Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Rootkit.0Access und vier weitere Trojaner in C:\WINDOWS\Installer\... (https://www.trojaner-board.de/117780-rootkit-0access-vier-trojaner-c-windows-installer.html)

Brasso 22.06.2012 17:42
Rootkit.0Access und vier weitere Trojaner in C:\WINDOWS\Installer\...
 
Hallo liebes Trojaner-Board-Team,

nun gehöre ich auch zum erlauchten Kreis derjenigen, die sich ein paar ordentliche Plagegeister eingefangen haben. :pfeiff:

Seit gestern habe ich den bereits o.g. Rootkit0.Access, Trojan.Small, Trojan.Zaccess, Trojan.Sirefef und zweimal Trojan.Dropper.PE4 auf dem Rechner.

Von den anderen Betroffenen hier habe ich die Erkenntnis, dass damit nicht zu Spaßen ist. Also Online-Banking ist schon deaktiviert und die Kreditkarte ebenfalls.

Malwarebytes habe ich laufen lassen und nun sind sie in Quarantäne.
Die LOG-Datei von dem Lauf sieht folgendermaßen aus:
Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.22.03

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Uni :: MRNEWMAN [Administrator]

22.06.2012 15:45:02
mbam-log-2012-06-22 (15-45-02).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 312738
Laufzeit: 1 Stunde(n), 21 Minute(n), 35 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKCR\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32| (Trojan.Zaccess) -> Bösartig: (\\.\globalroot\systemroot\Installer\{a6a94f0b-6845-dd3e-987e-2338c43273da}\n.) Gut: (wbemess.dll) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Dokumente und Einstellungen\Uni\Lokale Einstellungen\Anwendungsdaten\{a6a94f0b-6845-dd3e-987e-2338c43273da}\n (Trojan.Dropper.PE4) -> Löschen bei Neustart.
C:\WINDOWS\Installer\{a6a94f0b-6845-dd3e-987e-2338c43273da}\n (Trojan.Dropper.PE4) -> Löschen bei Neustart.
C:\WINDOWS\Installer\{a6a94f0b-6845-dd3e-987e-2338c43273da}\U\00000001.@ (Trojan.Small) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\WINDOWS\Installer\{a6a94f0b-6845-dd3e-987e-2338c43273da}\U\80000000.@ (Trojan.Sirefef) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\WINDOWS\Installer\{a6a94f0b-6845-dd3e-987e-2338c43273da}\U\800000cb.@ (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Der Rechner muss tatsächlich komplett formatiert werden um für die Zukunft auf Nummer sicher zu gehen?!

Ich bin für jede Hilfe absolut dankbar!!!!

LG Alex

Larusso 23.06.2012 06:05
:hallo:

Hoffe ich versteh dich jetzt richtig. Für mich ist das grammatikalisch unklar.
Zitat:
Der Rechner muss tatsächlich komplett formatiert werden um für die Zukunft auf Nummer sicher zu gehen?!
Bei dieser Infektion, Ja

Brasso 23.06.2012 09:34
Hallo Daniel,

danke für den Willkommensgruß und die schnelle Antwort! Ja, Du hast mich
richtig verstanden. Das war eine leicht entsetzte Frage von mir.

Ojeoje, also wirklich komplett löschen. Hmm, ich habe nur einen kleinen Laptop ohne CD-Laufwerk. Eine originale CD mit Windows XP habe ich allerdings noch von meinem alten, ausgemusterten Rechner.
Besteht die Möglichkeit, irgendwie ein externes CD-Laufwerk anzuschließen und mit der Windows XP-CD den Laptop dann zu starten?
Das Problem wäre halt nur, dass ich die besagte Windows-Version schon damals für den alten Rechner aktiviert habe. Oder würde das trotzdem gehen?

Noch eine Frage aus eurer Erfahrung. Muss ich im jetzigen Status (die Trojaner sind in Quarantäne) Angst haben, dass beim "normalen" Surfen Daten von meinem Rechner übertragen werden?
Oder wenn ich eine Word-Datei in einer Dropbox speichere, könnten dann die Trojaner mit übertragen werden und andere Rechner infizieren?

Viele Grüße und ein schönes Wochenende
Alex

Larusso 25.06.2012 10:16
Sorry, Wochenende war etwas stressig.

Wie gesagt, wir könnes das auch bereinigen nur ist es bei einem XP System bisschen schwieriger.


Ich tippe mal, der Laptop ist ein Netbook oder ? Das sollte für gewöhnlich einer Recovery Partition besitzen, die man beim Starten starten kann.


Betriebsanleitung oder mir sagen, um welches Teil es sich hier genau handelt.

Brasso 25.06.2012 14:13
Hallo Daniel,
vielen Dank für Deine Antwort. Und, bloß keinen Stress! Wochenende ist heilig :-)
Habe vorübergehend einen alten Rechner von mir aktiviert.

Der kleine Läppi ist ein Samsung NP-NC10
CPU 270
mit 1.6 GHZ und 1.99 GB RAM
läuft auf Windows XP Home Edition Version 2002, Service Pack 3
Betriebsanleitung hab ich leider keine, weil ich das Gerät einem ehemaligen Kommilitonen abgekauft habe.
Reicht diese Information aus?

Mensch, das wäre ja toll wenn sich das Problem auch so bereinigen ließe, ohne Formatierung!

LG Alex

Larusso 25.06.2012 15:39
[code]
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Combofix wird überprüfen, ob die Microsoft Windows Wiederherstellungskonsole installiert ist.
    Ist diese nicht installiert, erlaube Combofix diese herunter zu laden und zu installieren. Folge dazu einfach den Anweisungen und aktzeptiere die End Nutzer Lizenz.
    Bei heutiger Malware ist dies sehr empfehlenswert, da diese uns eine Möglichkeit bietet, dein System zu reparieren, falls was schief geht.
    Bestätige die Information, dass die Wiederherstellungskonsole installiert wurde mit Ja.
Hinweis: Ist diese bereits installiert, wird Combofix mit der Malwareentfernung fortfahren.


Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Brasso 26.06.2012 18:43
Hallo Daniel,

danke, werde so vorgehen. Melde mich morgen mit der LOG-File.

LG Alex

Ich nochmal!

Das hat ja doch alles schneller geklappt als ich dachte.

Hier ist die ausgegebene LOG-File:

Code:
ComboFix 12-06-26.02 - Uni 26.06.2012  20:34:06.1.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.2038.1606 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Uni\Desktop\ComboFix.exe
FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\All Users\Anwendungsdaten\xml498.tmp
c:\dokumente und einstellungen\All Users\Anwendungsdaten\xml49B.tmp
c:\dokumente und einstellungen\All Users\Anwendungsdaten\xml49C.tmp
c:\programme\pdfforge Toolbar\IE\1.1.2\pdFForgetoolbarie.dll
c:\programme\pdfforge Toolbar\SeARchsettings.dll
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-26 bis 2012-06-26  ))))))))))))))))))))))))))))))
.
.
2012-06-23 18:08 . 2003-06-25 14:05        266360        ----a-w-        c:\windows\system32\TweakUI.exe
2012-06-22 07:49 . 2012-06-22 07:49        --------        d-----w-        c:\dokumente und einstellungen\Uni\Anwendungsdaten\Malwarebytes
2012-06-22 07:49 . 2012-06-22 07:49        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-06-22 07:49 . 2012-06-22 07:49        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-06-22 07:49 . 2012-04-04 13:56        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-06-21 14:51 . 2012-06-21 15:09        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\F4D55F0200002A30000BB869D151FC84
2012-06-19 10:30 . 2012-06-19 10:30        426184        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-06-13 16:46 . 2012-05-11 14:40        521728        -c----w-        c:\windows\system32\dllcache\jsdbgui.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-19 10:30 . 2011-10-12 18:09        70344        -c--a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-02 13:19 . 2009-04-26 09:00        18456        ----a-w-        c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2009-04-26 09:00        15896        ----a-w-        c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2008-11-03 13:39        329240        ----a-w-        c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2008-11-03 13:39        210968        ----a-w-        c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2008-11-03 13:39        219160        ----a-w-        c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2009-04-26 09:00        45080        ----a-w-        c:\windows\system32\wups2.dll
2012-06-02 13:19 . 2009-04-26 09:00        15896        ----a-w-        c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2008-11-03 21:20        97304        ----a-w-        c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2008-11-03 13:39        53784        ----a-w-        c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2008-11-03 13:39        35864        ----a-w-        c:\windows\system32\wups.dll
2012-06-02 13:19 . 2009-04-26 09:00        23576        ----a-w-        c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2008-11-03 13:39        577048        ----a-w-        c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2008-11-03 13:39        1933848        ----a-w-        c:\windows\system32\wuaueng.dll
2012-06-02 13:18 . 2009-04-28 07:42        275696        ----a-w-        c:\windows\system32\mucltui.dll
2012-06-02 13:18 . 2009-04-28 07:42        214256        ----a-w-        c:\windows\system32\muweb.dll
2012-06-02 13:18 . 2009-04-28 07:42        18160        ----a-w-        c:\windows\system32\mucltui.dll.mui
2012-05-31 13:22 . 2008-11-03 21:20        604160        ----a-w-        c:\windows\system32\crypt32.dll
2012-05-16 15:07 . 2008-11-03 21:21        916992        ----a-w-        c:\windows\system32\wininet.dll
2012-05-15 13:56 . 2008-11-03 21:21        1863296        ----a-w-        c:\windows\system32\win32k.sys
2012-05-11 14:40 . 2008-11-03 21:20        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2012-05-11 14:40 . 2008-11-03 21:20        1469440        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2008-11-03 21:20        385024        ----a-w-        c:\windows\system32\html.iec
2012-05-05 03:14 . 2008-11-03 21:20        2150912        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-05-05 03:14 . 2008-04-14 07:30        2029056        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2008-11-03 13:37        139656        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Uni\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Uni\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Uni\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Uni\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1044480]
"RTHDCPL"="RTHDCPL.EXE" [2008-08-26 16851456]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-02-18 137752]
"MagicKeyboard"="c:\programme\SAMSUNG\MagicKBD\PreMKBD.exe" [2006-05-14 151552]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-02-18 166424]
"DMHotKey"="c:\programme\Samsung\Easy Display Manager\DMLoader.exe" [2006-12-27 466944]
"BIH"="bih.dll" [2009-04-27 208896]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-11-29 421888]
"SSBkgdUpdate"="c:\programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 155648]
"OpwareSE4"="c:\programme\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 69632]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"GrooveMonitor"="c:\programme\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
.
c:\dokumente und einstellungen\Uni\Startmenü\Programme\Autostart\
Dropbox.lnk - c:\dokumente und einstellungen\Uni\Anwendungsdaten\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
VPN Client.lnk - c:\windows\Installer\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\Icon3E5562ED7.ico [2010-8-30 6144]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programme\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^McAfee Security Scan Plus.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACU]
2009-05-11 22:00        479320        -c--a-w-        c:\programme\Atheros WLAN Client\ACU.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 13:10        843712        ----a-w-        c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EDS]
2007-12-20 19:40        659456        ----a-w-        c:\programme\Samsung\Samsung EDS\EDSAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2009-02-26 16:36        30040        ----a-w-        c:\programme\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 16:38        421888        ----a-w-        c:\programme\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings]
2010-01-07 23:36        974848        -c--a-w-        c:\programme\pdfforge Toolbar\SearchSettings.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-09-21 19:45        198160        -c--a-w-        c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-10-24 18:05        204288        -c----w-        c:\programme\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"VMCService"=2 (0x2)
"SandraAgentSrv"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"ipsecd"=2 (0x2)
"iPod Service"=3 (0x3)
"iked"=2 (0x2)
"HssTrayService"=3 (0x3)
"HssSrv"=2 (0x2)
"HotspotShieldService"=2 (0x2)
"gusvc"=3 (0x3)
"dtpd"=2 (0x2)
"CVPND"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Application Updater"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"ACS"=2 (0x2)
"McComponentHostService"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe"
"GrooveMonitor"="c:\programme\Microsoft Office\Office12\GrooveMonitor.exe"
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" -atboottime
"ControlCenter2.0"=c:\programme\Brother\ControlCenter2\brctrcen.exe /autorun
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe"
"SetDefPrt"=c:\programme\Brother\Brmfl04g\BrStDvPt.exe
"HP Software Update"=c:\programme\HP\HP Software Update\HPWuSchd2.exe
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot
"SUPBackGround"=c:\programme\Samsung\Samsung Update Plus\SUPBackGround.exe
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"IgfxTray"=c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [06.05.2009 15:19 721904]
R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [03.11.2008 15:45 4300]
R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [14.01.2008 20:01 30208]
R3 hspabus;SAMSUNG HSPA USB Composite Device driver (WDM);c:\windows\system32\drivers\hspabus.sys [30.10.2010 06:09 91776]
R3 hspamdfl;SAMSUNG HSPA Modem Filter;c:\windows\system32\drivers\hspamdfl.sys [30.10.2010 06:09 14976]
R3 hspamdm;SAMSUNG HSPA Modem Drivers;c:\windows\system32\drivers\hspamdm.sys [30.10.2010 06:09 119808]
R3 hspaserd;SAMSUNG HSPA Modem Diagnostic Serial Port (WDM);c:\windows\system32\drivers\hspaserd.sys [30.10.2010 06:09 98560]
R3 pflt;Shrew Soft Miniport Filter;c:\windows\system32\drivers\vfilter.sys [19.11.2009 02:06 23808]
R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [03.11.2008 15:49 238464]
S3 cmnsusbser;Mobile Connector USB Device for Legacy Serial Communication LCT2053s;c:\windows\system32\DRIVERS\cmnsusbser.sys --> c:\windows\system32\DRIVERS\cmnsusbser.sys [?]
S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\programme\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [20.01.2010 01:59 87336]
S3 massfilter;MBB Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [09.05.2009 11:10 9216]
S3 SUEPD;SUE NDIS Protocol Driver;c:\windows\system32\drivers\SUE_PD.sys [01.08.2006 15:57 19840]
S3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\drivers\virtualnet.sys [19.11.2009 02:06 6784]
S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\drivers\ZTEusbnet.sys [03.12.2010 06:47 114688]
S3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\drivers\zteusbvoice.sys [03.12.2010 06:47 105856]
S4 Application Updater;Application Updater;c:\programme\Application Updater\ApplicationUpdater.exe [08.01.2010 00:51 380928]
S4 dtpd;ShrewSoft DNS Proxy Daemon;c:\programme\ShrewSoft1\VPN Client\dtpd.exe -service --> c:\programme\ShrewSoft1\VPN Client\dtpd.exe -service [?]
S4 iked;ShrewSoft IKE Daemon;c:\programme\ShrewSoft1\VPN Client\iked.exe -service --> c:\programme\ShrewSoft1\VPN Client\iked.exe -service [?]
S4 ipsecd;ShrewSoft IPSEC Daemon;c:\programme\ShrewSoft1\VPN Client\ipsecd.exe -service --> c:\programme\ShrewSoft1\VPN Client\ipsecd.exe -service [?]
S4 McComponentHostService;McAfee Security Scan Component Host Service;c:\programme\McAfee Security Scan\2.0.181\McCHSvc.exe [15.01.2010 14:49 227232]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\programme\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [23.09.2005 08:01 2799808]
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-26 c:\windows\Tasks\User_Feed_Synchronization-{C434F7DC-7E32-43A4-A389-33736965C89C}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: Easy-WebPrint - Drucken - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Schnelldruck - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint - Vorschau - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Zu Druckliste hinzufügen - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{03ECD74F-CD29-4766-B8A5-08EE061E28A5}: NameServer = 141.45.2.100,141.45.3.100
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-Adobe Reader Speed Launcher - c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-AppleSyncNotifier - c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe
MSConfigStartUp-iTunesHelper - c:\programme\iTunes\iTunesHelper.exe
MSConfigStartUp-MobileConnect - c:\programme\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
MSConfigStartUp-TomTomHOME - c:\programme\TomTom HOME 2\TomTomHOMERunner.exe
AddRemove-Easy-WebPrint - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-06-26 20:41
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-26  20:44:03
ComboFix-quarantined-files.txt  2012-06-26 18:44
.
Vor Suchlauf: 12 Verzeichnis(se), 15.915.876.352 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 16.457.191.424 Bytes frei
.
WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 5A55AF0242CE413D88940184B7765542
Bin sehr gespannt wie es weiter geht.
Nur für mich zur Info, ist die Malware jetzt schon komplett gelöscht?

Einen schönen Feierabend
Alex

Larusso 26.06.2012 20:41
Hm :/


Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
%windir%\installer\*. /5
%localappdata%\*. /5
/md5start
services.exe
user32.dll
/md5stop
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Wenn der Scan beendet wurde, wird sich ein Textdokument öffnen.
  • Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Brasso 27.06.2012 19:09
Hallo Daniel,
alles so ausgeführt wie Du beschrieben hast.
Hier nun die OTL.txt:
Code:
OTL logfile created on: 27.06.2012 19:48:06 - Run 1
OTL by OldTimer - Version 3.2.53.0    Folder = C:\Dokumente und Einstellungen\Uni\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,55 Gb Available Physical Memory | 77,99% Memory free
3,33 Gb Paging File | 3,06 Gb Available in Paging File | 91,82% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 41,04 Gb Total Space | 15,35 Gb Free Space | 37,41% Space Free | Partition Type: NTFS
Drive D: | 102,00 Gb Total Space | 92,05 Gb Free Space | 90,25% Space Free | Partition Type: NTFS
 
Computer Name: MRNEWMAN | User Name: Uni | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.27 19:44:55 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Uni\Desktop\OTL.exe
PRC - [2008.10.06 19:07:26 | 000,679,936 | ---- | M] (SAMSUNG Electronics) -- C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2008.05.21 17:44:30 | 000,299,008 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\MagicKBD\PerformanceManager.exe
PRC - [2008.05.20 21:02:08 | 000,372,736 | ---- | M] (SAMSUNG Electronics Co., Ltd.) -- C:\Programme\Samsung\MagicKBD\MagicKBD.exe
PRC - [2008.05.03 13:31:46 | 000,071,096 | ---- | M] () -- C:\Programme\BurnAware Free\nmsaccessu.exe
PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.10.26 13:40:34 | 000,335,872 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe
PRC - [2006.03.21 13:19:40 | 000,069,632 | ---- | M] (ScanSoft, Inc.) -- C:\Programme\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2010.08.16 00:08:44 | 000,094,208 | ---- | M] () -- C:\Programme\FileZilla FTP Client\fzshellext.dll
MOD - [2008.05.03 13:31:46 | 000,071,096 | ---- | M] () -- C:\Programme\BurnAware Free\nmsaccessu.exe
MOD - [2006.08.12 13:48:40 | 000,049,152 | ---- | M] () -- C:\Programme\Samsung\Easy Display Manager\HookDllPS2.dll
MOD - [2005.07.12 17:34:22 | 000,045,056 | ---- | M] () -- C:\Programme\Samsung\MagicKBD\EasyBoxDll.dll
MOD - [2001.10.28 18:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2011.12.05 23:16:36 | 000,079,360 | ---- | M] (SolidWorks) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\SolidWorks Shared\Service\SolidWorksLicensing.exe -- (SolidWorks Licensing Service)
SRV - [2011.12.05 23:16:35 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.03.23 13:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Disabled | Stopped] -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2010.01.20 01:59:12 | 000,087,336 | ---- | M] (Dassault Systèmes SolidWorks Corp.) [On_Demand | Stopped] -- C:\Programme\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe -- (CoordinatorServiceHost)
SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [Disabled | Stopped] -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2010.01.08 00:51:02 | 000,380,928 | ---- | M] (Spigot, Inc.) [Disabled | Stopped] -- C:\Programme\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2009.11.15 20:31:08 | 000,049,152 | ---- | M] () [Disabled | Stopped] -- C:\Programme\ShrewSoft1\VPN Client\dtpd.exe -- (dtpd)
SRV - [2009.11.15 20:29:10 | 000,716,800 | ---- | M] () [Disabled | Stopped] -- C:\Programme\ShrewSoft1\VPN Client\iked.exe -- (iked)
SRV - [2009.11.15 20:26:42 | 000,536,576 | ---- | M] () [Disabled | Stopped] -- C:\Programme\ShrewSoft1\VPN Client\ipsecd.exe -- (ipsecd)
SRV - [2009.05.12 00:00:08 | 000,495,700 | ---- | M] (Atheros) [Disabled | Stopped] -- C:\WINDOWS\system32\ACS.exe -- (ACS)
SRV - [2008.05.03 13:31:46 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\BurnAware Free\nmsaccessu.exe -- (NMSAccessU)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006.10.26 13:40:34 | 000,335,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe -- (MDM)
SRV - [2006.03.03 21:03:10 | 000,069,632 | ---- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2005.09.23 08:01:16 | 002,799,808 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon80)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\usbaapl.sys -- (USBAAPL)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2009.SP3\WNt500x86\Sandra.sys -- (SANDRA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\PCASp50.sys -- (PCASp50)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\cmnsusbser.sys -- (cmnsusbser)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\Uni\LOKALE~1\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (avg7tglo)
DRV - [2010.11.02 15:44:07 | 000,119,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hspamdm.sys -- (hspamdm)
DRV - [2010.11.02 15:44:07 | 000,098,560 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hspaserd.sys -- (hspaserd) SAMSUNG HSPA Modem Diagnostic Serial Port (WDM)
DRV - [2010.11.02 15:44:07 | 000,091,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hspabus.sys -- (hspabus) SAMSUNG HSPA USB Composite Device driver (WDM)
DRV - [2010.11.02 15:44:07 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hspamdfl.sys -- (hspamdfl)
DRV - [2010.06.30 12:08:44 | 000,114,688 | R--- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbnet.sys -- (ZTEusbnet)
DRV - [2010.06.30 12:08:44 | 000,105,856 | R--- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\zteusbvoice.sys -- (ZTEusbvoice)
DRV - [2010.06.30 12:08:44 | 000,105,856 | R--- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2010.06.30 12:08:44 | 000,105,856 | R--- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2010.06.30 12:08:44 | 000,105,856 | R--- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2010.06.30 12:08:44 | 000,009,216 | R--- | M] (MBB Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\massfilter.sys -- (massfilter)
DRV - [2010.06.04 20:29:04 | 001,606,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2010.03.23 13:15:36 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2010.02.11 14:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2009.11.19 02:06:06 | 000,023,808 | ---- | M] (Shrew Soft Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vfilter.sys -- (pflt)
DRV - [2009.11.19 02:06:04 | 000,006,784 | ---- | M] (Shrew Soft Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\virtualnet.sys -- (vnet)
DRV - [2009.09.15 22:04:58 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\taphss.sys -- (taphss)
DRV - [2009.05.06 15:19:43 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2009.04.21 10:09:00 | 000,297,344 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2009.03.16 23:19:44 | 000,058,208 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wsimd.sys -- (WSIMD)
DRV - [2008.11.16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2008.09.23 22:23:58 | 000,238,464 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VMC326.sys -- (VMC326)
DRV - [2008.08.27 01:35:00 | 004,753,920 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.01.14 20:01:02 | 000,030,208 | ---- | M] (Samsung Electronics,.LTD) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SamsungEDS.SYS -- (DNSeFilter)
DRV - [2007.11.14 19:05:16 | 000,394,952 | ---- | M] (Zone Labs, LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2007.03.23 19:50:42 | 000,067,960 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2007.01.18 20:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2006.08.01 15:57:24 | 000,019,840 | ---- | M] (Samsung) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SUE_PD.sys -- (SUEPD)
DRV - [2005.10.27 06:18:05 | 000,004,300 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\MEMIO.SYS -- (DOSMEMIO)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{18A94681-EDFD-43D1-8609-65A41829A2AA}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=302398&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8064.0206: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.448: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
O1 HOSTS File: ([2012.06.26 20:41:19 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (EWPBrowseObject Class) - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll ()
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) -  - No CLSID value found.
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BIH] C:\WINDOWS\System32\bih.dll (Thomas Michel eMail: support.batteryinfo@arcor.de  Web: hxxp://www.batteryinfo.de.vu or hxxp://home.arcor.de/batteryinfo)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [DMHotKey] C:\Programme\Samsung\Easy Display Manager\DMLoader.exe (SAMSUNG Electronics)
O4 - HKLM..\Run: [MagicKeyboard] C:\Programme\Samsung\MagicKBD\PreMKbd.exe ()
O4 - HKLM..\Run: [OpwareSE4] C:\Programme\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Scansoft, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk = C:\WINDOWS\Installer\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\Icon3E5562ED7.ico ()
O4 - Startup: C:\Dokumente und Einstellungen\Uni\Startmenü\Programme\Autostart\Dropbox.lnk = C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1240736193156 (WUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (JavaBeansBridge Object)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} hxxp://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{03ECD74F-CD29-4766-B8A5-08EE061E28A5}: NameServer = 141.45.2.100,141.45.3.100
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Uni\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Uni\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.11.03 15:41:30 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {2545B756-042C-E3C7-2B1E-487307B443DD} - DirectAnimation
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {381F42B5-CA8B-D65A-6259-665971C18BAA} - Internet Explorer
ActiveX: {3938DCCD-06B7-801D-AB7C-AF7AA74CA69E} - Microsoft Windows Media Player 6.4
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5393C9C7-1C00-4914-2CB0-D081869F5A8B} - Internet Explorer
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9372DB4E-0FED-0925-B45F-52EED785B992} - DirectAnimation
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {D8D66F05-760D-0931-7455-C3FE6ACEE795} - Themes Setup
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: {F73A6218-546C-7BA4-833D-8BE45C47E70E} - Microsoft Windows Media Player 6.4
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: Microsoft Base Smart Card Crypto Provider Package -
 
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - Services: "VMCService"
MsConfig - Services: "SandraAgentSrv"
MsConfig - Services: "FLEXnet Licensing Service"
MsConfig - Services: "Microsoft Office Groove Audit Service"
MsConfig - Services: "JavaQuickStarterService"
MsConfig - Services: "ipsecd"
MsConfig - Services: "iPod Service"
MsConfig - Services: "iked"
MsConfig - Services: "HssTrayService"
MsConfig - Services: "HssSrv"
MsConfig - Services: "HotspotShieldService"
MsConfig - Services: "gusvc"
MsConfig - Services: "dtpd"
MsConfig - Services: "CVPND"
MsConfig - Services: "Bonjour Service"
MsConfig - Services: "Application Updater"
MsConfig - Services: "Apple Mobile Device"
MsConfig - Services: "ACS"
MsConfig - Services: "McComponentHostService"
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^McAfee Security Scan Plus.lnk - C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe - (McAfee, Inc.)
MsConfig - StartUpReg: ACU - hkey= - key= - C:\Programme\Atheros WLAN Client\ACU.exe (Atheros Communications, Inc.)
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: EDS - hkey= - key= - C:\Programme\Samsung\Samsung EDS\EDSAgent.exe (Samsung Electronics,.LTD)
MsConfig - StartUpReg: GrooveMonitor - hkey= - key= - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Programme\QuickTime\qttask.exe (Apple Inc.)
MsConfig - StartUpReg: SearchSettings - hkey= - key= - C:\Programme\pdfforge Toolbar\SearchSettings.exe (Spigot, Inc.)
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: WMPNSCFG - hkey= - key= - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.27 19:44:49 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Uni\Desktop\OTL.exe
[2012.06.26 20:44:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2012.06.26 20:28:39 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012.06.26 20:22:25 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012.06.26 20:22:25 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012.06.26 20:22:25 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012.06.26 20:22:25 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012.06.26 20:17:21 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.06.26 20:17:16 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Uni\Eigene Dateien\Eigene Videos
[2012.06.26 20:17:15 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Uni\Eigene Dateien\Eigene Musik
[2012.06.26 20:17:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2012.06.26 20:12:19 | 004,569,121 | R--- | C] (Swearware) -- C:\Dokumente und Einstellungen\Uni\Desktop\ComboFix.exe
[2012.06.23 20:08:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Powertoys for Windows XP
[2012.06.22 09:49:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\Malwarebytes
[2012.06.22 09:49:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.06.22 09:49:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.06.22 09:49:02 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.06.22 09:49:02 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.06.21 16:51:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\F4D55F0200002A30000BB869D151FC84
[2012.05.29 15:58:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Uni\Desktop\3hrcontrolsim8_5
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.27 19:55:00 | 000,000,416 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{C434F7DC-7E32-43A4-A389-33736965C89C}.job
[2012.06.27 19:44:55 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Uni\Desktop\OTL.exe
[2012.06.27 11:25:17 | 000,002,423 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk
[2012.06.27 11:24:46 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.27 11:24:43 | 2137,444,352 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.26 20:41:19 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012.06.26 20:28:44 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2012.06.26 20:12:19 | 004,569,121 | R--- | M] (Swearware) -- C:\Dokumente und Einstellungen\Uni\Desktop\ComboFix.exe
[2012.06.25 16:18:00 | 000,902,952 | ---- | M] () -- C:\Dokumente und Einstellungen\Uni\Desktop\ISO_14971.pdf
[2012.06.25 16:17:00 | 000,686,785 | ---- | M] () -- C:\Dokumente und Einstellungen\Uni\Desktop\DIN_6353.pdf
[2012.06.25 16:17:00 | 000,260,492 | ---- | M] () -- C:\Dokumente und Einstellungen\Uni\Desktop\DIN_6386_1.pdf
[2012.06.25 16:17:00 | 000,201,500 | ---- | M] () -- C:\Dokumente und Einstellungen\Uni\Desktop\DIN_6386_2.pdf
[2012.06.25 16:17:00 | 000,189,853 | ---- | M] () -- C:\Dokumente und Einstellungen\Uni\Desktop\DIN_55026.pdf
[2012.06.22 09:49:05 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.19 12:26:23 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.14 17:03:52 | 001,586,344 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.14 13:01:29 | 000,477,826 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.06.14 13:01:29 | 000,436,042 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.06.14 13:01:29 | 000,091,570 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.06.14 13:01:29 | 000,068,938 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.06.14 12:53:27 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.06.11 18:11:09 | 000,011,900 | ---- | M] () -- C:\Dokumente und Einstellungen\Uni\Eigene Dateien\Muster_Werkstudentenvertrag.pdf
[2012.06.11 18:07:25 | 000,013,860 | ---- | M] () -- C:\Dokumente und Einstellungen\Uni\Eigene Dateien\Vertraege.zip
[2012.05.29 11:44:30 | 008,591,406 | ---- | M] () -- C:\Dokumente und Einstellungen\Uni\Desktop\3hrcontrolsim8_5.zip
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.26 20:28:44 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2012.06.26 20:28:40 | 000,262,448 | RHS- | C] () -- C:\cmldr
[2012.06.26 20:22:25 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012.06.26 20:22:25 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012.06.26 20:22:25 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012.06.26 20:22:25 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012.06.26 20:22:25 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012.06.25 16:18:00 | 000,902,952 | ---- | C] () -- C:\Dokumente und Einstellungen\Uni\Desktop\ISO_14971.pdf
[2012.06.25 16:17:00 | 000,686,785 | ---- | C] () -- C:\Dokumente und Einstellungen\Uni\Desktop\DIN_6353.pdf
[2012.06.25 16:17:00 | 000,260,492 | ---- | C] () -- C:\Dokumente und Einstellungen\Uni\Desktop\DIN_6386_1.pdf
[2012.06.25 16:17:00 | 000,201,500 | ---- | C] () -- C:\Dokumente und Einstellungen\Uni\Desktop\DIN_6386_2.pdf
[2012.06.25 16:17:00 | 000,189,853 | ---- | C] () -- C:\Dokumente und Einstellungen\Uni\Desktop\DIN_55026.pdf
[2012.06.23 20:08:58 | 000,160,217 | ---- | C] () -- C:\WINDOWS\System32\PowerToysLicense.rtf
[2012.06.22 09:49:05 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.11 18:11:06 | 000,011,900 | ---- | C] () -- C:\Dokumente und Einstellungen\Uni\Eigene Dateien\Muster_Werkstudentenvertrag.pdf
[2012.06.11 18:07:22 | 000,013,860 | ---- | C] () -- C:\Dokumente und Einstellungen\Uni\Eigene Dateien\Vertraege.zip
[2012.05.29 15:57:53 | 008,591,406 | ---- | C] () -- C:\Dokumente und Einstellungen\Uni\Desktop\3hrcontrolsim8_5.zip
[2012.02.15 18:02:57 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.01.18 13:25:55 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2011.11.04 14:19:14 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.11.03 19:26:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\eDrawingOfficeAutomator.INI
[2011.10.14 08:17:50 | 000,029,191 | ---- | C] () -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\Kommagetrennte Werte (Windows).ADR
[2011.10.08 12:12:52 | 000,000,411 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2011.03.16 00:57:44 | 000,033,280 | ---- | C] () -- C:\Dokumente und Einstellungen\Uni\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.30 06:16:33 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\RemoveWLAN.exe
[2010.10.26 16:34:49 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2008.11.03 23:20:55 | 000,002,048 | -HS- | C] () -- C:\WINDOWS\Installer\{a6a94f0b-6845-dd3e-987e-2338c43273da}\@
[2008.11.03 23:20:55 | 000,002,048 | -HS- | C] () -- C:\Dokumente und Einstellungen\Uni\Lokale Einstellungen\Anwendungsdaten\{a6a94f0b-6845-dd3e-987e-2338c43273da}\@
 
========== LOP Check ==========
 
[2011.05.01 14:03:05 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2009.05.06 15:23:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2011.11.03 19:42:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DassaultSystemes
[2012.06.21 17:09:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\F4D55F0200002A30000BB869D151FC84
[2011.10.08 12:12:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft
[2010.09.20 08:06:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TomTom
[2011.10.01 10:28:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Vodafone
[2008.11.03 15:49:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WLAN
[2010.04.19 22:33:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009.10.10 11:04:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009.05.15 17:13:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011.10.08 13:42:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\Canon
[2011.11.03 19:42:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\DassaultSystemes
[2012.06.27 11:25:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\Dropbox
[2011.11.03 19:43:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\EDrawings
[2012.01.17 21:12:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\OpenCandy
[2011.03.20 16:47:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\Opera
[2012.01.18 13:26:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\pdfforge
[2012.01.09 15:09:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\Philipp Winterberg
[2011.10.08 12:12:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\ScanSoft
[2011.03.15 17:05:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\Search Settings
[2009.05.14 08:20:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\Vodafone
[2009.05.05 07:59:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Uni\Anwendungsdaten\Windows Search
[2012.06.27 19:55:00 | 000,000,416 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{C434F7DC-7E32-43A4-A389-33736965C89C}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2009.05.12 16:26:21 | 000,000,000 | ---D | M] -- C:\AllDupBackup
[2012.06.26 20:28:44 | 000,000,000 | RHSD | M] -- C:\cmdcons
[2012.06.16 22:54:09 | 000,000,000 | ---D | M] -- C:\Config.Msi
[2011.11.16 13:25:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2010.10.05 15:23:00 | 000,000,000 | ---D | M] -- C:\Downloads
[2008.11.03 15:46:14 | 000,000,000 | ---D | M] -- C:\Intel
[2009.04.26 03:52:04 | 000,000,000 | R--D | M] -- C:\MSOCache
[2012.06.26 20:23:50 | 000,000,000 | R--D | M] -- C:\Programme
[2012.06.26 20:44:05 | 000,000,000 | ---D | M] -- C:\Qoobox
[2011.11.16 15:02:03 | 000,000,000 | ---D | M] -- C:\SolidWorks
[2011.11.16 15:21:43 | 000,000,000 | ---D | M] -- C:\SolidWorks Data
[2011.12.05 23:18:32 | 000,000,000 | ---D | M] -- C:\SolidWorks Data (2)
[2012.06.26 20:24:02 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010.10.30 06:16:42 | 000,000,000 | ---D | M] -- C:\Temp
[2012.06.26 20:44:05 | 000,000,000 | ---D | M] -- C:\WINDOWS
[2011.11.14 22:20:01 | 000,000,000 | ---D | M] -- C:\WinRAR
 
< %PROGRAMFILES%\*.exe >
Invalid Environment Variable: LOCALAPPDATA
 
< %systemroot%\*. /mp /s >
 
< %windir%\installer\*. /5 >
Invalid Environment Variable: localappdata
 
< MD5 for: SERVICES.EXE  >
[2008.04.14 14:00:00 | 000,109,056 | ---- | M] (Microsoft Corporation) MD5=4BB6A83640F1D1792AD21CE767B621C6 -- C:\WINDOWS\$NtUninstallKB956572$\services.exe
[2009.02.09 13:21:35 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=A3EDBE9053889FB24AB22492472B39DC -- C:\WINDOWS\erdnt\cache\services.exe
[2009.02.09 13:21:35 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=A3EDBE9053889FB24AB22492472B39DC -- C:\WINDOWS\system32\dllcache\services.exe
[2009.02.09 13:21:35 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=A3EDBE9053889FB24AB22492472B39DC -- C:\WINDOWS\system32\services.exe
[2009.02.09 13:14:22 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=F0A7D59AF279326528715B206669B86C -- C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe
 
< MD5 for: USER32.DLL  >
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\erdnt\cache\user32.dll
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

< End of report >
Und hier die Extras.txt:
Code:
OTL Extras logfile created on: 27.06.2012 19:48:06 - Run 1
OTL by OldTimer - Version 3.2.53.0    Folder = C:\Dokumente und Einstellungen\Uni\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,55 Gb Available Physical Memory | 77,99% Memory free
3,33 Gb Paging File | 3,06 Gb Available in Paging File | 91,82% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 41,04 Gb Total Space | 15,35 Gb Free Space | 37,41% Space Free | Partition Type: NTFS
Drive D: | 102,00 Gb Total Space | 92,05 Gb Free Space | 90,25% Space Free | Partition Type: NTFS
 
Computer Name: MRNEWMAN | User Name: Uni | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{03CAB33F-D1C2-48C6-8766-DAE84DFC25FE}" = Microsoft Sync Framework Services v1.0 (x86)
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{077E2E73-01E0-4F37-81AD-C93C6C2F0933}" = Connection Manager
"{119B7481-0216-40D2-A5CC-C3E1F461ECC1}" = Windows Live Fotogalerie
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16
"{29D851C2-048C-4B5E-8D1F-25D473342BB5}" = ScanSoft OmniPage SE 4.0
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{363790D2-DA98-41DD-9C9F-69FA36B169DE}" = PanoStandAlone
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm
"{4EA684E9-5C81-4033-A696-3019EC57AC3A}" = HPProductAssistant
"{51F96AEC-D902-4434-A0DC-B9692A21AE7C}" = MobileMe Control Panel
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5791B7D3-8B34-4218-9750-6A8E45D0AD32}" = pdfforge Toolbar v1.1.2
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{68763C27-235D-4165-A961-FDEA228CE504}" = AiOSoftwareNPI
"{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox
"{6994491D-D491-48F1-AE1F-E179C1FFFC2F}" = HP Photosmart Essential
"{69B49029-5975-449A-B662-E9CD13A8D1BB}" = Connection Manager
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Samsung Battery Manager
"{70B7A167-0B88-445D-A3EA-97C73AA88CAC}" = Windows Live Toolbar
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{71A51B59-E7D3-11DB-A386-005056C00008}" = Namuga 1.3M Webcam
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{736C803C-DD3B-4015-BC51-AFB9E67B9076}" = Readme
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"{7E7B7865-6C80-4373-8BC1-C2EB9431F9DE}" = ProductContextNPI
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{8331C3EA-0C91-43AA-A4D4-27221C631139}" = Status
"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{8624888C-A959-45A5-98F4-292E956325EA}" = LECTURNITY Player
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A4CE7FD-9657-4B06-9943-E1819F3D5D67}" = DocProc
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload
"{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}_PRJPRO_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_PRJPRO_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_PRJPRO_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}_PRJPRO_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-003B-0000-0000-0000000FF1CE}" = Microsoft Office Project Professional 2007
"{90120000-003B-0000-0000-0000000FF1CE}_PRJPRO_{8446EB22-A746-46DC-B1BD-E0DFA1F3CDDA}" = Microsoft Office Project 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}_PRJPRO_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A4-0409-0000-0000000FF1CE}" = Microsoft Office 2003 Web Components
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90120000-00B4-0407-0000-0000000FF1CE}" = Microsoft Office Project MUI (German) 2007
"{90120000-00B4-0407-0000-0000000FF1CE}_PRJPRO_{C8D442F2-CF33-486E-8079-A704A2E80A39}" = Microsoft Office Project 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91E04CA7-0B13-4F8C-AA4D-2A573AC96D19}" = Windows Live Essentials
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{996512CF-F35B-48DE-9291-557FA5316967}" = ScannerCopy
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9CAC71E9-D196-472E-845C-5462356B2AE1}" = Easy Resolution Manager
"{9FC8D8F8-AF3A-4488-98AF-51C6DEC732F2}" = c3100_Help
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager
"{A786161E-959C-4B4B-AA6D-7424C13CCCF2}" = SolidWorks eDrawings 2010
"{A8BD5A60-E843-46DC-8271-ABF20756BE0F}" = Microsoft Sync Framework Runtime v1.0 (x86)
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{ABB14904-A11B-4F42-996C-80FD608A0F17}" = Samsung EDS
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AF2066F6-7C57-46A1-A306-077EBBFC7B2B}" = SolidWorks 2010 SP02.1
"{AFDFC350-C142-4790-BE12-8357AECD028F}" = SyncToy 2.0 (x86)
"{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}" = Cisco Systems VPN Client 5.0.07.0290
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Software Update
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BD723E53-A42C-4702-AA04-1D74A0311590}" = Magic Keyboard
"{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}" = HP Photosmart, Officejet and Deskjet 7.0.A
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C7F54CF8-D6FB-4E0A-93A3-E68AE0D6C476}" = SolutionCenter
"{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA
"{CB87D276-2F4A-453A-A2D8-D597927C59A0}" = Tabellenbuch Metall digital 6.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D2FEBD11-E587-4C41-AD33-0CD90D26A964}" = Client für die Windows-Rechteverwaltung mit Service Pack 2
"{D481EA96-2313-4A7C-98EE-710D1AF884AC}" = Microsoft Visual Studio 2005 Tools for Applications - ENU
"{DBC20735-34E6-4E97-A9E5-2066B66B243D}" = TrayApp
"{EB8C9964-09AC-48bf-8B98-027609C78251}" = C3100
"{EC905264-BCFE-423B-9C42-C3A106266790}" = Rückwärtskompatibilität des Clients für die Windows-Rechteverwaltung SP2
"{ED636101-1959-4360-8BF7-209436E7DEE4}" = Windows Live Sync
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F157460F-720E-482f-8625-AD7843891E5F}" = InstantShareDevicesMFC
"{F3760724-B29D-465B-BC53-E5D72095BCC4}" = Scan
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F4F41D14-E0DD-4FB4-AA09-A14225C769BD}" = Atheros WLAN Client
"{F6076EF9-08E1-442F-B6A2-BFB61B295A14}" = Fax_CDA
"{FB15E224-67C3-491F-9F5C-F257BC418412}" = Destinations
"{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}" = NewCopy_CDA
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Anti-Twin 2010-11-02 18.15.33" = Anti-Twin (Installation 02.11.2010)
"BatteryInfo" = Notebook BatteryInfo
"BurnAware Free_is1" = BurnAware Free 2.3.4
"CCleaner" = CCleaner
"CPU-Control_is1" = CPU-Control
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Eusing Free Registry Cleaner" = Eusing Free Registry Cleaner
"FileZilla Client" = FileZilla Client 3.3.4.1
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free RAR Extract Frog" = Free RAR Extract Frog
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HP Imaging Device Functions" = HP Imaging Device Functions 7.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 7.0
"HPOCR" = OCR Software by I.R.I.S 7.0
"ie8" = Windows Internet Explorer 8
"InstallShield_{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"IrfanView" = IrfanView (remove only)
"LingoPad_is1" = LingoPad 2.6 (Build 360)
"Longman iBT" = Longman iBT
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Maniac Mansion Deluxe" = Maniac Mansion Deluxe
"Marvell Miniport Driver" = Marvell Miniport Driver
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Visual Studio 2005 Tools for Applications - ENU" = Microsoft Visual Studio 2005 Tools for Applications - ENU
"MP Navigator 3.0" = Canon MP Navigator 3.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"pdfsam" = pdfsam
"PRJPRO" = Microsoft Office Project Professional 2007
"RealPlayer 12.0" = RealPlayer
"SAMSUNG HSPA Modem" = SAMSUNG HSPA Modem Software
"SHOUTcastDSP" = SHOUTcast Source DSP 1.9.1 (remove only)
"Shrew Soft VPN Client" = Shrew Soft VPN Client
"SMPlayer" = SMPlayer 0.6.7
"SolidWorks Installation Manager 20100-40201-1100-200" = SolidWorks 2010 SP02.1
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Tweak UI 2.10" = Tweak UI
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.11
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XP Codec Pack" = XP Codec Pack
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 10.05.2012 10:54:26 | Computer Name = MRNEWMAN | Source = Windows Search Service | ID = 3024
Description = Die Aktualisierung kann nicht gestartet werden, da kein Zugriff auf
 die Inhaltsquellen bestand. Beheben Sie die Fehler, und starten Sie die Aktualisierung
 erneut.  Kontext:  Anwendung, SystemIndex Katalog
 
Error - 22.05.2012 04:30:05 | Computer Name = MRNEWMAN | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 22.05.2012 04:31:26 | Computer Name = MRNEWMAN | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 22.05.2012 04:31:29 | Computer Name = MRNEWMAN | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 16.06.2012 16:54:14 | Computer Name = MRNEWMAN | Source = Windows Search Service | ID = 3006
Description = Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert
 werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt
 nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der
 Leistungsindikatoren. Starten Sie den Computer erneut.
 
Error - 16.06.2012 16:54:15 | Computer Name = MRNEWMAN | Source = Windows Search Service | ID = 3007
Description = Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert
 werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt
 nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der
 Leistungsindikatoren. Starten Sie den Computer erneut.  Kontext:  Anwendung, SystemIndex
 Katalog
 
Error - 21.06.2012 10:59:16 | Computer Name = MRNEWMAN | Source = Windows Search Service | ID = 3024
Description = Die Aktualisierung kann nicht gestartet werden, da kein Zugriff auf
 die Inhaltsquellen bestand. Beheben Sie die Fehler, und starten Sie die Aktualisierung
 erneut.  Kontext:  Anwendung, SystemIndex Katalog
 
Error - 21.06.2012 10:59:17 | Computer Name = MRNEWMAN | Source = Windows Search Service | ID = 3024
Description = Die Aktualisierung kann nicht gestartet werden, da kein Zugriff auf
 die Inhaltsquellen bestand. Beheben Sie die Fehler, und starten Sie die Aktualisierung
 erneut.  Kontext:  Anwendung, SystemIndex Katalog
 
Error - 21.06.2012 10:59:18 | Computer Name = MRNEWMAN | Source = Windows Search Service | ID = 3024
Description = Die Aktualisierung kann nicht gestartet werden, da kein Zugriff auf
 die Inhaltsquellen bestand. Beheben Sie die Fehler, und starten Sie die Aktualisierung
 erneut.  Kontext:  Anwendung, SystemIndex Katalog
 
Error - 21.06.2012 11:01:26 | Computer Name = MRNEWMAN | Source = Windows Search Service | ID = 3024
Description = Die Aktualisierung kann nicht gestartet werden, da kein Zugriff auf
 die Inhaltsquellen bestand. Beheben Sie die Fehler, und starten Sie die Aktualisierung
 erneut.  Kontext:  Anwendung, SystemIndex Katalog
 
[ OSession Events ]
Error - 13.02.2010 03:44:53 | Computer Name = MRNEWMAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1996
 seconds with 120 seconds of active time.  This session ended with a crash.
 
Error - 06.04.2010 09:02:28 | Computer Name = MRNEWMAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 344
 seconds with 240 seconds of active time.  This session ended with a crash.
 
Error - 26.05.2010 09:46:30 | Computer Name = MRNEWMAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1839
 seconds with 360 seconds of active time.  This session ended with a crash.
 
Error - 30.08.2010 12:37:11 | Computer Name = MRNEWMAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 455
 seconds with 120 seconds of active time.  This session ended with a crash.
 
Error - 12.09.2010 11:32:03 | Computer Name = MRNEWMAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 215
 seconds with 60 seconds of active time.  This session ended with a crash.
 
Error - 02.10.2010 15:52:21 | Computer Name = MRNEWMAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6539.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 148
 seconds with 60 seconds of active time.  This session ended with a crash.
 
Error - 02.10.2010 23:51:04 | Computer Name = MRNEWMAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6539.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 140
 seconds with 120 seconds of active time.  This session ended with a crash.
 
Error - 30.05.2011 04:23:08 | Computer Name = MRNEWMAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1135
 seconds with 600 seconds of active time.  This session ended with a crash.
 
Error - 29.06.2011 07:50:21 | Computer Name = MRNEWMAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 746
 seconds with 300 seconds of active time.  This session ended with a crash.
 
Error - 20.07.2011 07:55:04 | Computer Name = MRNEWMAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 2693 seconds with 300 seconds of active time.  This session ended with a
crash.
 
[ System Events ]
Error - 23.06.2012 13:18:30 | Computer Name = MRNEWMAN | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Systemwiederherstellungsdienst" wurde mit folgendem Fehler
 beendet:  %%2
 
Error - 23.06.2012 13:18:30 | Computer Name = MRNEWMAN | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:  %%1060
 
Error - 26.06.2012 14:17:15 | Computer Name = MRNEWMAN | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:  %%1060
 
Error - 26.06.2012 14:18:08 | Computer Name = MRNEWMAN | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:  %%1060
 
Error - 26.06.2012 14:24:15 | Computer Name = MRNEWMAN | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:  %%1060
 
Error - 26.06.2012 14:27:17 | Computer Name = MRNEWMAN | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet
 beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden
 in 30000 Millisekunden durchgeführt: Starten Sie den Dienst neu..
 
Error - 26.06.2012 14:33:58 | Computer Name = MRNEWMAN | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet
 beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden
 in 30000 Millisekunden durchgeführt: Starten Sie den Dienst neu..
 
Error - 26.06.2012 14:36:35 | Computer Name = MRNEWMAN | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet
 beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden
 in 30000 Millisekunden durchgeführt: Starten Sie den Dienst neu..
 
Error - 27.06.2012 13:19:24 | Computer Name = MRNEWMAN | Source = Srv | ID = 2000
Description = Der Aufruf eines Systemdienstes durch den Serverdienst ist unerwartet
 fehlgeschlagen.
 
Error - 27.06.2012 13:19:24 | Computer Name = MRNEWMAN | Source = Srv | ID = 2000
Description = Der Aufruf eines Systemdienstes durch den Serverdienst ist unerwartet
 fehlgeschlagen.
 
 
< End of report >
Ich hoffe das hilft Dir weiter.
Einen schönen Abend
Alex

Larusso 27.06.2012 19:17
Scan mit SystemLook

Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop.

Download Mirror #1 - Download Mirror #2
  • Doppelklick auf die SystemLook.exe, um das Tool zu starten.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

    Code:
    :folderfind
    {a6a94f0b-6845-dd3e-987e-2338c43273da}
    :regfind
    {a6a94f0b-6845-dd3e-987e-2338c43273da}
  • Klicke nun auf den Button Look, um den Scan zu starten.
  • Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, diese hier in den Thread posten.
  • Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

Brasso 28.06.2012 16:53
Hallo Daniel,

hier das Ergebnis von dem Suchlauf mit SystemLook:

Code:
SystemLook 30.07.11 by jpshortstuff
Log created at 17:46 on 28/06/2012 by Uni
Administrator - Elevation successful

========== folderfind ==========

Searching for "{a6a94f0b-6845-dd3e-987e-2338c43273da}"
C:\Dokumente und Einstellungen\Uni\Lokale Einstellungen\Anwendungsdaten\{a6a94f0b-6845-dd3e-987e-2338c43273da}        d--hs--        [21:20 03/11/2008]
C:\WINDOWS\Installer\{a6a94f0b-6845-dd3e-987e-2338c43273da}        d--hs--        [21:20 03/11/2008]

========== regfind ==========

Searching for "{a6a94f0b-6845-dd3e-987e-2338c43273da}"
No data found.

-= EOF =-
Die Datei in C:WINDOWS\Installer, ist das der Trojaner?

LG Alex

Larusso 28.06.2012 18:28
Ja



Hinweis für Mitleser:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, dass kann andere Systeme nachhaltig schädigen!

Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von einem der folgenden Download-Spiegel neu herunter:
BleepingComputer.com - ForoSpyware.com
und speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste --> Notepad (hinein schreiben) --> OK

Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.

Code:
Folder::
C:\Dokumente und Einstellungen\Uni\Lokale Einstellungen\Anwendungsdaten\{a6a94f0b-6845-dd3e-987e-2338c43273da}       
C:\WINDOWS\Installer\{a6a94f0b-6845-dd3e-987e-2338c43273da}

ClearJavaCache::
Reboot::
Speichere dies als CFScript.txt auf deinem Desktop.
Wichtig:
  • Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern. Danach wieder anstellen nicht vergessen!
  • Bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.
  • Schließe alle laufenden Programme. Gehe sicher, dass ComboFix ungehindert arbeiten kann.
  • Mache nichts am PC solange ComboFix läuft.

http://i266.photobucket.com/albums/i.../CFScriptB.gif
  • In Bezug auf obiges Bild, ziehe CFScript.txt in die ComboFix.exe
  • Wenn ComboFix fertig ist, wird es ein Log erstellen, C:\ComboFix.txt. Bitte füge es hier als Antwort ein.
Falls im Skript die Anweisung Suspect:: oder Collect:: enthalten ist, wird eine Message-Box erscheinen, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen.




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Brasso 28.06.2012 23:09
Guten Abend Daniel,

habe Combofix erneut laufen lassen. Hier ist die entsprechende LOG-File:
Code:
ComboFix 12-06-28.03 - Uni 28.06.2012  23:36:11.2.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.2038.1542 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Uni\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Uni\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\Uni\Lokale Einstellungen\Anwendungsdaten\{a6a94f0b-6845-dd3e-987e-2338c43273da}
c:\dokumente und einstellungen\Uni\Lokale Einstellungen\Anwendungsdaten\{a6a94f0b-6845-dd3e-987e-2338c43273da}\@
c:\windows\Installer\{a6a94f0b-6845-dd3e-987e-2338c43273da}
c:\windows\Installer\{a6a94f0b-6845-dd3e-987e-2338c43273da}\@
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-28 bis 2012-06-28  ))))))))))))))))))))))))))))))
.
.
2012-06-28 18:02 . 2012-04-27 08:20        137928        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-06-28 18:02 . 2012-04-24 22:32        83392        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2012-06-28 18:02 . 2012-04-16 19:17        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2012-06-28 18:02 . 2012-06-28 18:02        --------        d-----w-        c:\programme\Avira
2012-06-28 18:02 . 2012-06-28 18:02        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira
2012-06-28 18:00 . 2012-06-28 18:00        99308192        ----a-w-        C:\avira_free_antivirus_de12001125.exe
2012-06-23 18:08 . 2003-06-25 14:05        266360        ----a-w-        c:\windows\system32\TweakUI.exe
2012-06-22 07:49 . 2012-06-22 07:49        --------        d-----w-        c:\dokumente und einstellungen\Uni\Anwendungsdaten\Malwarebytes
2012-06-22 07:49 . 2012-06-22 07:49        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-06-22 07:49 . 2012-06-22 07:49        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-06-22 07:49 . 2012-04-04 13:56        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-06-21 14:51 . 2012-06-21 15:09        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\F4D55F0200002A30000BB869D151FC84
2012-06-19 10:30 . 2012-06-19 10:30        426184        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-06-13 16:46 . 2012-05-11 14:40        521728        -c----w-        c:\windows\system32\dllcache\jsdbgui.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-19 10:30 . 2011-10-12 18:09        70344        -c--a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-02 13:19 . 2009-04-26 09:00        18456        ----a-w-        c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2009-04-26 09:00        15896        ----a-w-        c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2008-11-03 13:39        329240        ----a-w-        c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2008-11-03 13:39        210968        ----a-w-        c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2008-11-03 13:39        219160        ----a-w-        c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2009-04-26 09:00        45080        ----a-w-        c:\windows\system32\wups2.dll
2012-06-02 13:19 . 2009-04-26 09:00        15896        ----a-w-        c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2008-11-03 21:20        97304        ----a-w-        c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2008-11-03 13:39        53784        ----a-w-        c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2008-11-03 13:39        35864        ----a-w-        c:\windows\system32\wups.dll
2012-06-02 13:19 . 2009-04-26 09:00        23576        ----a-w-        c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2008-11-03 13:39        577048        ----a-w-        c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2008-11-03 13:39        1933848        ----a-w-        c:\windows\system32\wuaueng.dll
2012-06-02 13:18 . 2009-04-28 07:42        275696        ----a-w-        c:\windows\system32\mucltui.dll
2012-06-02 13:18 . 2009-04-28 07:42        214256        ----a-w-        c:\windows\system32\muweb.dll
2012-06-02 13:18 . 2009-04-28 07:42        18160        ----a-w-        c:\windows\system32\mucltui.dll.mui
2012-05-31 13:22 . 2008-11-03 21:20        604160        ----a-w-        c:\windows\system32\crypt32.dll
2012-05-16 15:07 . 2008-11-03 21:21        916992        ----a-w-        c:\windows\system32\wininet.dll
2012-05-15 13:56 . 2008-11-03 21:21        1863296        ----a-w-        c:\windows\system32\win32k.sys
2012-05-11 14:40 . 2008-11-03 21:20        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2012-05-11 14:40 . 2008-11-03 21:20        1469440        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2008-11-03 21:20        385024        ----a-w-        c:\windows\system32\html.iec
2012-05-05 03:14 . 2008-11-03 21:20        2150912        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-05-05 03:14 . 2008-04-14 07:30        2029056        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2008-11-03 13:37        139656        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
.
.
(((((((((((((((((((((((((((((  SnapShot@2012-06-26_18.41.35  )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-06-28 18:02 . 2010-06-17 13:14        28520              c:\windows\system32\drivers\ssmdrv.sys
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Uni\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Uni\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Uni\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\dokumente und einstellungen\Uni\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1044480]
"RTHDCPL"="RTHDCPL.EXE" [2008-08-26 16851456]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-02-18 137752]
"MagicKeyboard"="c:\programme\SAMSUNG\MagicKBD\PreMKBD.exe" [2006-05-14 151552]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-02-18 166424]
"DMHotKey"="c:\programme\Samsung\Easy Display Manager\DMLoader.exe" [2006-12-27 466944]
"BIH"="bih.dll" [2009-04-27 208896]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-11-29 421888]
"SSBkgdUpdate"="c:\programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 155648]
"OpwareSE4"="c:\programme\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 69632]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"GrooveMonitor"="c:\programme\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2012-05-01 348624]
.
c:\dokumente und einstellungen\Uni\Startmenü\Programme\Autostart\
Dropbox.lnk - c:\dokumente und einstellungen\Uni\Anwendungsdaten\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
VPN Client.lnk - c:\windows\Installer\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\Icon3E5562ED7.ico [2010-8-30 6144]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programme\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^McAfee Security Scan Plus.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACU]
2009-05-11 22:00        479320        -c--a-w-        c:\programme\Atheros WLAN Client\ACU.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 13:10        843712        ----a-w-        c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EDS]
2007-12-20 19:40        659456        ----a-w-        c:\programme\Samsung\Samsung EDS\EDSAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2009-02-26 16:36        30040        ----a-w-        c:\programme\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 16:38        421888        ----a-w-        c:\programme\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings]
2010-01-07 23:36        974848        -c--a-w-        c:\programme\pdfforge Toolbar\SearchSettings.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-09-21 19:45        198160        -c--a-w-        c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-10-24 18:05        204288        -c----w-        c:\programme\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"VMCService"=2 (0x2)
"SandraAgentSrv"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"ipsecd"=2 (0x2)
"iPod Service"=3 (0x3)
"iked"=2 (0x2)
"HssTrayService"=3 (0x3)
"HssSrv"=2 (0x2)
"HotspotShieldService"=2 (0x2)
"gusvc"=3 (0x3)
"dtpd"=2 (0x2)
"CVPND"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Application Updater"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"ACS"=2 (0x2)
"McComponentHostService"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe"
"GrooveMonitor"="c:\programme\Microsoft Office\Office12\GrooveMonitor.exe"
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" -atboottime
"ControlCenter2.0"=c:\programme\Brother\ControlCenter2\brctrcen.exe /autorun
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe"
"SetDefPrt"=c:\programme\Brother\Brmfl04g\BrStDvPt.exe
"HP Software Update"=c:\programme\HP\HP Software Update\HPWuSchd2.exe
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot
"SUPBackGround"=c:\programme\Samsung\Samsung Update Plus\SUPBackGround.exe
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"IgfxTray"=c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Dokumente und Einstellungen\\Uni\\Anwendungsdaten\\Dropbox\\bin\\Dropbox.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [06.05.2009 15:19 721904]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [28.06.2012 20:02 36000]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [28.06.2012 20:02 86224]
R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [03.11.2008 15:45 4300]
R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [14.01.2008 20:01 30208]
R3 hspabus;SAMSUNG HSPA USB Composite Device driver (WDM);c:\windows\system32\drivers\hspabus.sys [30.10.2010 06:09 91776]
R3 hspamdfl;SAMSUNG HSPA Modem Filter;c:\windows\system32\drivers\hspamdfl.sys [30.10.2010 06:09 14976]
R3 hspamdm;SAMSUNG HSPA Modem Drivers;c:\windows\system32\drivers\hspamdm.sys [30.10.2010 06:09 119808]
R3 hspaserd;SAMSUNG HSPA Modem Diagnostic Serial Port (WDM);c:\windows\system32\drivers\hspaserd.sys [30.10.2010 06:09 98560]
R3 pflt;Shrew Soft Miniport Filter;c:\windows\system32\drivers\vfilter.sys [19.11.2009 02:06 23808]
R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [03.11.2008 15:49 238464]
S3 cmnsusbser;Mobile Connector USB Device for Legacy Serial Communication LCT2053s;c:\windows\system32\DRIVERS\cmnsusbser.sys --> c:\windows\system32\DRIVERS\cmnsusbser.sys [?]
S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\programme\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [20.01.2010 01:59 87336]
S3 massfilter;MBB Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [09.05.2009 11:10 9216]
S3 SUEPD;SUE NDIS Protocol Driver;c:\windows\system32\drivers\SUE_PD.sys [01.08.2006 15:57 19840]
S3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\drivers\virtualnet.sys [19.11.2009 02:06 6784]
S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\drivers\ZTEusbnet.sys [03.12.2010 06:47 114688]
S3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\drivers\zteusbvoice.sys [03.12.2010 06:47 105856]
S4 Application Updater;Application Updater;c:\programme\Application Updater\ApplicationUpdater.exe [08.01.2010 00:51 380928]
S4 dtpd;ShrewSoft DNS Proxy Daemon;c:\programme\ShrewSoft1\VPN Client\dtpd.exe -service --> c:\programme\ShrewSoft1\VPN Client\dtpd.exe -service [?]
S4 iked;ShrewSoft IKE Daemon;c:\programme\ShrewSoft1\VPN Client\iked.exe -service --> c:\programme\ShrewSoft1\VPN Client\iked.exe -service [?]
S4 ipsecd;ShrewSoft IPSEC Daemon;c:\programme\ShrewSoft1\VPN Client\ipsecd.exe -service --> c:\programme\ShrewSoft1\VPN Client\ipsecd.exe -service [?]
S4 McComponentHostService;McAfee Security Scan Component Host Service;c:\programme\McAfee Security Scan\2.0.181\McCHSvc.exe [15.01.2010 14:49 227232]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\programme\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [23.09.2005 08:01 2799808]
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - SSMDRV
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-28 c:\windows\Tasks\User_Feed_Synchronization-{C434F7DC-7E32-43A4-A389-33736965C89C}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: Easy-WebPrint - Drucken - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Schnelldruck - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint - Vorschau - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Zu Druckliste hinzufügen - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: Interfaces\{03ECD74F-CD29-4766-B8A5-08EE061E28A5}: NameServer = 141.45.2.100,141.45.3.100
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-06-28 23:47
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'explorer.exe'(2660)
c:\programme\ScanSoft\OmniPageSE4.0\OpHookSE4.dll
c:\dokumente und einstellungen\Uni\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe
c:\programme\BurnAware Free\nmsaccessu.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\SearchIndexer.exe
c:\programme\Windows Media Player\WMPNetwk.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\programme\Samsung\Easy Display Manager\dmhkcore.exe
c:\programme\SAMSUNG\MagicKBD\MagicKBD.exe
c:\windows\system32\igfxext.exe
c:\programme\SAMSUNG\MagicKBD\PerformanceManager.exe
c:\programme\Avira\AntiVir Desktop\avshadow.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-28  23:52:29 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-06-28 21:52
ComboFix2.txt  2012-06-26 18:44
.
Vor Suchlauf: 14 Verzeichnis(se), 15.909.089.280 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 16.027.955.200 Bytes frei
.
- - End Of File - - 609824DFE61267925426310A79A8C5FD
Ich werde jetzt im Anschluss den Schritt mit dem ESET Online Scanner durchführen.
Hoffe nur, ich bereite nicht allzu große Umstände mit meinem Problem!!

Einen schönen Abend
Alex

Hallo Daniel,

hier nun die Textdatei von dem Scan mit dem ESET Online Scanner:
Code:
C:\Programme\Application Updater\ApplicationUpdater.exe        probably a variant of Win32/Toolbar.Widgi application
C:\Programme\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe        Win32/Toolbar.Widgi application
C:\Programme\pdfforge Toolbar\SearchSettings.exe        Win32/Toolbar.Widgi application
C:\Programme\pdfforge Toolbar\SearchSettingsRes409.dll        Win32/Toolbar.Widgi application
C:\Programme\pdfforge Toolbar\WidgiHelper.exe        Win32/Toolbar.Widgi application
C:\Qoobox\Quarantine\C\Programme\pdfforge Toolbar\SeARchsettings.dll.vir        Win32/Toolbar.Widgi application
C:\Qoobox\Quarantine\C\Programme\pdfforge Toolbar\IE\1.1.2\pdFForgetoolbarie.dll.vir        probably a variant of Win32/Toolbar.Widgi application
C:\System Volume Information\_restore{07F9C539-D216-4488-A6C7-B268A5247D3F}\RP1\A0000107.dll        probably a variant of Win32/Toolbar.Widgi application
C:\System Volume Information\_restore{07F9C539-D216-4488-A6C7-B268A5247D3F}\RP1\A0000108.dll        Win32/Toolbar.Widgi application
LG Alex

Larusso 30.06.2012 03:09
Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen.

Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und speichere das Logfile.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern ( Meistens C:\ )
    Als Beispiel: C:\TDSSKiller.<version_date_time>log.txt
Poste den Inhalt bitte hier in deinen Thread.

Brasso 30.06.2012 19:16
Hallo Daniel,

hier die LOG_File von dem TDSSKiller:
Code:
19:45:21.0296 0960        TDSS rootkit removing tool 2.7.43.0 Jun 29 2012 17:54:22
19:45:21.0328 0960        ============================================================
19:45:21.0328 0960        Current date / time: 2012/06/30 19:45:21.0328
19:45:21.0328 0960        SystemInfo:
19:45:21.0328 0960       
19:45:21.0328 0960        OS Version: 5.1.2600 ServicePack: 3.0
19:45:21.0328 0960        Product type: Workstation
19:45:21.0328 0960        ComputerName: MRNEWMAN
19:45:21.0328 0960        UserName: Uni
19:45:21.0328 0960        Windows directory: C:\WINDOWS
19:45:21.0328 0960        System windows directory: C:\WINDOWS
19:45:21.0328 0960        Processor architecture: Intel x86
19:45:21.0328 0960        Number of processors: 2
19:45:21.0328 0960        Page size: 0x1000
19:45:21.0328 0960        Boot type: Normal boot
19:45:21.0328 0960        ============================================================
19:45:23.0703 0960        Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
19:45:23.0718 0960        ============================================================
19:45:23.0718 0960        \Device\Harddisk0\DR0:
19:45:23.0718 0960        MBR partitions:
19:45:23.0718 0960        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0xC02F10, BlocksNum 0x52168F0
19:45:23.0718 0960        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x5E19800, BlocksNum 0xCBFF800
19:45:23.0718 0960        ============================================================
19:45:23.0750 0960        C: <-> \Device\Harddisk0\DR0\Partition0
19:45:23.0828 0960        D: <-> \Device\Harddisk0\DR0\Partition1
19:45:23.0828 0960        ============================================================
19:45:23.0828 0960        Initialize success
19:45:23.0828 0960        ============================================================
19:46:04.0609 3636        ============================================================
19:46:04.0609 3636        Scan started
19:46:04.0609 3636        Mode: Manual;
19:46:04.0609 3636        ============================================================
19:46:05.0187 3636        6to4            (d5a6658cbfbbf9a0f8827e83c9fde806) C:\WINDOWS\System32\6to4svc.dll
19:46:05.0218 3636        6to4 - ok
19:46:05.0234 3636        Abiosdsk - ok
19:46:05.0250 3636        abp480n5 - ok
19:46:05.0296 3636        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
19:46:05.0296 3636        ACPI - ok
19:46:05.0328 3636        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
19:46:05.0328 3636        ACPIEC - ok
19:46:05.0421 3636        ACS            (1b5bb73de174056a1caf535dcc5ac7bf) C:\WINDOWS\system32\acs.exe
19:46:05.0515 3636        ACS - ok
19:46:05.0515 3636        adpu160m - ok
19:46:05.0593 3636        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
19:46:05.0640 3636        aec - ok
19:46:05.0703 3636        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
19:46:05.0734 3636        AFD - ok
19:46:05.0750 3636        Aha154x - ok
19:46:05.0750 3636        aic78u2 - ok
19:46:05.0765 3636        aic78xx - ok
19:46:05.0812 3636        Alerter        (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
19:46:05.0875 3636        Alerter - ok
19:46:05.0890 3636        ALG            (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
19:46:05.0921 3636        ALG - ok
19:46:05.0921 3636        AliIde - ok
19:46:05.0937 3636        amsint - ok
19:46:06.0046 3636        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Programme\Avira\AntiVir Desktop\sched.exe
19:46:06.0093 3636        AntiVirSchedulerService - ok
19:46:06.0140 3636        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Programme\Avira\AntiVir Desktop\avguard.exe
19:46:06.0187 3636        AntiVirService - ok
19:46:06.0250 3636        Application Updater (293e66aa529f0fba1aa56340e293a389) C:\Programme\Application Updater\ApplicationUpdater.exe
19:46:06.0312 3636        Application Updater - ok
19:46:06.0328 3636        AppMgmt - ok
19:46:06.0515 3636        AR5416          (c413e2e549488a5f1969decb5b03187a) C:\WINDOWS\system32\DRIVERS\athw.sys
19:46:06.0562 3636        AR5416 - ok
19:46:06.0687 3636        asc - ok
19:46:06.0703 3636        asc3350p - ok
19:46:06.0718 3636        asc3550 - ok
19:46:06.0812 3636        aspnet_state    (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
19:46:06.0875 3636        aspnet_state - ok
19:46:06.0906 3636        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
19:46:06.0953 3636        AsyncMac - ok
19:46:06.0984 3636        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
19:46:07.0000 3636        atapi - ok
19:46:07.0000 3636        Atdisk - ok
19:46:07.0046 3636        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
19:46:07.0093 3636        Atmarpc - ok
19:46:07.0125 3636        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
19:46:07.0171 3636        AudioSrv - ok
19:46:07.0203 3636        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
19:46:07.0265 3636        audstub - ok
19:46:07.0328 3636        avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
19:46:07.0328 3636        avgntflt - ok
19:46:07.0359 3636        avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\WINDOWS\system32\DRIVERS\avipbb.sys
19:46:07.0421 3636        avipbb - ok
19:46:07.0453 3636        avkmgr          (53e56450da16a1a7f0d002f511113f67) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
19:46:07.0515 3636        avkmgr - ok
19:46:07.0562 3636        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
19:46:07.0578 3636        Beep - ok
19:46:07.0656 3636        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
19:46:07.0718 3636        BITS - ok
19:46:07.0781 3636        Browser        (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
19:46:07.0812 3636        Browser - ok
19:46:07.0843 3636        BrScnUsb        (92a964547b96d697e5e9ed43b4297f5a) C:\WINDOWS\system32\Drivers\BrScnUsb.sys
19:46:07.0875 3636        BrScnUsb - ok
19:46:07.0906 3636        BrSerIf        (d48c13f4a409aee8dafaddac81e34557) C:\WINDOWS\system32\Drivers\BrSerIf.sys
19:46:07.0937 3636        BrSerIf - ok
19:46:07.0968 3636        BrUsbSer        (8fa0ac830a8312912a3aa0c0431cba0d) C:\WINDOWS\system32\Drivers\BrUsbSer.sys
19:46:08.0000 3636        BrUsbSer - ok
19:46:08.0046 3636        BthEnum        (b279426e3c0c344893ed78a613a73bde) C:\WINDOWS\system32\DRIVERS\BthEnum.sys
19:46:08.0062 3636        BthEnum - ok
19:46:08.0109 3636        BthPan          (80602b8746d3738f5886ce3d67ef06b6) C:\WINDOWS\system32\DRIVERS\bthpan.sys
19:46:08.0156 3636        BthPan - ok
19:46:08.0218 3636        BTHPORT        (592e1cedbe314d0ef184dc6f46141e76) C:\WINDOWS\system32\Drivers\BTHport.sys
19:46:08.0281 3636        BTHPORT - ok
19:46:08.0312 3636        BthServ        (26c601ef7525e31379744abfc6f35a1b) C:\WINDOWS\System32\bthserv.dll
19:46:08.0359 3636        BthServ - ok
19:46:08.0390 3636        BTHUSB          (61364cd71ef63b0f038b7e9df00f1efa) C:\WINDOWS\system32\Drivers\BTHUSB.sys
19:46:08.0453 3636        BTHUSB - ok
19:46:08.0484 3636        BTWUSB          (57e91e9925976bbc98984eebaaf1d84c) C:\WINDOWS\system32\Drivers\btwusb.sys
19:46:08.0515 3636        BTWUSB - ok
19:46:08.0531 3636        catchme - ok
19:46:08.0562 3636        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
19:46:08.0593 3636        cbidf2k - ok
19:46:08.0640 3636        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
19:46:08.0671 3636        CCDECODE - ok
19:46:08.0671 3636        cd20xrnt - ok
19:46:08.0703 3636        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
19:46:08.0734 3636        Cdaudio - ok
19:46:08.0765 3636        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
19:46:08.0796 3636        Cdfs - ok
19:46:08.0843 3636        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
19:46:08.0875 3636        Cdrom - ok
19:46:08.0875 3636        Changer - ok
19:46:08.0906 3636        CiSvc          (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
19:46:08.0937 3636        CiSvc - ok
19:46:08.0968 3636        ClipSrv        (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
19:46:09.0015 3636        ClipSrv - ok
19:46:09.0109 3636        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
19:46:09.0187 3636        clr_optimization_v2.0.50727_32 - ok
19:46:09.0218 3636        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
19:46:09.0250 3636        CmBatt - ok
19:46:09.0265 3636        CmdIde - ok
19:46:09.0265 3636        cmnsusbser - ok
19:46:09.0296 3636        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
19:46:09.0296 3636        Compbatt - ok
19:46:09.0296 3636        COMSysApp - ok
19:46:09.0468 3636        CoordinatorServiceHost (20d4df9fb904cae0dacdaa86fe6466b9) C:\Programme\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe
19:46:09.0562 3636        CoordinatorServiceHost - ok
19:46:09.0562 3636        Cpqarray - ok
19:46:09.0625 3636        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
19:46:09.0656 3636        CryptSvc - ok
19:46:09.0671 3636        CVirtA          (b5ecadf7708960f1818c7fa015f4c239) C:\WINDOWS\system32\DRIVERS\CVirtA.sys
19:46:09.0703 3636        CVirtA - ok
19:46:09.0890 3636        CVPND          (66257cb4e4fb69887cddc71663741435) C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
19:46:10.0000 3636        CVPND - ok
19:46:10.0484 3636        CVPNDRVA        (18994842386fd3039279d7865740abbd) C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
19:46:10.0562 3636        CVPNDRVA - ok
19:46:10.0562 3636        dac2w2k - ok
19:46:10.0578 3636        dac960nt - ok
19:46:10.0671 3636        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
19:46:10.0671 3636        DcomLaunch - ok
19:46:10.0734 3636        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
19:46:10.0781 3636        Dhcp - ok
19:46:10.0812 3636        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
19:46:10.0812 3636        Disk - ok
19:46:10.0812 3636        dmadmin - ok
19:46:10.0921 3636        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
19:46:10.0984 3636        dmboot - ok
19:46:11.0031 3636        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
19:46:11.0062 3636        dmio - ok
19:46:11.0093 3636        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
19:46:11.0484 3636        dmload - ok
19:46:11.0515 3636        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
19:46:11.0546 3636        dmserver - ok
19:46:11.0593 3636        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
19:46:11.0625 3636        DMusic - ok
19:46:11.0656 3636        DNE            (b5aa5aa5ac327bd7c1aec0c58f0c1144) C:\WINDOWS\system32\DRIVERS\dne2000.sys
19:46:11.0718 3636        DNE - ok
19:46:11.0765 3636        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
19:46:11.0796 3636        Dnscache - ok
19:46:11.0828 3636        DNSeFilter      (128ae3aedde1e3ae772c88320628fe7c) C:\WINDOWS\system32\drivers\SamsungEDS.sys
19:46:11.0875 3636        DNSeFilter - ok
19:46:11.0921 3636        DOSMEMIO        (8a4cb9438571814b128b6dc30d698064) C:\WINDOWS\system32\MEMIO.SYS
19:46:11.0937 3636        DOSMEMIO - ok
19:46:11.0984 3636        Dot3svc        (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
19:46:12.0031 3636        Dot3svc - ok
19:46:12.0031 3636        dpti2o - ok
19:46:12.0062 3636        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
19:46:12.0093 3636        drmkaud - ok
19:46:12.0156 3636        dtpd - ok
19:46:12.0171 3636        EapHost        (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
19:46:12.0218 3636        EapHost - ok
19:46:12.0250 3636        ERSvc          (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
19:46:12.0281 3636        ERSvc - ok
19:46:12.0343 3636        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
19:46:12.0406 3636        Eventlog - ok
19:46:12.0453 3636        EventSystem    (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
19:46:12.0484 3636        EventSystem - ok
19:46:12.0546 3636        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
19:46:12.0593 3636        Fastfat - ok
19:46:12.0640 3636        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
19:46:12.0687 3636        FastUserSwitchingCompatibility - ok
19:46:12.0734 3636        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
19:46:12.0765 3636        Fdc - ok
19:46:12.0812 3636        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
19:46:12.0828 3636        Fips - ok
19:46:12.0968 3636        FLEXnet Licensing Service (abedfd48ac042c6aaad32452e77217a1) C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
19:46:13.0046 3636        FLEXnet Licensing Service - ok
19:46:13.0078 3636        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
19:46:13.0109 3636        Flpydisk - ok
19:46:13.0156 3636        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
19:46:13.0156 3636        FltMgr - ok
19:46:13.0281 3636        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
19:46:13.0343 3636        FontCache3.0.0.0 - ok
19:46:13.0390 3636        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
19:46:13.0421 3636        Fs_Rec - ok
19:46:13.0468 3636        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
19:46:13.0484 3636        Ftdisk - ok
19:46:13.0515 3636        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
19:46:13.0562 3636        GEARAspiWDM - ok
19:46:13.0609 3636        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
19:46:13.0640 3636        Gpc - ok
19:46:13.0703 3636        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
19:46:13.0734 3636        HDAudBus - ok
19:46:13.0812 3636        helpsvc        (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
19:46:13.0859 3636        helpsvc - ok
19:46:13.0890 3636        HidServ        (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
19:46:13.0921 3636        HidServ - ok
19:46:13.0968 3636        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
19:46:13.0984 3636        HidUsb - ok
19:46:14.0031 3636        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
19:46:14.0078 3636        hkmsvc - ok
19:46:14.0078 3636        hpn - ok
19:46:14.0125 3636        HPZid412        (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
19:46:14.0156 3636        HPZid412 - ok
19:46:14.0171 3636        HPZipr12        (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
19:46:14.0218 3636        HPZipr12 - ok
19:46:14.0250 3636        HPZius12        (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
19:46:14.0281 3636        HPZius12 - ok
19:46:14.0328 3636        hspabus        (54bfa8f9e08aaeaa0d1d19a704bf7aaf) C:\WINDOWS\system32\DRIVERS\hspabus.sys
19:46:14.0343 3636        hspabus - ok
19:46:14.0375 3636        hspamdfl        (b7c4e2ee7bc688c13a8d47f59f59b23c) C:\WINDOWS\system32\DRIVERS\hspamdfl.sys
19:46:14.0375 3636        hspamdfl - ok
19:46:14.0437 3636        hspamdm        (7ff9f5651e776386dd719fef4bf3038c) C:\WINDOWS\system32\DRIVERS\hspamdm.sys
19:46:14.0437 3636        hspamdm - ok
19:46:14.0468 3636        hspaserd        (5d6b358d35f36f1b941f6c08eb9c3472) C:\WINDOWS\system32\DRIVERS\hspaserd.sys
19:46:14.0468 3636        hspaserd - ok
19:46:14.0546 3636        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
19:46:14.0593 3636        HTTP - ok
19:46:14.0625 3636        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
19:46:14.0671 3636        HTTPFilter - ok
19:46:14.0671 3636        i2omgmt - ok
19:46:14.0687 3636        i2omp - ok
19:46:14.0734 3636        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
19:46:14.0781 3636        i8042prt - ok
19:46:15.0312 3636        ialm            (48846b31be5a4fa662ccfde7a1ba86b9) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
19:46:15.0578 3636        ialm - ok
19:46:15.0828 3636        idsvc          (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
19:46:15.0937 3636        idsvc - ok
19:46:16.0000 3636        iked - ok
19:46:16.0140 3636        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
19:46:16.0171 3636        Imapi - ok
19:46:16.0218 3636        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
19:46:16.0250 3636        ImapiService - ok
19:46:16.0265 3636        ini910u - ok
19:46:16.0718 3636        IntcAzAudAddService (32915772ccd5bc2bf9762195c002a949) C:\WINDOWS\system32\drivers\RtkHDAud.sys
19:46:16.0921 3636        IntcAzAudAddService - ok
19:46:17.0062 3636        IntelIde - ok
19:46:17.0109 3636        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
19:46:17.0140 3636        intelppm - ok
19:46:17.0156 3636        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
19:46:17.0171 3636        Ip6Fw - ok
19:46:17.0203 3636        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
19:46:17.0250 3636        IpFilterDriver - ok
19:46:17.0265 3636        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
19:46:17.0312 3636        IpInIp - ok
19:46:17.0343 3636        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
19:46:17.0390 3636        IpNat - ok
19:46:17.0421 3636        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
19:46:17.0453 3636        IPSec - ok
19:46:17.0531 3636        ipsecd - ok
19:46:17.0546 3636        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
19:46:17.0593 3636        IRENUM - ok
19:46:17.0609 3636        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
19:46:17.0609 3636        isapnp - ok
19:46:17.0703 3636        JavaQuickStarterService (09417134f248dfceea15c72bcc87f592) C:\Programme\Java\jre6\bin\jqs.exe
19:46:17.0734 3636        JavaQuickStarterService - ok
19:46:17.0781 3636        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
19:46:17.0812 3636        Kbdclass - ok
19:46:17.0843 3636        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
19:46:17.0875 3636        kbdhid - ok
19:46:17.0921 3636        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
19:46:17.0984 3636        kmixer - ok
19:46:18.0031 3636        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
19:46:18.0031 3636        KSecDD - ok
19:46:18.0078 3636        LanmanServer    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
19:46:18.0125 3636        LanmanServer - ok
19:46:18.0171 3636        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
19:46:18.0218 3636        lanmanworkstation - ok
19:46:18.0218 3636        lbrtfdc - ok
19:46:18.0265 3636        LmHosts        (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
19:46:18.0312 3636        LmHosts - ok
19:46:18.0343 3636        massfilter      (8d9c68fa8b7fbe0e225bde0bbcd8ce9b) C:\WINDOWS\system32\DRIVERS\massfilter.sys
19:46:18.0375 3636        massfilter - ok
19:46:18.0453 3636        McComponentHostService (f453d1e6d881e8f8717e20ccd4199e85) C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe
19:46:18.0531 3636        McComponentHostService - ok
19:46:18.0687 3636        MDM            (7cf1b716372b89568ae4c0fe769f5869) C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe
19:46:18.0734 3636        MDM - ok
19:46:18.0765 3636        Messenger      (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
19:46:18.0796 3636        Messenger - ok
19:46:18.0859 3636        Microsoft Office Groove Audit Service (123271bd5237ab991dc5c21fdf8835eb) C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe
19:46:18.0921 3636        Microsoft Office Groove Audit Service - ok
19:46:18.0953 3636        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
19:46:18.0984 3636        mnmdd - ok
19:46:19.0000 3636        mnmsrvc        (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
19:46:19.0031 3636        mnmsrvc - ok
19:46:19.0078 3636        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
19:46:19.0078 3636        Modem - ok
19:46:19.0093 3636        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
19:46:19.0140 3636        Mouclass - ok
19:46:19.0171 3636        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
19:46:19.0203 3636        mouhid - ok
19:46:19.0234 3636        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
19:46:19.0234 3636        MountMgr - ok
19:46:19.0250 3636        mraid35x - ok
19:46:19.0296 3636        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
19:46:19.0312 3636        MRxDAV - ok
19:46:19.0359 3636        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
19:46:19.0375 3636        MRxSmb - ok
19:46:19.0406 3636        MSDTC          (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
19:46:19.0453 3636        MSDTC - ok
19:46:19.0484 3636        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
19:46:19.0484 3636        Msfs - ok
19:46:19.0500 3636        MSIServer - ok
19:46:19.0656 3636        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
19:46:19.0703 3636        MSKSSRV - ok
19:46:19.0734 3636        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
19:46:19.0781 3636        MSPCLOCK - ok
19:46:19.0796 3636        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
19:46:19.0843 3636        MSPQM - ok
19:46:19.0875 3636        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
19:46:19.0906 3636        mssmbios - ok
19:46:19.0921 3636        MSTEE          (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
19:46:19.0953 3636        MSTEE - ok
19:46:20.0312 3636        msvsmon80      (73fa09b84b23a1897809a84f976d5d99) C:\Programme\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe
19:46:20.0500 3636        msvsmon80 - ok
19:46:20.0671 3636        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
19:46:20.0687 3636        Mup - ok
19:46:20.0718 3636        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
19:46:20.0765 3636        NABTSFEC - ok
19:46:20.0828 3636        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
19:46:20.0890 3636        napagent - ok
19:46:20.0937 3636        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
19:46:20.0937 3636        NDIS - ok
19:46:20.0953 3636        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
19:46:20.0984 3636        NdisIP - ok
19:46:21.0031 3636        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
19:46:21.0046 3636        NdisTapi - ok
19:46:21.0078 3636        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
19:46:21.0093 3636        Ndisuio - ok
19:46:21.0125 3636        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
19:46:21.0171 3636        NdisWan - ok
19:46:21.0203 3636        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
19:46:21.0234 3636        NDProxy - ok
19:46:21.0265 3636        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
19:46:21.0265 3636        NetBIOS - ok
19:46:21.0328 3636        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
19:46:21.0375 3636        NetBT - ok
19:46:21.0406 3636        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
19:46:21.0453 3636        NetDDE - ok
19:46:21.0468 3636        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
19:46:21.0468 3636        NetDDEdsdm - ok
19:46:21.0500 3636        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
19:46:21.0531 3636        Netlogon - ok
19:46:21.0578 3636        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
19:46:21.0625 3636        Netman - ok
19:46:21.0750 3636        NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
19:46:21.0812 3636        NetTcpPortSharing - ok
19:46:21.0875 3636        Nla            (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
19:46:21.0890 3636        Nla - ok
19:46:21.0984 3636        NMSAccessU      (b400ed9fa710f2e5fc3c1cb14d7947b0) C:\Programme\BurnAware Free\nmsaccessu.exe
19:46:22.0031 3636        NMSAccessU - ok
19:46:22.0078 3636        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
19:46:22.0078 3636        Npfs - ok
19:46:22.0140 3636        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
19:46:22.0156 3636        Ntfs - ok
19:46:22.0156 3636        NtLmSsp        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
19:46:22.0171 3636        NtLmSsp - ok
19:46:22.0234 3636        NtmsSvc        (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
19:46:22.0281 3636        NtmsSvc - ok
19:46:22.0312 3636        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
19:46:22.0343 3636        Null - ok
19:46:22.0359 3636        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
19:46:22.0406 3636        NwlnkFlt - ok
19:46:22.0421 3636        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
19:46:22.0468 3636        NwlnkFwd - ok
19:46:22.0671 3636        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
19:46:22.0765 3636        odserv - ok
19:46:22.0796 3636        ose            (5a432a042dae460abe7199b758e8606c) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
19:46:22.0843 3636        ose - ok
19:46:22.0890 3636        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
19:46:22.0921 3636        Parport - ok
19:46:22.0953 3636        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
19:46:22.0953 3636        PartMgr - ok
19:46:23.0000 3636        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
19:46:23.0046 3636        ParVdm - ok
19:46:23.0046 3636        PCASp50 - ok
19:46:23.0093 3636        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
19:46:23.0109 3636        PCI - ok
19:46:23.0109 3636        PCIDump - ok
19:46:23.0125 3636        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
19:46:23.0125 3636        PCIIde - ok
19:46:23.0171 3636        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
19:46:23.0218 3636        Pcmcia - ok
19:46:23.0234 3636        PDCOMP - ok
19:46:23.0234 3636        PDFRAME - ok
19:46:23.0250 3636        PDRELI - ok
19:46:23.0250 3636        PDRFRAME - ok
19:46:23.0265 3636        perc2 - ok
19:46:23.0281 3636        perc2hib - ok
19:46:23.0328 3636        pflt            (ceef6777d40dc4b44283eb37fa1e80e1) C:\WINDOWS\system32\DRIVERS\vfilter.sys
19:46:23.0375 3636        pflt - ok
19:46:23.0437 3636        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
19:46:23.0437 3636        PlugPlay - ok
19:46:23.0484 3636        Pml Driver HPZ12 (d31f88c5f19eefa366a415d6bc5f2abc) C:\WINDOWS\system32\HPZipm12.exe
19:46:23.0515 3636        Pml Driver HPZ12 - ok
19:46:23.0546 3636        PolicyAgent    (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
19:46:23.0546 3636        PolicyAgent - ok
19:46:23.0625 3636        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
19:46:23.0640 3636        PptpMiniport - ok
19:46:23.0656 3636        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
19:46:23.0656 3636        ProtectedStorage - ok
19:46:23.0671 3636        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
19:46:23.0687 3636        PSched - ok
19:46:23.0734 3636        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
19:46:23.0765 3636        Ptilink - ok
19:46:23.0812 3636        PxHelp20        (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
19:46:23.0812 3636        PxHelp20 - ok
19:46:23.0828 3636        ql1080 - ok
19:46:23.0828 3636        Ql10wnt - ok
19:46:23.0843 3636        ql12160 - ok
19:46:23.0859 3636        ql1240 - ok
19:46:23.0859 3636        ql1280 - ok
19:46:23.0875 3636        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
19:46:23.0906 3636        RasAcd - ok
19:46:23.0921 3636        RasAuto        (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
19:46:23.0968 3636        RasAuto - ok
19:46:24.0000 3636        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
19:46:24.0031 3636        Rasl2tp - ok
19:46:24.0062 3636        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
19:46:24.0109 3636        RasMan - ok
19:46:24.0156 3636        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
19:46:24.0171 3636        RasPppoe - ok
19:46:24.0234 3636        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
19:46:24.0265 3636        Raspti - ok
19:46:24.0312 3636        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
19:46:24.0312 3636        Rdbss - ok
19:46:24.0328 3636        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
19:46:24.0375 3636        RDPCDD - ok
19:46:24.0453 3636        RDPWD          (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys
19:46:24.0500 3636        RDPWD - ok
19:46:24.0546 3636        RDSessMgr      (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
19:46:24.0593 3636        RDSessMgr - ok
19:46:24.0640 3636        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
19:46:24.0687 3636        redbook - ok
19:46:24.0734 3636        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
19:46:24.0765 3636        RemoteAccess - ok
19:46:24.0796 3636        RFCOMM          (851c30df2807fcfa21e4c681a7d6440e) C:\WINDOWS\system32\DRIVERS\rfcomm.sys
19:46:24.0843 3636        RFCOMM - ok
19:46:24.0875 3636        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
19:46:24.0906 3636        RpcLocator - ok
19:46:24.0984 3636        RpcSs          (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\System32\rpcss.dll
19:46:24.0984 3636        RpcSs - ok
19:46:25.0031 3636        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
19:46:25.0078 3636        RSVP - ok
19:46:25.0109 3636        SamSs          (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
19:46:25.0125 3636        SamSs - ok
19:46:25.0156 3636        SANDRA - ok
19:46:25.0187 3636        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
19:46:25.0234 3636        SCardSvr - ok
19:46:25.0296 3636        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
19:46:25.0343 3636        Schedule - ok
19:46:25.0375 3636        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
19:46:25.0406 3636        Secdrv - ok
19:46:25.0453 3636        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
19:46:25.0484 3636        seclogon - ok
19:46:25.0515 3636        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
19:46:25.0531 3636        SENS - ok
19:46:25.0578 3636        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
19:46:25.0609 3636        Serial - ok
19:46:25.0640 3636        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
19:46:25.0671 3636        Sfloppy - ok
19:46:25.0734 3636        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
19:46:25.0781 3636        SharedAccess - ok
19:46:25.0812 3636        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
19:46:25.0812 3636        ShellHWDetection - ok
19:46:25.0828 3636        Simbad - ok
19:46:25.0859 3636        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
19:46:25.0890 3636        SLIP - ok
19:46:26.0000 3636        SolidWorks Licensing Service (4945020bc094c322571184a6e8056b3a) C:\Programme\Gemeinsame Dateien\SolidWorks Shared\Service\SolidWorksLicensing.exe
19:46:26.0046 3636        SolidWorks Licensing Service - ok
19:46:26.0046 3636        Sparrow - ok
19:46:26.0093 3636        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
19:46:26.0125 3636        splitter - ok
19:46:26.0171 3636        Spooler        (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
19:46:26.0203 3636        Spooler - ok
19:46:26.0312 3636        sptd            (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\system32\Drivers\sptd.sys
19:46:26.0312 3636        Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9
19:46:26.0312 3636        sptd ( LockedFile.Multi.Generic ) - warning
19:46:26.0312 3636        sptd - detected LockedFile.Multi.Generic (1)
19:46:26.0359 3636        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
19:46:26.0359 3636        sr - ok
19:46:26.0390 3636        srservice      (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
19:46:26.0437 3636        srservice - ok
19:46:26.0500 3636        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
19:46:26.0500 3636        Srv - ok
19:46:26.0546 3636        SSDPSRV        (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
19:46:26.0593 3636        SSDPSRV - ok
19:46:26.0640 3636        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
19:46:26.0687 3636        ssmdrv - ok
19:46:26.0750 3636        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
19:46:26.0812 3636        stisvc - ok
19:46:26.0843 3636        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
19:46:26.0890 3636        streamip - ok
19:46:26.0906 3636        SUEPD          (c0137b5947ae3d3fc1c17ba6fdfb3dad) C:\WINDOWS\system32\DRIVERS\SUE_PD.sys
19:46:26.0937 3636        SUEPD - ok
19:46:26.0984 3636        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
19:46:27.0000 3636        swenum - ok
19:46:27.0046 3636        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
19:46:27.0062 3636        swmidi - ok
19:46:27.0078 3636        SwPrv - ok
19:46:27.0078 3636        symc810 - ok
19:46:27.0093 3636        symc8xx - ok
19:46:27.0109 3636        sym_hi - ok
19:46:27.0109 3636        sym_u3 - ok
19:46:27.0171 3636        SynTP          (ea447f6db6115e8a32352f9faffa824d) C:\WINDOWS\system32\DRIVERS\SynTP.sys
19:46:27.0203 3636        SynTP - ok
19:46:27.0234 3636        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
19:46:27.0265 3636        sysaudio - ok
19:46:27.0296 3636        SysmonLog      (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
19:46:27.0328 3636        SysmonLog - ok
19:46:27.0375 3636        taphss          (0c3b2a9c4bd2dd9a6c2e4084314dd719) C:\WINDOWS\system32\DRIVERS\taphss.sys
19:46:27.0421 3636        taphss - ok
19:46:27.0453 3636        TapiSrv        (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
19:46:27.0515 3636        TapiSrv - ok
19:46:27.0609 3636        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
19:46:27.0656 3636        Tcpip - ok
19:46:27.0703 3636        Tcpip6          (4e53bbcc4be37d7a4bd6ef1098c89ff7) C:\WINDOWS\system32\DRIVERS\tcpip6.sys
19:46:27.0750 3636        Tcpip6 - ok
19:46:27.0765 3636        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
19:46:27.0796 3636        TDPIPE - ok
19:46:27.0828 3636        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
19:46:27.0859 3636        TDTCP - ok
19:46:27.0890 3636        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
19:46:27.0906 3636        TermDD - ok
19:46:27.0953 3636        TermService    (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
19:46:28.0000 3636        TermService - ok
19:46:28.0046 3636        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
19:46:28.0062 3636        Themes - ok
19:46:28.0062 3636        TosIde - ok
19:46:28.0109 3636        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
19:46:28.0156 3636        TrkWks - ok
19:46:28.0187 3636        tunmp          (8f861eda21c05857eb8197300a92501c) C:\WINDOWS\system32\DRIVERS\tunmp.sys
19:46:28.0234 3636        tunmp - ok
19:46:28.0265 3636        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
19:46:28.0296 3636        Udfs - ok
19:46:28.0312 3636        ultra - ok
19:46:28.0406 3636        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
19:46:28.0453 3636        Update - ok
19:46:28.0500 3636        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
19:46:28.0546 3636        upnphost - ok
19:46:28.0562 3636        UPS            (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
19:46:28.0609 3636        UPS - ok
19:46:28.0625 3636        USBAAPL - ok
19:46:28.0671 3636        usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
19:46:28.0703 3636        usbaudio - ok
19:46:28.0750 3636        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
19:46:28.0765 3636        usbccgp - ok
19:46:28.0812 3636        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
19:46:28.0843 3636        usbehci - ok
19:46:28.0859 3636        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
19:46:28.0890 3636        usbhub - ok
19:46:28.0937 3636        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
19:46:28.0968 3636        usbprint - ok
19:46:29.0015 3636        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
19:46:29.0031 3636        usbscan - ok
19:46:29.0078 3636        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
19:46:29.0093 3636        USBSTOR - ok
19:46:29.0140 3636        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
19:46:29.0171 3636        usbuhci - ok
19:46:29.0218 3636        usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
19:46:29.0265 3636        usbvideo - ok
19:46:29.0296 3636        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
19:46:29.0343 3636        VgaSave - ok
19:46:29.0343 3636        ViaIde - ok
19:46:29.0406 3636        VMC326          (4f101e48d060e318752fbc458a4b49f0) C:\WINDOWS\system32\Drivers\VMC326.sys
19:46:29.0453 3636        VMC326 - ok
19:46:29.0484 3636        vnet            (068c6a16220b9d8752fd24bb65907719) C:\WINDOWS\system32\DRIVERS\virtualnet.sys
19:46:29.0531 3636        vnet - ok
19:46:29.0578 3636        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
19:46:29.0578 3636        VolSnap - ok
19:46:29.0640 3636        vsdatant        (0354ba3a5ba5e28cc247eb5f5dd8793c) C:\WINDOWS\system32\vsdatant.sys
19:46:29.0687 3636        vsdatant - ok
19:46:29.0750 3636        VSS            (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
19:46:29.0828 3636        VSS - ok
19:46:29.0875 3636        W32Time        (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
19:46:29.0921 3636        W32Time - ok
19:46:29.0953 3636        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
19:46:29.0984 3636        Wanarp - ok
19:46:30.0046 3636        Wdf01000        (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
19:46:30.0109 3636        Wdf01000 - ok
19:46:30.0125 3636        WDICA - ok
19:46:30.0171 3636        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
19:46:30.0203 3636        wdmaud - ok
19:46:30.0250 3636        WebClient      (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
19:46:30.0281 3636        WebClient - ok
19:46:30.0390 3636        winmgmt        (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
19:46:30.0437 3636        winmgmt - ok
19:46:30.0484 3636        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
19:46:30.0531 3636        WmdmPmSN - ok
19:46:30.0562 3636        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
19:46:30.0593 3636        WmiApSrv - ok
19:46:30.0796 3636        WMPNetworkSvc  (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
19:46:30.0906 3636        WMPNetworkSvc - ok
19:46:30.0968 3636        WS2IFSL        (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
19:46:31.0000 3636        WS2IFSL - ok
19:46:31.0031 3636        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
19:46:31.0062 3636        wscsvc - ok
19:46:31.0078 3636        WSearch - ok
19:46:31.0125 3636        WSIMD          (0091d78c5f8fde0cdf2b214823de6e48) C:\WINDOWS\system32\DRIVERS\wsimd.sys
19:46:31.0171 3636        WSIMD - ok
19:46:31.0218 3636        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
19:46:31.0234 3636        WSTCODEC - ok
19:46:31.0281 3636        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
19:46:31.0328 3636        wuauserv - ok
19:46:31.0359 3636        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
19:46:31.0390 3636        WudfPf - ok
19:46:31.0437 3636        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
19:46:31.0484 3636        WudfRd - ok
19:46:31.0515 3636        WudfSvc        (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
19:46:31.0562 3636        WudfSvc - ok
19:46:31.0640 3636        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
19:46:31.0703 3636        WZCSVC - ok
19:46:31.0750 3636        xmlprov        (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
19:46:31.0796 3636        xmlprov - ok
19:46:31.0859 3636        yukonwxp        (7578410b1512fad9c485b134561e8b78) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
19:46:31.0906 3636        yukonwxp - ok
19:46:31.0953 3636        ZTEusbmdm6k    (2a6f72d2b6a549b1fc6a6522bc204159) C:\WINDOWS\system32\DRIVERS\ZTEusbmdm6k.sys
19:46:31.0984 3636        ZTEusbmdm6k - ok
19:46:32.0015 3636        ZTEusbnet      (7df32dc0267c91bacf7e2b4e38ac5df1) C:\WINDOWS\system32\DRIVERS\ZTEusbnet.sys
19:46:32.0062 3636        ZTEusbnet - ok
19:46:32.0093 3636        ZTEusbnmea      (2a6f72d2b6a549b1fc6a6522bc204159) C:\WINDOWS\system32\DRIVERS\ZTEusbnmea.sys
19:46:32.0109 3636        ZTEusbnmea - ok
19:46:32.0140 3636        ZTEusbser6k    (2a6f72d2b6a549b1fc6a6522bc204159) C:\WINDOWS\system32\DRIVERS\ZTEusbser6k.sys
19:46:32.0156 3636        ZTEusbser6k - ok
19:46:32.0187 3636        ZTEusbvoice    (2a6f72d2b6a549b1fc6a6522bc204159) C:\WINDOWS\system32\DRIVERS\ZTEusbvoice.sys
19:46:32.0203 3636        ZTEusbvoice - ok
19:46:32.0250 3636        MBR (0x1B8)    (5bdb9a225c818b2353e1b937aea06c2f) \Device\Harddisk0\DR0
19:46:33.0203 3636        \Device\Harddisk0\DR0 - ok
19:46:33.0203 3636        Boot (0x1200)  (6abcee621bac6b42be9f62e35469c920) \Device\Harddisk0\DR0\Partition0
19:46:33.0203 3636        \Device\Harddisk0\DR0\Partition0 - ok
19:46:33.0234 3636        Boot (0x1200)  (b12b66e5cc6c40f5a4d3c9ba4e66e808) \Device\Harddisk0\DR0\Partition1
19:46:33.0234 3636        \Device\Harddisk0\DR0\Partition1 - ok
19:46:33.0234 3636        ============================================================
19:46:33.0234 3636        Scan finished
19:46:33.0234 3636        ============================================================
19:46:33.0250 3212        Detected object count: 1
19:46:33.0250 3212        Actual detected object count: 1
LG Alex


Alle Zeitangaben in WEZ +1. Es ist jetzt 13:31 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28