53.0997 3112        IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

20:34:53.0997 3112        IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 

20:34:54.0013 3112        PRISM_A02 ( UnsignedFile.Multi.Generic ) - skipped by user

20:34:54.0013 3112        PRISM_A02 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

20:34:54.0013 3112        spkrmon ( UnsignedFile.Multi.Generic ) - skipped by user

20:34:54.0013 3112        spkrmon ( UnsignedFile.Multi.Generic ) - User select action: Skip 

20:34:54.0060 3112        \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - skipped by user

20:34:54.0075 3112        \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - User select action: Skip

Zitat:

\Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - skipped by user

Den SInowal bitte mit dem TDSS-Killer löschen lassen, starte Windows danach neu und mach ein neues Log mit diesem Tool. Poste es wieder mit CODE-Tags umschlossen.

und hier das TDSS log nach Löschung:

Code:

17:02:06.0000 2284        TDSS rootkit removing tool 2.7.34.0 May  2 2012 09:59:18

17:02:08.0000 2284        ============================================================

17:02:08.0000 2284        Current date / time: 2012/06/13 17:02:08.0000

17:02:08.0000 2284        SystemInfo:

17:02:08.0000 2284        

17:02:08.0000 2284        OS Version: 5.1.2600 ServicePack: 3.0

17:02:08.0000 2284        Product type: Workstation

17:02:08.0000 2284        ComputerName: PHYSIOCARE-1

17:02:08.0000 2284        UserName: Administrator

17:02:08.0000 2284        Windows directory: C:\WINDOWS

17:02:08.0000 2284        System windows directory: C:\WINDOWS

17:02:08.0000 2284        Processor architecture: Intel x86

17:02:08.0000 2284        Number of processors: 1

17:02:08.0000 2284        Page size: 0x1000

17:02:08.0000 2284        Boot type: Normal boot

17:02:08.0000 2284        ============================================================

17:02:11.0921 2284        Drive \Device\Harddisk0\DR0 - Size: 0x12A05F2000 (74.51 Gb), SectorSize: 0x200, Cylinders: 0x25FE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

17:02:11.0921 2284        Drive \Device\Harddisk1\DR2 - Size: 0xEEF00000 (3.73 Gb), SectorSize: 0x200, Cylinders: 0x1E7, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

17:02:11.0921 2284        ============================================================

17:02:11.0921 2284        \Device\Harddisk0\DR0:

17:02:11.0921 2284        MBR partitions:

17:02:11.0921 2284        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x94FE97E

17:02:11.0921 2284        \Device\Harddisk1\DR2:

17:02:11.0921 2284        MBR partitions:

17:02:11.0921 2284        \Device\Harddisk1\DR2\Partition0: MBR, Type 0xB, StartLBA 0x20, BlocksNum 0x7777E0

17:02:11.0921 2284        ============================================================

17:02:12.0156 2284        C: <-> \Device\Harddisk0\DR0\Partition0

17:02:12.0156 2284        ============================================================

17:02:12.0156 2284        Initialize success

17:02:12.0156 2284        ============================================================

17:02:42.0390 2720        ============================================================

17:02:42.0390 2720        Scan started

17:02:42.0390 2720        Mode: Manual; SigCheck; TDLFS; 

17:02:42.0390 2720        ============================================================

17:02:47.0515 2720        Abiosdsk - ok

17:02:47.0515 2720        abp480n5 - ok

17:02:47.0578 2720        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys

17:02:48.0218 2720        ACPI - ok

17:02:48.0265 2720        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys

17:02:48.0531 2720        ACPIEC - ok

17:02:48.0531 2720        adpu160m - ok

17:02:48.0562 2720        aeaudio         (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys

17:02:48.0687 2720        aeaudio - ok

17:02:48.0828 2720        aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

17:02:49.0093 2720        aec - ok

17:02:49.0203 2720        AFD             (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

17:02:49.0375 2720        AFD - ok

17:02:49.0390 2720        Aha154x - ok

17:02:49.0406 2720        aic78u2 - ok

17:02:49.0421 2720        aic78xx - ok

17:02:49.0562 2720        Alerter         (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll

17:02:49.0937 2720        Alerter - ok

17:02:49.0968 2720        ALG             (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe

17:02:50.0171 2720        ALG - ok

17:02:50.0171 2720        AliIde - ok

17:02:50.0187 2720        amsint - ok

17:02:50.0296 2720        AppMgmt         (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll

17:02:50.0500 2720        AppMgmt - ok

17:02:50.0500 2720        asc - ok

17:02:50.0515 2720        asc3350p - ok

17:02:50.0515 2720        asc3550 - ok

17:02:51.0265 2720        aspnet_state    (e1a1206a4fb19b675e947b29ccd25fba) C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe

17:02:51.0343 2720        aspnet_state ( UnsignedFile.Multi.Generic ) - warning

17:02:51.0343 2720        aspnet_state - detected UnsignedFile.Multi.Generic (1)

17:02:51.0375 2720        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

17:02:51.0718 2720        AsyncMac - ok

17:02:51.0859 2720        atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

17:02:52.0125 2720        atapi - ok

17:02:52.0140 2720        Atdisk - ok

17:02:52.0187 2720        Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

17:02:52.0421 2720        Atmarpc - ok

17:02:52.0468 2720        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll

17:02:52.0890 2720        AudioSrv - ok

17:02:52.0921 2720        audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

17:02:53.0203 2720        audstub - ok

17:02:53.0531 2720        AVM WLAN Connection Service (06c3528e0686a58701367749b0145a4a) C:\Programme\avmwlanstick\WlanNetService.exe

17:02:53.0968 2720        AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - warning

17:02:53.0968 2720        AVM WLAN Connection Service - detected UnsignedFile.Multi.Generic (1)

17:02:54.0062 2720        avmeject        (263cf9d248fd5e020a1333ed4f7eaa88) C:\WINDOWS\system32\drivers\avmeject.sys

17:02:54.0312 2720        avmeject ( UnsignedFile.Multi.Generic ) - warning

17:02:54.0312 2720        avmeject - detected UnsignedFile.Multi.Generic (1)

17:02:54.0578 2720        b57w2k          (4826fcf97c47b361a2e2f68cd487a19e) C:\WINDOWS\system32\DRIVERS\b57xp32.sys

17:02:54.0812 2720        b57w2k - ok

17:02:55.0031 2720        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

17:02:55.0328 2720        Beep - ok

17:02:55.0578 2720        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll

17:02:55.0875 2720        BITS - ok

17:02:56.0171 2720        bkn50USB        (6d39682a1051a5be7437ec99f1bf9921) C:\WINDOWS\system32\DRIVERS\rt2500usb.sys

17:02:56.0390 2720        bkn50USB ( UnsignedFile.Multi.Generic ) - warning

17:02:56.0390 2720        bkn50USB - detected UnsignedFile.Multi.Generic (1)

17:02:56.0546 2720        Browser         (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll

17:02:56.0843 2720        Browser - ok

17:02:56.0890 2720        cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

17:02:57.0203 2720        cbidf2k - ok

17:02:57.0203 2720        cd20xrnt - ok

17:02:57.0250 2720        Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

17:02:57.0437 2720        Cdaudio - ok

17:02:57.0500 2720        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

17:02:57.0703 2720        Cdfs - ok

17:02:57.0796 2720        Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

17:02:57.0984 2720        Cdrom - ok

17:02:58.0093 2720        cfwids          (1c7b1e36f3ced9e4b0b13385e627fe8b) C:\WINDOWS\system32\drivers\cfwids.sys

17:03:09.0156 2720        cfwids - ok

17:03:09.0156 2720        Changer - ok

17:03:09.0203 2720        CiSvc           (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe

17:03:09.0468 2720        CiSvc - ok

17:03:09.0750 2720        ClipSrv         (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe

17:03:10.0031 2720        ClipSrv - ok

17:03:10.0046 2720        CmdIde - ok

17:03:10.0046 2720        COMSysApp - ok

17:03:10.0062 2720        Cpqarray - ok

17:03:10.0140 2720        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll

17:03:10.0437 2720        CryptSvc - ok

17:03:10.0453 2720        dac2w2k - ok

17:03:10.0453 2720        dac960nt - ok

17:03:11.0078 2720        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll

17:03:11.0140 2720        DcomLaunch - ok

17:03:11.0187 2720        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll

17:03:11.0343 2720        Dhcp - ok

17:03:11.0375 2720        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

17:03:11.0531 2720        Disk - ok

17:03:11.0546 2720        dmadmin - ok

17:03:11.0609 2720        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys

17:03:12.0078 2720        dmboot - ok

17:03:12.0109 2720        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys

17:03:12.0484 2720        dmio - ok

17:03:12.0500 2720        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

17:03:12.0671 2720        dmload - ok

17:03:12.0703 2720        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll

17:03:12.0968 2720        dmserver - ok

17:03:13.0015 2720        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

17:03:13.0156 2720        DMusic - ok

17:03:13.0203 2720        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll

17:03:13.0234 2720        Dnscache - ok

17:03:13.0281 2720        Dot3svc         (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll

17:03:13.0437 2720        Dot3svc - ok

17:03:13.0453 2720        dpti2o - ok

17:03:13.0468 2720        drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

17:03:13.0625 2720        drmkaud - ok

17:03:13.0671 2720        EapHost         (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll

17:03:13.0984 2720        EapHost - ok

17:03:14.0031 2720        ERSvc           (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll

17:03:14.0281 2720        ERSvc - ok

17:03:14.0328 2720        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe

17:03:14.0359 2720        Eventlog - ok

17:03:14.0406 2720        EventSystem     (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll

17:03:14.0437 2720        EventSystem - ok

17:03:14.0484 2720        Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

17:03:14.0640 2720        Fastfat - ok

17:03:14.0687 2720        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll

17:03:14.0734 2720        FastUserSwitchingCompatibility - ok

17:03:14.0765 2720        Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

17:03:14.0906 2720        Fdc - ok

17:03:14.0937 2720        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys

17:03:15.0343 2720        Fips - ok

17:03:15.0359 2720        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

17:03:15.0500 2720        Flpydisk - ok

17:03:15.0546 2720        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

17:03:15.0687 2720        FltMgr - ok

17:03:15.0750 2720        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

17:03:15.0890 2720        Fs_Rec - ok

17:03:15.0921 2720        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

17:03:16.0187 2720        Ftdisk - ok

17:03:16.0250 2720        FWLANUSB        (41077d927c3654fd2d71549763525d75) C:\WINDOWS\system32\DRIVERS\fwlanusb.sys

17:03:16.0406 2720        FWLANUSB - ok

17:03:16.0484 2720        fwlanusbn       (fc06a5be1ab381cd47af3d69006e88f0) C:\WINDOWS\system32\DRIVERS\fwlanusbn.sys

17:03:16.0750 2720        fwlanusbn - ok

17:03:16.0781 2720        Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

17:03:16.0953 2720        Gpc - ok

17:03:16.0953 2720        GTNDIS5 - ok

17:03:17.0062 2720        gupdate         (8f0de4fef8201e306f9938b0905ac96a) C:\Programme\Google\Update\GoogleUpdate.exe

17:03:17.0078 2720        gupdate - ok

17:03:17.0093 2720        gupdatem        (8f0de4fef8201e306f9938b0905ac96a) C:\Programme\Google\Update\GoogleUpdate.exe

17:03:17.0109 2720        gupdatem - ok

17:03:17.0171 2720        gusvc           (cc839e8d766cc31a7710c9f38cf3e375) C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

17:03:17.0187 2720        gusvc - ok

17:03:17.0312 2720        helpsvc         (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

17:03:17.0546 2720        helpsvc - ok

17:03:17.0593 2720        HidServ         (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll

17:03:17.0859 2720        HidServ - ok

17:03:17.0890 2720        hidusb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

17:03:18.0031 2720        hidusb - ok

17:03:18.0062 2720        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll

17:03:18.0328 2720        hkmsvc - ok

17:03:18.0343 2720        hpn - ok

17:03:18.0390 2720        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

17:03:18.0421 2720        HTTP - ok

17:03:18.0453 2720        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll

17:03:18.0718 2720        HTTPFilter - ok

17:03:18.0718 2720        i2omgmt - ok

17:03:18.0734 2720        i2omp - ok

17:03:18.0890 2720        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\drivers\i8042prt.sys

17:03:19.0171 2720        i8042prt - ok

17:03:19.0250 2720        ialm            (0acebb31989cbf9a5663fe4a33d28d21) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys

17:03:19.0453 2720        ialm ( UnsignedFile.Multi.Generic ) - warning

17:03:19.0453 2720        ialm - detected UnsignedFile.Multi.Generic (1)

17:03:19.0578 2720        IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

17:03:19.0765 2720        IDriverT ( UnsignedFile.Multi.Generic ) - warning

17:03:19.0765 2720        IDriverT - detected UnsignedFile.Multi.Generic (1)

17:03:19.0781 2720        Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

17:03:19.0921 2720        Imapi - ok

17:03:19.0953 2720        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe

17:03:20.0140 2720        ImapiService - ok

17:03:20.0140 2720        ini910u - ok

17:03:20.0171 2720        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys

17:03:20.0578 2720        IntelIde - ok

17:03:20.0625 2720        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys

17:03:21.0000 2720        intelppm - ok

17:03:21.0031 2720        Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

17:03:21.0156 2720        Ip6Fw - ok

17:03:21.0218 2720        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

17:03:21.0359 2720        IpFilterDriver - ok

17:03:21.0406 2720        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

17:03:21.0546 2720        IpInIp - ok

17:03:21.0562 2720        IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

17:03:21.0718 2720        IpNat - ok

17:03:21.0750 2720        IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

17:03:21.0890 2720        IPSec - ok

17:03:21.0921 2720        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

17:03:22.0015 2720        IRENUM - ok

17:03:22.0046 2720        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys

17:03:22.0296 2720        isapnp - ok

17:03:22.0421 2720        JavaQuickStarterService (5fd5865dc1a2100f8d4cf000ee5409a3) C:\Programme\Java\jre6\bin\jqs.exe

17:03:22.0593 2720        JavaQuickStarterService - ok

17:03:22.0625 2720        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

17:03:22.0937 2720        Kbdclass - ok

17:03:22.0968 2720        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

17:03:23.0343 2720        kbdhid - ok

17:03:23.0453 2720        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

17:03:23.0656 2720        kmixer - ok

17:03:23.0703 2720        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

17:03:23.0750 2720        KSecDD - ok

17:03:23.0796 2720        lanmanserver    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll

17:03:23.0828 2720        lanmanserver - ok

17:03:23.0875 2720        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll

17:03:23.0890 2720        lanmanworkstation - ok

17:03:23.0906 2720        lbrtfdc - ok

17:03:23.0968 2720        LmHosts         (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll

17:03:24.0125 2720        LmHosts - ok

17:03:24.0156 2720        MBAMSwissArmy   (0db7527db188c7d967a37bb51bbf3963) C:\WINDOWS\system32\drivers\mbamswissarmy.sys

17:03:24.0281 2720        MBAMSwissArmy - ok

17:03:24.0375 2720        McAfee SiteAdvisor Service (6c3d154fff0a97a6c3d9f78d60c41655) C:\Programme\McAfee\SiteAdvisor\McSACore.exe

17:03:24.0734 2720        McAfee SiteAdvisor Service - ok

17:03:24.0875 2720        McMPFSvc        (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe

17:03:25.0000 2720        McMPFSvc - ok

17:03:25.0015 2720        mcmscsvc        (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe

17:03:25.0031 2720        mcmscsvc - ok

17:03:25.0046 2720        McNaiAnn        (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe

17:03:25.0093 2720        McNaiAnn - ok

17:03:25.0093 2720        McNASvc         (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe

17:03:25.0125 2720        McNASvc - ok

17:03:25.0203 2720        McODS           (42117cbc4849a5cf11129912dabbdeca) C:\Programme\McAfee\VirusScan\mcods.exe

17:03:25.0218 2720        McODS - ok

17:03:25.0234 2720        McProxy         (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe

17:03:25.0250 2720        McProxy - ok

17:03:25.0546 2720        McShield        (593fa4c378818ece76ba64a11ad56cf2) C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mcshield.exe

17:03:25.0703 2720        McShield - ok

17:03:26.0000 2720        Messenger       (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll

17:03:26.0421 2720        Messenger - ok

17:03:26.0515 2720        mfeapfk         (43c31bdf404a6d7a7ac1bfd5ead2a566) C:\WINDOWS\system32\drivers\mfeapfk.sys

17:03:26.0687 2720        mfeapfk - ok

17:03:26.0828 2720        mfeavfk         (c1dc5f42d3367f33b6451be78b38bd46) C:\WINDOWS\system32\drivers\mfeavfk.sys

17:03:26.0968 2720        mfeavfk - ok

17:03:26.0984 2720        mfeavfk01 - ok

17:03:27.0093 2720        mfebopk         (0435c43f4c2be01b84868ad2a906397b) C:\WINDOWS\system32\drivers\mfebopk.sys

17:03:27.0265 2720        mfebopk - ok

17:03:27.0453 2720        mfefire         (7e1f8b1bdc8240f08bd358b3a466c005) C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mfefire.exe

17:03:27.0625 2720        mfefire - ok

17:03:27.0796 2720        mfefirek        (4ea6ff90015424517843e931448e00f1) C:\WINDOWS\system32\drivers\mfefirek.sys

17:03:28.0015 2720        mfefirek - ok

17:03:28.0703 2720        mfehidk         (d1e998748ba24a731106611d535c6bbf) C:\WINDOWS\system32\drivers\mfehidk.sys

17:03:29.0328 2720        mfehidk - ok

17:03:29.0390 2720        mfendisk        (26c76d10ed650e6492800d6f081ecfba) C:\WINDOWS\system32\DRIVERS\mfendisk.sys

17:03:29.0562 2720        mfendisk - ok

17:03:29.0593 2720        mfendiskmp      (26c76d10ed650e6492800d6f081ecfba) C:\WINDOWS\system32\DRIVERS\mfendisk.sys

17:03:29.0671 2720        mfendiskmp - ok

17:03:29.0765 2720        mferkdet        (f454a13377f0a006d20a8c14a753c432) C:\WINDOWS\system32\drivers\mferkdet.sys

17:03:29.0921 2720        mferkdet - ok

17:03:30.0000 2720        mferkdk         (41fe2f288e05a6c8ab85dd56770ffbad) C:\WINDOWS\system32\drivers\mferkdk.sys

17:03:30.0125 2720        mferkdk - ok

17:03:30.0187 2720        mfesmfk         (096b52ea918aa909ba5903d79e129005) C:\WINDOWS\system32\drivers\mfesmfk.sys

17:03:30.0500 2720        mfesmfk - ok

17:03:30.0546 2720        mfetdi2k        (070d3faf2eac417c59d8674a8752f7a6) C:\WINDOWS\system32\drivers\mfetdi2k.sys

17:03:30.0718 2720        mfetdi2k - ok

17:03:30.0859 2720        mfevtp          (b10c4efd40810c08f4b44df2efcb54f7) C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfevtps.exe

17:03:31.0046 2720        mfevtp - ok

17:03:31.0093 2720        mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

17:03:31.0406 2720        mnmdd - ok

17:03:31.0468 2720        mnmsrvc         (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe

17:03:31.0734 2720        mnmsrvc - ok

17:03:31.0875 2720        MOBKbackup      (aea8691282dd0afb4b753e378c5501f5) C:\Programme\McAfee Online Backup\MOBKbackup.exe

17:03:32.0062 2720        MOBKbackup - ok

17:03:32.0078 2720        MOBKFilter      (e896775837a8bce436348df460522394) C:\WINDOWS\system32\DRIVERS\MOBK.sys

17:03:32.0562 2720        MOBKFilter - ok

17:03:32.0765 2720        Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys

17:03:33.0125 2720        Modem - ok

17:03:33.0218 2720        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys

17:03:33.0562 2720        Mouclass - ok

17:03:33.0640 2720        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys

17:03:33.0921 2720        mouhid - ok

17:03:34.0078 2720        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

17:03:34.0296 2720        MountMgr - ok

17:03:34.0500 2720        MozillaMaintenance (6380ff81dd4d78b23398752d2f46ea43) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe

17:03:35.0937 2720        MozillaMaintenance - ok

17:03:36.0359 2720        mozybackup      (55b717af54ac492fbd275835e5b485ad) C:\Programme\MozyHome\mozybackup.exe

17:03:36.0546 2720        mozybackup - ok

17:03:36.0921 2720        mozyFilter      (8e5f185f04d4ff203afbb0fd2b609e88) C:\WINDOWS\system32\DRIVERS\mozy.sys

17:03:37.0296 2720        mozyFilter - ok

17:03:37.0312 2720        mraid35x - ok

17:03:38.0140 2720        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

17:03:38.0312 2720        MRxDAV - ok

17:03:38.0375 2720        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

17:03:38.0468 2720        MRxSmb - ok

17:03:38.0515 2720        MSDTC           (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe

17:03:38.0843 2720        MSDTC - ok

17:03:38.0890 2720        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

17:03:39.0031 2720        Msfs - ok

17:03:39.0046 2720        MSIServer - ok

17:03:39.0156 2720        MSK80Service    (7e6932eeda54c8eaf7dc6c2225261b85) C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe

17:03:39.0171 2720        MSK80Service - ok

17:03:39.0187 2720        MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

17:03:39.0328 2720        MSKSSRV - ok

17:03:39.0343 2720        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

17:03:39.0484 2720        MSPCLOCK - ok

17:03:39.0500 2720        MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

17:03:39.0640 2720        MSPQM - ok

17:03:39.0687 2720        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

17:03:39.0828 2720        mssmbios - ok

17:03:39.0875 2720        Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

17:03:39.0906 2720        Mup - ok

17:03:40.0015 2720        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll

17:03:40.0296 2720        napagent - ok

17:03:40.0328 2720        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

17:03:40.0484 2720        NDIS - ok

17:03:40.0578 2720        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

17:03:40.0640 2720        NdisTapi - ok

17:03:40.0687 2720        Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

17:03:40.0937 2720        Ndisuio - ok

17:03:41.0015 2720        NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

17:03:41.0203 2720        NdisWan - ok

17:03:41.0250 2720        NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

17:03:41.0328 2720        NDProxy - ok

17:03:41.0609 2720        NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

17:03:41.0765 2720        NetBIOS - ok

17:03:42.0234 2720        NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

17:03:42.0500 2720        NetBT - ok

17:03:42.0765 2720        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe

17:03:43.0843 2720        NetDDE - ok

17:03:43.0843 2720        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe

17:03:44.0093 2720        NetDDEdsdm - ok

17:03:44.0328 2720        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

17:03:44.0546 2720        Netlogon - ok

17:03:45.0140 2720        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll

17:03:45.0406 2720        Netman - ok

17:03:47.0296 2720        Nla             (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll

17:03:47.0546 2720        Nla - ok

17:03:47.0843 2720        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

17:03:48.0156 2720        Npfs - ok

17:03:48.0421 2720        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

17:03:48.0750 2720        Ntfs - ok

17:03:48.0750 2720        NtLmSsp         (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

17:03:49.0078 2720        NtLmSsp - ok

17:03:49.0359 2720        NtmsSvc         (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll

17:03:49.0750 2720        NtmsSvc - ok

17:03:49.0796 2720        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

17:03:50.0140 2720        Null - ok

17:03:50.0187 2720        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

17:03:50.0515 2720        NwlnkFlt - ok

17:03:50.0531 2720        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

17:03:50.0875 2720        NwlnkFwd - ok

17:03:51.0109 2720        ose             (7a56cf3e3f12e8af599963b16f50fb6a) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE

17:03:51.0156 2720        ose - ok

17:03:51.0234 2720        Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys

17:03:51.0750 2720        Parport - ok

17:03:51.0750 2720        PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

17:03:52.0015 2720        PartMgr - ok

17:03:52.0078 2720        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys

17:03:52.0515 2720        ParVdm - ok

17:03:52.0656 2720        PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys

17:03:53.0078 2720        PCI - ok

17:03:53.0078 2720        PCIDump - ok

17:03:53.0125 2720        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\drivers\PCIIde.sys

17:03:53.0500 2720        PCIIde - ok

17:03:53.0687 2720        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys

17:03:54.0031 2720        Pcmcia - ok

17:03:54.0031 2720        PDCOMP - ok

17:03:54.0046 2720        PDFRAME - ok

17:03:54.0046 2720        PDRELI - ok

17:03:54.0062 2720        PDRFRAME - ok

17:03:54.0062 2720        perc2 - ok

17:03:54.0078 2720        perc2hib - ok

17:03:54.0187 2720        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe

17:03:54.0312 2720        PlugPlay - ok

17:03:54.0312 2720        PolicyAgent     (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

17:03:54.0578 2720        PolicyAgent - ok

17:03:54.0718 2720        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

17:03:55.0015 2720        PptpMiniport - ok

17:03:55.0171 2720        PRISM_A02       (57e95881e5f014816a8a53ad94ee0c48) C:\WINDOWS\system32\DRIVERS\WUSB20XP.sys

17:03:55.0468 2720        PRISM_A02 ( UnsignedFile.Multi.Generic ) - warning

17:03:55.0468 2720        PRISM_A02 - detected UnsignedFile.Multi.Generic (1)

17:03:55.0468 2720        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

17:03:55.0765 2720        ProtectedStorage - ok

17:03:55.0781 2720        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

17:03:56.0125 2720        PSched - ok

17:03:56.0156 2720        Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

17:03:56.0468 2720        Ptilink - ok

17:03:56.0468 2720        ql1080 - ok

17:03:56.0484 2720        Ql10wnt - ok

17:03:56.0484 2720        ql12160 - ok

17:03:56.0500 2720        ql1240 - ok

17:03:56.0531 2720        ql1280 - ok

17:03:56.0562 2720        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

17:03:56.0828 2720        RasAcd - ok

17:03:56.0875 2720        RasAuto         (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll

17:03:57.0281 2720        RasAuto - ok

17:03:57.0312 2720        Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

17:03:57.0468 2720        Rasl2tp - ok

17:03:58.0125 2720        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll

17:03:58.0265 2720        RasMan - ok

17:03:58.0296 2720        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

17:03:58.0468 2720        RasPppoe - ok

17:03:58.0718 2720        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

17:03:58.0859 2720        Raspti - ok

17:03:59.0125 2720        Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

17:03:59.0343 2720        Rdbss - ok

17:03:59.0375 2720        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

17:03:59.0515 2720        RDPCDD - ok

17:03:59.0578 2720        rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

17:03:59.0765 2720        rdpdr - ok

17:04:00.0015 2720        RDPWD           (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys

17:04:00.0093 2720        RDPWD - ok

17:04:00.0140 2720        RDSessMgr       (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe

17:04:00.0328 2720        RDSessMgr - ok

17:04:00.0609 2720        redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys

17:04:01.0156 2720        redbook - ok

17:04:01.0265 2720        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll

17:04:01.0687 2720        RemoteAccess - ok

17:04:01.0718 2720        RemoteRegistry  (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll

17:04:02.0093 2720        RemoteRegistry - ok

17:04:02.0625 2720        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe

17:04:03.0125 2720        RpcLocator - ok

17:04:03.0484 2720        RpcSs           (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll

17:04:03.0562 2720        RpcSs - ok

17:04:03.0984 2720        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe

17:04:04.0468 2720        RSVP - ok

17:04:04.0500 2720        SamSs           (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

17:04:04.0750 2720        SamSs - ok

17:04:04.0812 2720        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe

17:04:05.0296 2720        SCardSvr - ok

17:04:05.0390 2720        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll

17:04:05.0796 2720        Schedule - ok

17:04:05.0828 2720        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

17:04:06.0046 2720        Secdrv - ok

17:04:06.0078 2720        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll

17:04:06.0375 2720        seclogon - ok

17:04:06.0406 2720        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll

17:04:06.0562 2720        SENS - ok

17:04:06.0640 2720        serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

17:04:06.0781 2720        serenum - ok

17:04:06.0828 2720        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys

17:04:07.0140 2720        Serial - ok

17:04:07.0187 2720        Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys

17:04:07.0390 2720        Sfloppy - ok

17:04:07.0593 2720        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll

17:04:07.0906 2720        SharedAccess - ok

17:04:08.0078 2720        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll

17:04:08.0156 2720        ShellHWDetection - ok

17:04:08.0156 2720        Simbad - ok

17:04:09.0031 2720        smwdm           (4aa922332433cdeb8b82c072c212e32e) C:\WINDOWS\system32\drivers\smwdm.sys

17:04:10.0078 2720        smwdm - ok

17:04:10.0093 2720        Sparrow - ok

17:04:10.0328 2720        spkrmon         (4a205d78d17e6234986ddcd0da2761e9) C:\Programme\Analog Devices\SoundMAX\spkrmon.exe

17:04:10.0468 2720        spkrmon ( UnsignedFile.Multi.Generic ) - warning

17:04:10.0468 2720        spkrmon - detected UnsignedFile.Multi.Generic (1)

17:04:10.0546 2720        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

17:04:10.0703 2720        splitter - ok

17:04:10.0734 2720        Spooler         (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe

17:04:10.0781 2720        Spooler - ok

17:04:10.0812 2720        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys

17:04:11.0171 2720        sr - ok

17:04:11.0359 2720        srservice       (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll

17:04:12.0578 2720        srservice - ok

17:04:12.0687 2720        Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

17:04:13.0718 2720        Srv - ok

17:04:14.0656 2720        SSDPSRV         (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll

17:04:15.0484 2720        SSDPSRV - ok

17:04:15.0781 2720        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll

17:04:16.0171 2720        stisvc - ok

17:04:18.0078 2720        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

17:04:18.0312 2720        swenum - ok

17:04:18.0375 2720        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

17:04:18.0718 2720        swmidi - ok

17:04:18.0718 2720        SwPrv - ok

17:04:18.0734 2720        symc810 - ok

17:04:18.0750 2720        symc8xx - ok

17:04:18.0750 2720        sym_hi - ok

17:04:18.0796 2720        sym_u3 - ok

17:04:18.0828 2720        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

17:04:19.0171 2720        sysaudio - ok

17:04:19.0265 2720        SysmonLog       (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe

17:04:19.0765 2720        SysmonLog - ok

17:04:19.0937 2720        TapiSrv         (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll

17:04:20.0234 2720        TapiSrv - ok

17:04:20.0578 2720        Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

17:04:20.0656 2720        Tcpip - ok

17:04:20.0843 2720        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

17:04:21.0000 2720        TDPIPE - ok

17:04:21.0031 2720        TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

17:04:21.0234 2720        TDTCP - ok

17:04:21.0281 2720        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

17:04:21.0500 2720        TermDD - ok

17:04:22.0468 2720        TermService     (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll

17:04:22.0734 2720        TermService - ok

17:04:24.0218 2720        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll

17:04:24.0312 2720        Themes - ok

17:04:24.0437 2720        TlntSvr         (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\system32\tlntsvr.exe

17:04:24.0656 2720        TlntSvr - ok

17:04:24.0671 2720        TosIde - ok

17:04:24.0875 2720        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll

17:04:25.0187 2720        TrkWks - ok

17:04:25.0265 2720        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

17:04:25.0453 2720        Udfs - ok

17:04:25.0468 2720        ultra - ok

17:04:26.0109 2720        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

17:04:26.0500 2720        Update - ok

17:04:26.0718 2720        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll

17:04:26.0953 2720        upnphost - ok

17:04:26.0984 2720        UPS             (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe

17:04:27.0265 2720        UPS - ok

17:04:27.0296 2720        usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

17:04:27.0656 2720        usbehci - ok

17:04:27.0687 2720        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

17:04:27.0843 2720        usbhub - ok

17:04:27.0875 2720        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

17:04:28.0078 2720        usbprint - ok

17:04:28.0109 2720        USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

17:04:28.0265 2720        USBSTOR - ok

17:04:28.0281 2720        usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

17:04:28.0562 2720        usbuhci - ok

17:04:28.0578 2720        VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

17:04:28.0796 2720        VgaSave - ok

17:04:28.0812 2720        ViaIde - ok

17:04:28.0859 2720        VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys

17:04:29.0312 2720        VolSnap - ok

17:04:29.0546 2720        VSS             (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe

17:04:29.0750 2720        VSS - ok

17:04:29.0875 2720        W32Time         (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll

17:04:30.0125 2720        W32Time - ok

17:04:30.0296 2720        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

17:04:30.0437 2720        Wanarp - ok

17:04:30.0437 2720        WDICA - ok

17:04:30.0468 2720        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

17:04:30.0625 2720        wdmaud - ok

17:04:30.0671 2720        WebClient       (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll

17:04:31.0000 2720        WebClient - ok

17:04:31.0250 2720        winmgmt         (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll

17:04:31.0500 2720        winmgmt - ok

17:04:31.0546 2720        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll

17:04:31.0593 2720        WmdmPmSN - ok

17:04:33.0156 2720        Wmi             (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll

17:04:33.0281 2720        Wmi - ok

17:04:33.0375 2720        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe

17:04:33.0546 2720        WmiApSrv - ok

17:04:34.0312 2720        WMPNetworkSvc   (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe

17:04:34.0750 2720        WMPNetworkSvc - ok

17:04:34.0828 2720        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\Drivers\wpdusb.sys

17:04:35.0031 2720        WpdUsb - ok

17:04:35.0078 2720        WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

17:04:35.0421 2720        WS2IFSL - ok

17:04:35.0453 2720        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll

17:04:35.0937 2720        wscsvc - ok

17:04:35.0968 2720        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll

17:04:37.0000 2720        wuauserv - ok

17:04:37.0046 2720        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

17:04:37.0109 2720        WudfPf - ok

17:04:37.0140 2720        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

17:04:37.0203 2720        WudfRd - ok

17:04:37.0234 2720        WudfSvc         (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll

17:04:37.0281 2720        WudfSvc - ok

17:04:37.0343 2720        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll

17:04:37.0609 2720        WZCSVC - ok

17:04:37.0640 2720        xmlprov         (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll

17:04:37.0796 2720        xmlprov - ok

17:04:37.0828 2720        MBR (0x1B8)     (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0

17:04:37.0859 2720        \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - infected

17:04:37.0859 2720        \Device\Harddisk0\DR0 - detected Rootkit.Boot.Sinowal.b (0)

17:04:37.0890 2720        MBR (0x1B8)     (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR2

17:04:38.0015 2720        \Device\Harddisk1\DR2 - ok

17:04:38.0031 2720        Boot (0x1200)   (beaff209fcf932c1d7ff731f54d95dc9) \Device\Harddisk0\DR0\Partition0

17:04:38.0031 2720        \Device\Harddisk0\DR0\Partition0 - ok

17:04:38.0031 2720        Boot (0x1200)   (03db26b74f1015c63ae2e7b6cbcb7005) \Device\Harddisk1\DR2\Partition0

17:04:38.0031 2720        \Device\Harddisk1\DR2\Partition0 - ok

17:04:38.0046 2720        ============================================================

17:04:38.0046 2720        Scan finished

17:04:38.0046 2720        ============================================================

17:04:38.0062 3020        Detected object count: 9

17:04:38.0062 3020        Actual detected object count: 9

17:46:13.0093 3020        C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe - copied to quarantine

17:46:13.0109 3020        HKLM\SYSTEM\ControlSet001\services\aspnet_state - will be deleted on reboot

17:46:13.0109 3020        HKLM\SYSTEM\ControlSet003\services\aspnet_state - will be deleted on reboot

17:46:13.0125 3020        C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe - will be deleted on reboot

17:46:13.0125 3020        aspnet_state ( UnsignedFile.Multi.Generic ) - User select action: Delete 

17:46:13.0421 3020        C:\Programme\avmwlanstick\WlanNetService.exe - copied to quarantine

17:46:13.0765 3020        HKLM\SYSTEM\ControlSet001\services\AVM WLAN Connection Service - will be deleted on reboot

17:46:13.0765 3020        HKLM\SYSTEM\ControlSet003\services\AVM WLAN Connection Service - will be deleted on reboot

17:46:13.0781 3020        C:\Programme\avmwlanstick\WlanNetService.exe - will be deleted on reboot

17:46:13.0781 3020        AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - User select action: Delete 

17:46:13.0921 3020        C:\WINDOWS\system32\drivers\avmeject.sys - copied to quarantine

17:46:14.0171 3020        HKLM\SYSTEM\ControlSet001\services\avmeject - will be deleted on reboot

17:46:14.0171 3020        HKLM\SYSTEM\ControlSet003\services\avmeject - will be deleted on reboot

17:46:14.0171 3020        C:\WINDOWS\system32\drivers\avmeject.sys - will be deleted on reboot

17:46:14.0171 3020        avmeject ( UnsignedFile.Multi.Generic ) - User select action: Delete 

17:46:14.0343 3020        C:\WINDOWS\system32\DRIVERS\rt2500usb.sys - copied to quarantine

17:46:14.0546 3020        HKLM\SYSTEM\ControlSet001\services\bkn50USB - will be deleted on reboot

17:46:14.0546 3020        HKLM\SYSTEM\ControlSet003\services\bkn50USB - will be deleted on reboot

17:46:14.0546 3020        C:\WINDOWS\system32\DRIVERS\rt2500usb.sys - will be deleted on reboot

17:46:14.0546 3020        bkn50USB ( UnsignedFile.Multi.Generic ) - User select action: Delete 

17:46:14.0718 3020        C:\WINDOWS\system32\DRIVERS\ialmnt5.sys - copied to quarantine

17:46:14.0781 3020        HKLM\SYSTEM\ControlSet001\services\ialm - will be deleted on reboot

17:46:14.0796 3020        HKLM\SYSTEM\ControlSet003\services\ialm - will be deleted on reboot

17:46:14.0796 3020        C:\WINDOWS\system32\DRIVERS\ialmnt5.sys - will be deleted on reboot

17:46:14.0796 3020        ialm ( UnsignedFile.Multi.Generic ) - User select action: Delete 

17:46:15.0000 3020        C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe - copied to quarantine

17:46:15.0250 3020        HKLM\SYSTEM\ControlSet001\services\IDriverT - will be deleted on reboot

17:46:15.0265 3020        HKLM\SYSTEM\ControlSet003\services\IDriverT - will be deleted on reboot

17:46:15.0265 3020        C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe - will be deleted on reboot

17:46:15.0265 3020        IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Delete 

17:46:15.0468 3020        C:\WINDOWS\system32\DRIVERS\WUSB20XP.sys - copied to quarantine

17:46:15.0718 3020        HKLM\SYSTEM\ControlSet001\services\PRISM_A02 - will be deleted on reboot

17:46:15.0718 3020        HKLM\SYSTEM\ControlSet003\services\PRISM_A02 - will be deleted on reboot

17:46:15.0718 3020        C:\WINDOWS\system32\DRIVERS\WUSB20XP.sys - will be deleted on reboot

17:46:15.0718 3020        PRISM_A02 ( UnsignedFile.Multi.Generic ) - User select action: Delete 

17:46:15.0906 3020        C:\Programme\Analog Devices\SoundMAX\spkrmon.exe - copied to quarantine

17:46:16.0187 3020        HKLM\SYSTEM\ControlSet001\services\spkrmon - will be deleted on reboot

17:46:16.0187 3020        HKLM\SYSTEM\ControlSet003\services\spkrmon - will be deleted on reboot

17:46:16.0187 3020        C:\Programme\Analog Devices\SoundMAX\spkrmon.exe - will be deleted on reboot

17:46:16.0187 3020        spkrmon ( UnsignedFile.Multi.Generic ) - User select action: Delete 

17:46:16.0640 3020        \Device\Harddisk0\DR0\# - copied to quarantine

17:46:16.0656 3020        \Device\Harddisk0\DR0 - copied to quarantine

17:46:16.0671 3020        \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - will be cured on reboot

17:46:16.0687 3020        \Device\Harddisk0\DR0 - ok

17:46:16.0687 3020        \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - User select action: Cure 

17:46:27.0671 0824        Deinitialize success

Na toll, ich hab gesagt du sollst den SInowal-Eintrag löschen und du löscht alle Einträge :stirn: