Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   searchqu-Symbolleiste in Firefox (https://www.trojaner-board.de/107984-searchqu-symbolleiste-firefox.html)

fuchsneu 12.01.2012 12:47
searchqu-Symbolleiste in Firefox
 
Liebe Leute,
habe mir eine searchqu-Symbolleiste in Firefox eingefangen, die sich - wie meist in diesen Fällen - nicht entfernen lässt.
Bitte um Hilfe.
Anbei otl.txt (extras.txt wurde nicht erstellt) und gmer.txt
Beste Grüße

cosinus 12.01.2012 20:53
Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

fuchsneu 13.01.2012 18:36
Lieber Cosinus,
vorerst ganz herzlichen Dank für die Antwort.
Hat ein wenig gedauert, weil insbesondere der Eset-Scan lange gebraucht hat.


Die Scans von Malwarbyte:
Code:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.13.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: 09-PF681 [Administrator]

13.01.2012 08:27:46
mbam-log-2012-01-13 (08-27-46).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 410897
Laufzeit: 48 Minute(n), 7 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
F:\Downloads\Ö 1 - ab 21.12.2011\SoftonicDownloader_fuer_free-cd-ripper.exe (PUP.BundleOffer.Downloader.S) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
2 Tage vorher habe ich mit Malwarebyte einen Quickscan gemacht:
Code:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.11.03

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: 09-PF681 [Administrator]

11.01.2012 10:51:25
mbam-log-2012-01-11 (10-51-25).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 220071
Laufzeit: 4 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Programme\Unlocker\eBay_shortcuts_1016.exe (Adware.Clicker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)


Der log-File von eset:
Code:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=60285fe9cb2ee549ae7ecf8131366901
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-13 04:44:23
# local_time=2012-01-13 05:44:23 (+0100, Westeuropäische Normalzeit)
# country="Austria"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 3725 3725 0 0
# scanned=609240
# found=23
# cleaned=0
# scan_time=28999
C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\SetupDataMngr_Searchqu.exe        a variant of Win32/Toolbar.SearchSuite application (unable to clean)        00000000000000000000000000000000        I
C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\nsk154\nsz156.tmp\SetupDataMngr_Searchqu.exe        a variant of Win32/Toolbar.SearchSuite application (unable to clean)        00000000000000000000000000000000        I
C:\zwi\find31in.exe        probably a variant of Win32/Hupigon.GWQCLWT trojan (unable to clean)        00000000000000000000000000000000        I
C:\zwi\installer_Nero_DVD_Speed_0_53B_(2).exe        Win32/Toggle application (unable to clean)        00000000000000000000000000000000        I
C:\zwi\installer_Nero_DVD_Speed_0_53B_.exe        Win32/Toggle application (unable to clean)        00000000000000000000000000000000        I
C:\zwi\Nero-6.6.1.15c_wch.exe        Win32/Toolbar.AskSBar application (unable to clean)        00000000000000000000000000000000        I
C:\zwi\SoftonicDownloader_fuer_mp3-2-wav-converter.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I
C:\zwi\advanced pdf\installer_Advanced_PDF_Password_Recovery_5_01.exe        Win32/Toggle application (unable to clean)        00000000000000000000000000000000        I
D:\EUDORA\screen.rar        Win32/Wigon trojan (unable to clean)        00000000000000000000000000000000        I
D:\EUDORA\screen1.rar        Win32/Wigon trojan (unable to clean)        00000000000000000000000000000000        I
D:\EUDORA\ups-435984.zip        Win32/TrojanDownloader.Small.PEJ trojan (unable to clean)        00000000000000000000000000000000        I
E:\Hörspiele\Downloads\agsetup183se.exe        a variant of Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I
I:\xxxxx\C\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Desktopicon\eBayShortcuts.exe        a variant of Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I
I:\xxxxx\C\zwi\find31in.exe        probably a variant of Win32/Hupigon.GWQCLWT trojan (unable to clean)        00000000000000000000000000000000        I
I:\xxxxx\C\zwi\installer_Nero_DVD_Speed_0_53B_(2).exe        Win32/Toggle application (unable to clean)        00000000000000000000000000000000        I
I:\xxxxx\C\zwi\installer_Nero_DVD_Speed_0_53B_.exe        Win32/Toggle application (unable to clean)        00000000000000000000000000000000        I
I:\xxxxx\C\zwi\Nero-6.6.1.15c_wch.exe        Win32/Toolbar.AskSBar application (unable to clean)        00000000000000000000000000000000        I
I:\xxxxx\C\zwi\SoftonicDownloader_fuer_mp3-2-wav-converter.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I
I:\xxxxx\C\zwi\advanced pdf\installer_Advanced_PDF_Password_Recovery_5_01.exe        Win32/Toggle application (unable to clean)        00000000000000000000000000000000        I
I:\xxxxx\D\EUDORA\screen.rar        Win32/Wigon trojan (unable to clean)        00000000000000000000000000000000        I
I:\xxxxx\D\EUDORA\screen1.rar        Win32/Wigon trojan (unable to clean)        00000000000000000000000000000000        I
I:\xxxxx\D\EUDORA\ups-435984.zip        Win32/TrojanDownloader.Small.PEJ trojan (unable to clean)        00000000000000000000000000000000        I
I:\xxxxx\E\Hörspiele\Downloads\agsetup183se.exe        a variant of Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I
Schöne Grüße!

cosinus 13.01.2012 18:42
Zitat:
D:\EUDORA\screen.rar
D:\EUDORA\screen1.rar
D:\EUDORA\ups-435984.zip
Was genau soll das sein in D:\EUDORA?

fuchsneu 13.01.2012 19:15
Lieber Arne,
vielen Dank für die rasche Antwort.
Ehrlich gesagt, ich hab keine Ahnung mehr, was diese 3 Files sollen. Jedenfalls hatte ich in D:\EUDORA die Anhänge des Mail-Programms Eudora gespeichert, das ich allerdings schon länger nicht mehr verwende.
Beste Grüße
fuchsneu

cosinus 13.01.2012 19:30
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

fuchsneu 14.01.2012 15:40
Lieber Arne.
das ist der OTL-Logfile:
OTL Logfile:
Code:
OTL logfile created on: 14.01.2012 15:26:51 - Run 4
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Dokumente und Einstellungen\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
3,21 Gb Total Physical Memory | 2,57 Gb Available Physical Memory | 80,07% Memory free
5,05 Gb Paging File | 4,56 Gb Available in Paging File | 90,21% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 97,66 Gb Total Space | 22,97 Gb Free Space | 23,52% Space Free | Partition Type: NTFS
Drive D: | 97,66 Gb Total Space | 32,51 Gb Free Space | 33,29% Space Free | Partition Type: NTFS
Drive E: | 102,66 Gb Total Space | 68,46 Gb Free Space | 66,68% Space Free | Partition Type: NTFS
Drive F: | 298,09 Gb Total Space | 247,14 Gb Free Space | 82,91% Space Free | Partition Type: NTFS
Drive I: | 931,51 Gb Total Space | 416,85 Gb Free Space | 44,75% Space Free | Partition Type: NTFS
 
Computer Name: 09-PF681 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.11 12:25:29 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe
PRC - [2012.01.03 08:37:53 | 000,843,712 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
PRC - [2011.08.09 12:21:13 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
PRC - [2011.06.16 15:21:06 | 001,500,160 | ---- | M] (Nokia) -- C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe
PRC - [2011.06.09 12:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2011.06.08 14:49:48 | 000,159,744 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
PRC - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe
PRC - [2011.05.19 15:05:00 | 000,185,664 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\Common Framework\naPrdMgr.exe
PRC - [2011.05.19 15:05:00 | 000,120,128 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\Common Framework\FrameworkService.exe
PRC - [2011.03.31 14:32:14 | 000,134,144 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe
PRC - [2011.03.21 13:19:36 | 000,120,832 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe
PRC - [2011.02.04 19:07:00 | 000,147,984 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan Enterprise\Mcshield.exe
PRC - [2011.02.04 19:07:00 | 000,124,224 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan Enterprise\shstat.exe
PRC - [2011.02.04 19:07:00 | 000,069,192 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\mfevtps.exe
PRC - [2011.02.04 19:07:00 | 000,066,880 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan Enterprise\VsTskMgr.exe
PRC - [2011.02.04 19:07:00 | 000,027,960 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan Enterprise\mfeann.exe
PRC - [2011.02.04 19:07:00 | 000,022,816 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan Enterprise\EngineServer.exe
PRC - [2009.09.11 13:36:30 | 000,128,232 | ---- | M] (CyberLink Corp.) -- C:\Programme\CyberLink\PowerDVD DX\PDVDDXSrv.exe
PRC - [2008.08.06 16:00:50 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2008.08.06 16:00:48 | 000,182,808 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2008.07.23 09:56:14 | 002,054,680 | ---- | M] (Intel Corporation) -- C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\UNS\UNS.exe
PRC - [2008.07.23 09:56:12 | 000,174,616 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\AMT\LMS.exe
PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.08.21 15:18:24 | 000,286,720 | ---- | M] (baramundi software AG) -- C:\WINDOWS\system32\BFCRX.exe
PRC - [2006.10.26 13:40:34 | 000,335,872 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe
PRC - [2006.10.22 22:24:02 | 000,620,152 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
PRC - [2006.09.11 04:40:32 | 000,218,032 | ---- | M] (Macrovision Corporation) -- C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe
PRC - [2004.07.26 16:49:30 | 001,093,632 | ---- | M] (sw4you, Siegfried Weckmann) -- C:\Programme\Hardcopy\hardcopy.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.11.08 21:46:02 | 000,093,696 | ---- | M] () -- C:\Programme\FileZilla FTP Client\fzshellext.dll
MOD - [2011.05.19 15:05:00 | 000,070,976 | ---- | M] () -- C:\Programme\McAfee\Common Framework\boost_thread-vc80-mt-1_32.dll
MOD - [2011.04.07 16:43:24 | 008,191,488 | ---- | M] () -- C:\Programme\Nokia\Nokia PC Suite 7\QtGUI4.dll
MOD - [2011.04.07 16:43:22 | 002,296,320 | ---- | M] () -- C:\Programme\Nokia\Nokia PC Suite 7\QtCore4.dll
MOD - [2011.02.22 20:13:22 | 000,022,016 | ---- | M] () -- C:\Programme\Nokia\Nokia PC Suite 7\imageformats\qsvg4.dll
MOD - [2011.02.22 20:12:54 | 000,196,608 | ---- | M] () -- C:\Programme\Nokia\Nokia PC Suite 7\imageformats\qjpeg4.dll
MOD - [2011.02.22 17:39:06 | 000,276,480 | ---- | M] () -- C:\Programme\Nokia\Nokia PC Suite 7\QtSvg4.dll
MOD - [2011.02.22 17:07:20 | 000,339,968 | ---- | M] () -- C:\Programme\Nokia\Nokia PC Suite 7\QtXml4.dll
MOD - [2007.07.23 15:04:46 | 000,068,080 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\DLLShared\dlaapi_w.dll
MOD - [2007.04.18 19:30:46 | 000,471,040 | ---- | M] () -- C:\Programme\McAfee\Common Framework\ccme_base.dll
MOD - [2007.04.18 19:30:46 | 000,393,216 | ---- | M] () -- C:\Programme\McAfee\Common Framework\cryptocme2.dll
MOD - [2006.10.22 23:21:28 | 000,917,504 | ---- | M] () -- C:\Programme\Adobe\Acrobat 8.0\Acrobat\AdistRes.DEU
MOD - [2006.06.26 20:08:04 | 000,017,704 | ---- | M] () -- C:\Programme\Microsoft ActiveSync\rapiproxystub.dll
MOD - [2004.07.19 07:19:44 | 000,319,488 | ---- | M] () -- C:\Programme\Hardcopy\HcDllS.dll
MOD - [2003.12.25 05:20:28 | 000,043,520 | ---- | M] () -- C:\Programme\Hardcopy\hcdll2_C.dll
MOD - [2003.11.20 11:18:06 | 000,045,056 | ---- | M] () -- C:\Programme\Hardcopy\hardcopy.dll
MOD - [2001.10.28 16:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.08.09 12:21:13 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Running] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2011.05.19 15:05:00 | 000,120,128 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Programme\McAfee\Common Framework\FrameworkService.exe -- (McAfeeFramework)
SRV - [2011.02.04 19:07:00 | 000,147,984 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Programme\McAfee\VirusScan Enterprise\Mcshield.exe -- (McShield)
SRV - [2011.02.04 19:07:00 | 000,069,192 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\WINDOWS\system32\mfevtps.exe -- (mfevtp)
SRV - [2011.02.04 19:07:00 | 000,066,880 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Programme\McAfee\VirusScan Enterprise\VsTskMgr.exe -- (McTaskManager)
SRV - [2011.02.04 19:07:00 | 000,022,816 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Programme\McAfee\VirusScan Enterprise\EngineServer.exe -- (McAfeeEngineService)
SRV - [2008.08.06 16:00:50 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2008.07.23 09:56:14 | 002,054,680 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2008.07.23 09:56:12 | 000,174,616 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\AMT\LMS.exe -- (LMS) Intel(R)
SRV - [2007.08.21 15:18:24 | 000,286,720 | ---- | M] (baramundi software AG) [Auto | Running] -- C:\WINDOWS\system32\BFCRX.exe -- (BFCRX)
SRV - [2007.07.11 09:33:28 | 000,069,632 | R--- | M] (MicroVision Development, Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\SureThing Shared\stllssvr.exe -- (stllssvr)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006.10.26 13:40:34 | 000,335,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe -- (MDM)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.05.18 10:12:38 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011.05.18 10:12:36 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011.05.18 10:12:32 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011.05.18 10:12:28 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2011.02.04 19:07:00 | 000,337,560 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2011.02.04 19:07:00 | 000,091,992 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2011.02.04 19:07:00 | 000,076,088 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2011.02.04 19:07:00 | 000,067,240 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdet.sys -- (mferkdet)
DRV - [2011.02.04 19:07:00 | 000,065,960 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfetdik.sys -- (mfetdik)
DRV - [2011.02.04 19:07:00 | 000,043,224 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2009.01.18 22:30:13 | 000,064,160 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.07.23 09:42:30 | 000,040,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HECI.sys -- (HECI) Intel(R)
DRV - [2008.06.05 11:58:18 | 000,144,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e1k5132.sys -- (e1kexpress) Intel(R)
DRV - [2008.03.28 10:14:02 | 000,024,064 | ---- | M] (Sonic Focus, Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfaudio.sys -- (SFAUDIO)
DRV - [2007.07.23 15:05:18 | 000,009,104 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLADResM.SYS -- (DLADResM)
DRV - [2007.07.23 15:04:58 | 000,037,360 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLABMFSM.SYS -- (DLABMFSM)
DRV - [2007.07.23 15:04:56 | 000,098,448 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2007.07.23 15:04:56 | 000,093,552 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2007.07.23 15:04:54 | 000,027,216 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2007.07.23 15:04:52 | 000,032,848 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2007.07.23 15:04:52 | 000,016,304 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2007.07.23 15:04:50 | 000,108,752 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2007.07.23 14:49:44 | 000,030,064 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_M.SYS -- (DLARTL_M)
DRV - [2007.07.23 14:49:44 | 000,014,576 | ---- | M] (Roxio) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [1999.09.10 13:06:00 | 000,025,244 | ---- | M] (Adaptec) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\aspi32.sys -- (Aspi32)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Searchqu Web Search"
FF - prefs.js..browser.search.order.1: "Searchqu Web Search"
FF - prefs.js..browser.search.selectedEngine: "Searchqu Web Search"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "www.google.at"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&appid=0&systemid=412&sr=0&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.01.11 11:06:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.12.20 21:48:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.17\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2011.12.21 09:38:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.17\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins
 
[2011.12.21 22:06:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions
[2010.02.22 14:11:43 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.07.27 11:25:18 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\res\extensions
[2011.07.27 11:25:18 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\res\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.01.11 10:00:31 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\extensions
[2011.07.27 11:32:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.07.27 11:40:14 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011.07.27 11:40:12 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011.07.27 11:40:18 | 000,000,000 | ---D | M] (German Dictionary, extended for Austria) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\extensions\de-AT@dictionaries.addons.mozilla.org
[2011.07.27 11:40:15 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\extensions\nostmp
[2009.10.13 09:24:59 | 000,002,172 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\searchplugins\bing.xml
[2008.12.16 12:22:12 | 000,000,878 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\searchplugins\conduit.xml
[2011.12.21 15:21:20 | 000,002,520 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\searchplugins\SearchResults.xml
[2010.02.22 12:27:14 | 000,001,589 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\searchplugins\web-search.xml
[2012.01.11 11:06:57 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.01.11 11:06:54 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.02.04 19:07:00 | 000,023,864 | ---- | M] (McAfee, Inc.) -- C:\Programme\mozilla firefox\components\Scriptff.dll
[2008.08.16 17:42:02 | 000,070,456 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\mozilla firefox\plugins\CgpCore.dll
[2008.08.16 17:42:12 | 000,091,448 | ---- | M] () -- C:\Programme\mozilla firefox\plugins\confmgr.dll
[2008.08.16 17:42:08 | 000,020,800 | ---- | M] () -- C:\Programme\mozilla firefox\plugins\ctxlogging.dll
[2008.05.21 08:41:08 | 000,479,232 | ---- | M] (Microsoft Corporation) -- C:\Programme\mozilla firefox\plugins\msvcm80.dll
[2008.05.21 08:41:08 | 000,548,864 | ---- | M] (Microsoft Corporation) -- C:\Programme\mozilla firefox\plugins\msvcp80.dll
[2008.05.21 08:41:08 | 000,626,688 | ---- | M] (Microsoft Corporation) -- C:\Programme\mozilla firefox\plugins\msvcr80.dll
[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2008.08.16 17:44:46 | 000,427,312 | ---- | M] () -- C:\Programme\mozilla firefox\plugins\npicaN.dll
[2008.08.16 17:42:04 | 000,023,864 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\mozilla firefox\plugins\TcpPServ.dll
[2012.01.11 11:06:51 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.11 11:06:51 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.01.11 11:06:51 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.11 11:06:51 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.12.21 15:21:20 | 000,002,520 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\SearchResults.xml
[2012.01.11 11:06:51 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.11 11:06:51 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Searchqu Web Search (Enabled)
CHR - default_search_provider: search_url = hxxp://www.searchqu.com/web?src=ffb&appid=0&systemid=412&sr=0&q={searchTerms}
CHR - default_search_provider: suggest_url = hxxp://www.searchqu.com/suggest.php?qu={searchTerms}&ft=json&src=ffb&appid=0&systemid=412&sr=0
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\16.0.912.75\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\16.0.912.75\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Programme\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Programme\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Programme\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = C:\Programme\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programme\Windows Media Player\npdsplay.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Programme\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\
CHR - Extension: Google-Suche = C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\
CHR - Extension: Google Mail = C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.4_0\
 
O1 HOSTS File: ([2004.08.04 12:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan Enterprise\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Programme\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Programme\McAfee\Common Framework\udaterui.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Programme\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [picon] C:\Programme\Gemeinsame Dateien\Intel\Privacy Icon\PrivacyIconClient.exe (Intel Corporation)
O4 - HKLM..\Run: [ScanSoft OmniPage 16-reminder] C:\Programme\ScanSoft\OmniPage16\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [ShStatEXE] C:\Programme\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [OpAgent] "OpAgent.exe" /agent File not found
O4 - HKCU..\Run: [PC Suite Tray] C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\Hardcopy.LNK = C:\Programme\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann)
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\OneNote Inhaltsverzeichnis.onetoc2 ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalUserRunOnce = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Citavi Picker... - C:\Programme\Internet Explorer\PLUGINS\Citavi Picker\ShowContextMenu.html ()
O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1228389011265 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1257505153484 (MUWebControl Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2272904F-4A85-4522-994C-A666625C046F}: NameServer = 143.50.19.25,143.50.56.25
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) -C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.12.04 10:38:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011.07.27 14:21:24 | 000,000,000 | ---D | M] - D:\Autobiographie -- [ NTFS ]
O32 - AutoRun File - [2011.07.27 14:21:24 | 000,000,000 | ---D | M] - D:\Autorenbio -- [ NTFS ]
O33 - MountPoints2\##soft01#lizenzen#office11\Shell - "" = AutoRun
O33 - MountPoints2\##soft01#lizenzen#office11\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\##soft01#lizenzen#office11\Shell\AutoRun\command - "" = S:\SETUP.EXE /AUTORUN
O33 - MountPoints2\##soft01#lizenzen#office11\Shell\configure\command - "" = S:\SETUP.EXE
O33 - MountPoints2\##soft01#lizenzen#office11\Shell\install\command - "" = S:\SETUP.EXE
O33 - MountPoints2\{3267cf02-1582-11df-9611-0024e840b8b3}\Shell - "" = AutoRun
O33 - MountPoints2\{3267cf02-1582-11df-9611-0024e840b8b3}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3267cf02-1582-11df-9611-0024e840b8b3}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 0
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: McAfeeEngineService - C:\Programme\McAfee\VirusScan Enterprise\EngineServer.exe (McAfee, Inc.)
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0.3
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0.3
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9309DD7E-EBFE-3C95-8B47-30D3A012F606} - .NET Framework
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: Microsoft Base Smart Card Crypto Provider Package -
 
Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (hxxp://www.mp3dev.org/)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.13 09:38:59 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.01.13 09:38:52 | 002,322,184 | ---- | C] (ESET) -- C:\Dokumente und Einstellungen\Administrator\Desktop\esetsmartinstaller_enu.exe
[2012.01.12 12:39:04 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\All Users\Startmenü\Programme\7-Zip
[2012.01.12 12:39:04 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip
[2012.01.12 09:57:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Desktop\69886-alle-hilfesuchenden-eroeffnung-themas-beachten-Dateien
[2012.01.12 09:50:39 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe
[2012.01.11 11:20:30 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2012.01.11 11:20:30 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2012.01.11 10:50:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes
[2012.01.11 10:50:00 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.01.11 10:49:56 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.01.11 10:49:55 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.01.11 10:49:55 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.12.28 23:26:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Google Chrome
[2011.12.21 21:59:19 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess
[2011.12.21 15:21:18 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Free Audio Pack
[2011.12.21 15:21:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\FreeCDRipper
[2011.12.21 15:21:17 | 000,000,000 | ---D | C] -- C:\Programme\Free CD Ripper
[2011.12.20 21:48:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Apple Computer
[2011.12.20 21:47:50 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\All Users\Startmenü\Programme\QuickTime
[2011.12.20 21:47:15 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime
[2011.12.20 21:47:14 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer
[2011.12.20 21:45:39 | 000,000,000 | ---D | C] -- C:\Programme\Apple Software Update
[2011.12.17 13:26:23 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\All Users\Startmenü\Programme\FileZilla FTP Client
[2011.12.17 13:26:22 | 000,000,000 | ---D | C] -- C:\Programme\FileZilla FTP Client
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.14 15:25:00 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.01.14 15:24:15 | 000,002,189 | ---- | M] () -- D:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk
[2012.01.14 15:24:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.01.13 18:31:00 | 000,001,242 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-627158298-2154700328-2256013073-500UA.job
[2012.01.13 13:20:20 | 000,002,509 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Microsoft Office Word 2003.lnk
[2012.01.13 10:43:29 | 000,002,607 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Microsoft Office Outlook 2003.lnk
[2012.01.13 09:43:46 | 000,002,537 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Microsoft Office Excel 2003.lnk
[2012.01.13 09:38:52 | 002,322,184 | ---- | M] (ESET) -- C:\Dokumente und Einstellungen\Administrator\Desktop\esetsmartinstaller_enu.exe
[2012.01.13 09:34:22 | 000,521,086 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.01.13 09:34:22 | 000,497,090 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.01.13 09:34:22 | 000,102,508 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.01.13 09:34:22 | 000,085,574 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.01.12 12:46:08 | 000,027,315 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\logfiles.zip
[2012.01.12 12:40:05 | 000,021,274 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\logfiles.7z
[2012.01.12 09:59:51 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\nqv7jxbq.exe
[2012.01.12 09:57:08 | 000,071,705 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\69886-alle-hilfesuchenden-eroeffnung-themas-beachten.html
[2012.01.12 09:45:02 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\defogger_reenable
[2012.01.11 12:25:29 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe
[2012.01.11 12:04:42 | 000,000,550 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2012.01.11 10:50:00 | 000,000,652 | ---- | M] () -- D:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.11 10:05:12 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.01.10 10:34:57 | 000,002,199 | ---- | M] () -- D:\Dokumente und Einstellungen\All Users\Desktop\Microsoft Office Word 2007.lnk
[2012.01.09 09:31:33 | 000,002,430 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Google Chrome.lnk
[2011.12.28 23:31:00 | 000,001,190 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-627158298-2154700328-2256013073-500Core.job
[2011.12.21 15:21:19 | 000,000,722 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Free CD Ripper.lnk
[2011.12.20 21:47:50 | 000,001,492 | ---- | M] () -- D:\Dokumente und Einstellungen\All Users\Desktop\QuickTime Player.lnk
[2011.12.20 21:45:42 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011.12.20 21:22:41 | 000,077,271 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Buch_Dossier30-RPGruber_korr2 208.pdf
[2011.12.20 21:22:41 | 000,037,700 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Buch_Dossier30-RPGruber_korr2 207.pdf
[2011.12.20 17:43:00 | 000,000,458 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011.12.20 09:15:19 | 000,001,603 | ---- | M] () -- D:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 9.lnk
[2011.12.19 10:03:04 | 000,090,527 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Buch_Dossier30-RPGruber_korr1.pdf
[2011.12.17 13:26:26 | 000,001,525 | ---- | M] () -- D:\Dokumente und Einstellungen\All Users\Desktop\FileZilla Client.lnk
[2011.12.16 10:52:59 | 002,202,462 | ---- | M] () -- C:\WINDOWS\ACD Wallpaper.cmp
[2011.12.16 09:58:37 | 000,326,083 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\24.jpg
[2011.12.16 09:58:08 | 000,569,866 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\25.jpg
[2011.12.16 09:57:37 | 000,051,579 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\01.jpg
[2011.12.16 09:49:17 | 000,292,480 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.12 12:46:08 | 000,027,315 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\logfiles.zip
[2012.01.12 12:40:05 | 000,021,274 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\logfiles.7z
[2012.01.12 09:59:50 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\nqv7jxbq.exe
[2012.01.12 09:57:07 | 000,071,705 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\69886-alle-hilfesuchenden-eroeffnung-themas-beachten.html
[2012.01.12 09:45:02 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\defogger_reenable
[2012.01.11 10:50:00 | 000,000,652 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2011.12.28 23:26:52 | 000,002,430 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Google Chrome.lnk
[2011.12.28 23:26:29 | 000,001,242 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-627158298-2154700328-2256013073-500UA.job
[2011.12.28 23:26:29 | 000,001,190 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-627158298-2154700328-2256013073-500Core.job
[2011.12.21 15:21:19 | 000,000,722 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Free CD Ripper.lnk
[2011.12.20 21:47:50 | 000,001,492 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Desktop\QuickTime Player.lnk
[2011.12.20 21:45:42 | 000,000,276 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011.12.20 21:22:41 | 000,077,271 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Buch_Dossier30-RPGruber_korr2 208.pdf
[2011.12.20 21:22:41 | 000,037,700 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Buch_Dossier30-RPGruber_korr2 207.pdf
[2011.12.19 10:03:04 | 000,090,527 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Buch_Dossier30-RPGruber_korr1.pdf
[2011.12.16 10:52:52 | 002,202,462 | ---- | C] () -- C:\WINDOWS\ACD Wallpaper.cmp
[2011.12.16 09:58:36 | 000,326,083 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\24.jpg
[2011.12.16 09:58:08 | 000,569,866 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\25.jpg
[2011.12.16 09:57:37 | 000,051,579 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\01.jpg
[2011.08.09 15:14:49 | 000,039,095 | ---- | C] () -- C:\WINDOWS\Iccsigs.dat
[2011.08.09 15:14:49 | 000,000,156 | ---- | C] () -- C:\WINDOWS\KPCMS.INI
[2011.08.09 15:13:56 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
[2011.08.09 15:13:54 | 000,042,483 | ---- | C] () -- C:\WINDOWS\ICCCODES.DAT
[2011.08.05 23:07:23 | 000,177,072 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2011.08.03 09:36:48 | 000,002,508 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\$_hpcst$.hpc
[2011.08.01 11:16:40 | 000,012,800 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.07.28 09:23:53 | 000,000,387 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2010.02.12 10:32:24 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009.11.09 13:52:08 | 000,000,420 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009.11.06 13:25:59 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009.11.06 13:25:59 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2009.11.06 13:25:57 | 000,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009.11.06 13:25:56 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009.11.06 13:25:56 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009.08.19 10:58:10 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2008.12.05 14:56:07 | 002,026,604 | ---- | C] () -- C:\WINDOWS\System32\igkrng500.bin
[2008.12.05 14:56:06 | 000,442,964 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng500.bin
[2008.12.05 14:56:06 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4977.dll
[2008.12.04 15:34:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2008.12.04 13:16:49 | 000,000,507 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008.12.04 12:58:42 | 000,008,761 | ---- | C] () -- C:\WINDOWS\System32\DWRCS.INI
[2008.12.04 11:58:11 | 000,000,280 | ---- | C] () -- C:\WINDOWS\System32\epoPGPsdk.dll.sig
[2008.12.04 11:39:47 | 000,000,550 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2008.12.04 11:28:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2008.12.04 11:19:41 | 000,001,502 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI_dell
[2008.12.04 10:39:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2008.12.04 10:36:50 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008.12.04 10:31:15 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008.12.04 10:30:32 | 000,292,480 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004.08.04 12:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004.08.04 12:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.08.04 12:00:00 | 000,521,086 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004.08.04 12:00:00 | 000,497,090 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.08.04 12:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.08.04 12:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004.08.04 12:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.08.04 12:00:00 | 000,102,508 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004.08.04 12:00:00 | 000,085,574 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.08.04 12:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.08.04 12:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004.08.04 12:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.08.04 12:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.04 12:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004.08.04 12:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004.08.04 12:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003.02.20 16:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002.03.21 12:51:52 | 000,503,808 | R--- | C] () -- C:\WINDOWS\System32\lt_xtrans.dll
[2002.03.21 12:51:52 | 000,286,720 | R--- | C] () -- C:\WINDOWS\System32\MrSIDD.dll
[2002.03.21 12:51:52 | 000,163,840 | R--- | C] () -- C:\WINDOWS\System32\lt_common.dll
[2002.03.21 12:51:52 | 000,126,976 | R--- | C] () -- C:\WINDOWS\System32\lt_trans.dll
[2002.03.21 12:51:52 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\lt_meta.dll
[2002.03.21 12:51:52 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\lt_encrypt.dll
[2002.03.21 12:51:52 | 000,020,480 | R--- | C] () -- C:\WINDOWS\System32\lt_messagetext.dll
[2002.03.20 21:01:06 | 000,006,688 | R--- | C] () -- C:\WINDOWS\System32\Digita.sys
[2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportUSB.dll
[2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportSerial.dll
[2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrDA.dll
[2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrCOMM.dll
 
========== LOP Check ==========
 
[2008.12.04 13:26:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Academic Software Zurich
[2011.08.01 21:46:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ACD Systems
[2011.08.02 17:04:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Canon
[2011.12.17 13:40:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\FileZilla
[2011.12.21 15:22:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\FreeCDRipper
[2008.12.04 15:35:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ICAClient
[2012.01.11 15:44:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\MyPhoneExplorer
[2011.11.10 11:14:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Nokia
[2011.11.14 09:38:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\PC Suite
[2011.08.02 10:29:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ScanSoft
[2011.09.14 10:15:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Synchronizer
[2011.07.27 12:18:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Thunderbird
[2008.12.04 18:49:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Windows Search
[2011.08.02 10:29:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Zeon
[2011.12.20 17:43:00 | 000,000,458 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
[2008.12.04 12:00:00 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Application Data\McAfee
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2008.12.04 13:26:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Academic Software Zurich
[2011.08.01 21:46:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ACD Systems
[2011.12.16 09:56:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Adobe
[2011.12.21 09:15:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Apple Computer
[2008.12.04 12:48:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ATI
[2011.08.02 17:04:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Canon
[2008.12.04 16:03:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\CyberLink
[2011.12.17 13:40:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\FileZilla
[2011.12.21 15:22:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\FreeCDRipper
[2008.12.04 15:35:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ICAClient
[2008.12.04 11:05:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Identities
[2008.12.04 15:40:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\InstallShield
[2008.12.04 13:57:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Macromedia
[2012.01.11 10:50:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes
[2011.09.02 07:57:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\McAfee
[2011.08.15 16:04:10 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft
[2008.12.04 15:34:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla
[2012.01.11 15:44:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\MyPhoneExplorer
[2011.11.10 11:14:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Nokia
[2011.11.14 09:38:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\PC Suite
[2009.11.06 13:37:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Real
[2008.12.04 15:50:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Roxio
[2011.08.02 10:29:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ScanSoft
[2008.12.04 13:50:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun
[2011.09.14 10:15:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Synchronizer
[2011.07.27 12:18:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Thunderbird
[2008.12.04 18:49:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Windows Search
[2011.08.02 10:29:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Zeon
 
< %APPDATA%\*.exe /s >
[2011.08.05 19:54:54 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2008.12.04 11:42:31 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft\Installer\{42929F0F-CE14-47AF-9FC7-FF297A603021}\ARPPRODUCTICON.exe
[2008.12.04 11:42:31 | 000,045,056 | R--- | M] (Macrovision Corporation) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft\Installer\{42929F0F-CE14-47AF-9FC7-FF297A603021}\NewShortcut1_42929F0FCE1447AF9FC7FF297A603021_1.exe
[2011.08.01 22:12:58 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft\Installer\{A725C340-77EE-11D6-BBC2-0000CB591583}\_1d527b86.exe
[2011.08.01 22:12:58 | 000,001,078 | R--- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft\Installer\{A725C340-77EE-11D6-BBC2-0000CB591583}\_57566eb2.exe
[2011.08.01 22:12:58 | 000,003,638 | R--- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft\Installer\{A725C340-77EE-11D6-BBC2-0000CB591583}\_575918af.exe
[2010.09.01 14:52:56 | 000,032,032 | ---- | M] (NOS Microsystems Ltd.) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
[2010.09.01 14:52:56 | 000,032,032 | ---- | M] (NOS Microsystems Ltd.) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\extensions\nostmp\content\getPlusPlus_Adobe_reg.exe
[2009.08.19 11:45:27 | 000,390,664 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Real\RealPlayer\setup\AU_setup.exe
[2009.03.10 13:51:17 | 000,390,664 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Real\RealPlayer\setup\AU_setup6.exe
[2009.11.06 13:34:38 | 000,452,104 | ---- | M] (RealNetworks, Inc.) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Real\RealPlayer\setup\AU_setup9.exe
 
< %SYSTEMDRIVE%\*.exe >
[2004.01.31 14:07:21 | 003,731,456 | ---- | M] () -- C:\pm5_demo_g.exe
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
 
< MD5 for: AGP440.SYS  >
[2004.08.04 12:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008.04.14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 12:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.04 12:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 07:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 07:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 12:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: IASTOR.SYS  >
[2008.07.21 00:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\Drivers\KDRV0\IASTOR.SYS
[2008.08.27 23:23:38 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\Drivers\storage\R197541\IaStor.sys
[2008.07.20 17:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2008.07.21 00:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\OEMDIR\IASTOR.SYS
[2008.07.20 17:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\system32\drivers\iaStor.sys
[2008.07.20 17:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\system32\DRVSTORE\iaAHCI_80FADF59B996DEF517513B0713A4AB06CE0D38E2\iaStor.sys
[2008.07.21 00:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\iaStor.sys
[2008.05.07 16:40:02 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Drivers\DRV1\IASTOR.SYS
[2008.07.20 17:44:54 | 000,402,456 | ---- | M] (Intel Corporation) MD5=FC28E90F2204D8FD147FA9BFA8A51C01 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 07:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 07:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 12:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 07:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 07:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.04 12:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[1996.09.05 11:11:00 | 000,044,544 | ---- | M] (Microsoft Corporation) MD5=4B7FB096DB1F6BA08BC5464877E2F410 -- C:\AltePlatte\WINDOWS\SYSTEM\USER32.DLL
[2004.08.04 12:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2008.04.14 07:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll
[2008.04.14 07:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
[1999.05.05 22:22:00 | 000,069,632 | ---- | M] (Microsoft Corporation) MD5=B24A0AAA435674392405C770F2F45268 -- C:\C bis 2003\WINDOWS\SYSTEM\USER32.DLL
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 12:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WININIT.EXE  >
[1999.05.05 22:22:00 | 000,042,181 | ---- | M] () MD5=4B4201A7BE355B0648C10930E0141CA3 -- C:\C bis 2003\WINDOWS\WININIT.EXE
[1996.09.05 11:11:00 | 000,041,009 | ---- | M] () MD5=A4A92D4D2925448769865BF3758E4F89 -- C:\AltePlatte\WINDOWS\WININIT.EXE
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 12:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 12:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004.08.04 12:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.12.04 11:30:09 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2008.12.04 11:30:09 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2008.12.04 11:30:08 | 000,442,368 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
<          >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 88 bytes -> C:\Dokumente und Einstellungen\Administrator\Desktop\Lars 5.50.pif:SummaryInformation

< End of report >
--- --- ---


Beste Grüße
fn

cosinus 14.01.2012 16:18
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
FF - prefs.js..browser.search.defaultenginename: "Searchqu Web Search"
FF - prefs.js..browser.search.order.1: "Searchqu Web Search"
FF - prefs.js..browser.search.selectedEngine: "Searchqu Web Search"
FF - prefs.js..browser.search.update: false
FF - prefs.js..keyword.URL: "http://www.searchqu.com/web?src=ffb&appid=0&systemid=412&sr=0&q="
[2009.10.13 09:24:59 | 000,002,172 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\searchplugins\bing.xml
[2008.12.16 12:22:12 | 000,000,878 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\searchplugins\conduit.xml
[2011.12.21 15:21:20 | 000,002,520 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\searchplugins\SearchResults.xml
[2010.02.22 12:27:14 | 000,001,589 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\searchplugins\web-search.xml
[2012.01.11 11:06:51 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.01.11 11:06:51 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.11 11:06:51 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.12.21 15:21:20 | 000,002,520 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\SearchResults.xml
CHR - default_search_provider: Searchqu Web Search (Enabled)
CHR - default_search_provider: search_url = http://www.searchqu.com/web?src=ffb&appid=0&systemid=412&sr=0&q={searchTerms}
CHR - default_search_provider: suggest_url = http://www.searchqu.com/suggest.php?qu={searchTerms}&ft=json&src=ffb&appid=0&systemid=412&sr=0
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.12.04 10:38:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011.07.27 14:21:24 | 000,000,000 | ---D | M] - D:\Autobiographie -- [ NTFS ]
O32 - AutoRun File - [2011.07.27 14:21:24 | 000,000,000 | ---D | M] - D:\Autorenbio -- [ NTFS ]
O33 - MountPoints2\##soft01#lizenzen#office11\Shell - "" = AutoRun
O33 - MountPoints2\##soft01#lizenzen#office11\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\##soft01#lizenzen#office11\Shell\AutoRun\command - "" = S:\SETUP.EXE /AUTORUN
O33 - MountPoints2\##soft01#lizenzen#office11\Shell\configure\command - "" = S:\SETUP.EXE
O33 - MountPoints2\##soft01#lizenzen#office11\Shell\install\command - "" = S:\SETUP.EXE
O33 - MountPoints2\{3267cf02-1582-11df-9611-0024e840b8b3}\Shell - "" = AutoRun
O33 - MountPoints2\{3267cf02-1582-11df-9611-0024e840b8b3}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3267cf02-1582-11df-9611-0024e840b8b3}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

fuchsneu 16.01.2012 12:04
Lieber Arne,
hat etwas gedauert, da sich McAfee nur höchst mühsam ausschalten ließ.

Hab den Fix durchgeführt, die Log-Datei zwar vorher in den Zwischenspeicher gegeben, nach dem Neustart war sie aber weg...
Soll ich einen neuen Scan durchführen?
In Firefox ist jetzt searchqu verschwunden, statt dessen gibts an der gleichen Stelle eine "Amazon"-Such-Symbolleiste.
Beste Grüße
nf

fuchsneu 16.01.2012 12:22
Lieber Arne,
sorry, log-File nach OTL-Start wieder aufgetaucht.
Code:
All processes killed
========== OTL ==========
Prefs.js: "Searchqu Web Search" removed from browser.search.defaultenginename
Prefs.js: "Searchqu Web Search" removed from browser.search.order.1
Prefs.js: "Searchqu Web Search" removed from browser.search.selectedEngine
Prefs.js: false removed from browser.search.update
Prefs.js: "hxxp://www.searchqu.com/web?src=ffb&appid=0&systemid=412&sr=0&q=" removed from keyword.URL
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\searchplugins\bing.xml moved successfully.
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\searchplugins\conduit.xml moved successfully.
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\searchplugins\SearchResults.xml moved successfully.
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\searchplugins\web-search.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\bing.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\SearchResults.xml moved successfully.
Unable to fix default_search_provider items.
Unable to fix default_search_provider items.
Unable to fix default_search_provider items.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
File  not found.
File  not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##soft01#lizenzen#office11\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##soft01#lizenzen#office11\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##soft01#lizenzen#office11\ not found.
File S:\SETUP.EXE /AUTORUN not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##soft01#lizenzen#office11\ not found.
File S:\SETUP.EXE not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##soft01#lizenzen#office11\ not found.
File S:\SETUP.EXE not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3267cf02-1582-11df-9611-0024e840b8b3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3267cf02-1582-11df-9611-0024e840b8b3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3267cf02-1582-11df-9611-0024e840b8b3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3267cf02-1582-11df-9611-0024e840b8b3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3267cf02-1582-11df-9611-0024e840b8b3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3267cf02-1582-11df-9611-0024e840b8b3}\ not found.
File G:\LaunchU3.exe -a not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 414769433 bytes
->Temporary Internet Files folder emptied: 12024697 bytes
->Java cache emptied: 28736386 bytes
->FireFox cache emptied: 76607070 bytes
->Google Chrome cache emptied: 10873888 bytes
->Flash cache emptied: 77979 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
%systemdrive% .tmp files removed: 4 bytes
%systemroot% .tmp files removed: 2134333 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 8258360 bytes
RecycleBin emptied: 812680261 bytes
 
Total Files Cleaned = 1.303,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.31.0 log created on 01162012_115443

Files\Folders moved on Reboot...
C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\WCESLog.log moved successfully.

Registry entries deleted on Reboot...
Beste Grüße
fn

cosinus 16.01.2012 14:32
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

fuchsneu 16.01.2012 14:49
Lieber Arne,
log-File von
Code:
14:45:37.0531 3440        TDSS rootkit removing tool 2.7.2.0 Jan 14 2012 20:07:30
14:45:37.0609 3440        ============================================================
14:45:37.0609 3440        Current date / time: 2012/01/16 14:45:37.0609
14:45:37.0609 3440        SystemInfo:
14:45:37.0609 3440       
14:45:37.0609 3440        OS Version: 5.1.2600 ServicePack: 3.0
14:45:37.0609 3440        Product type: Workstation
14:45:37.0609 3440        ComputerName: 09-PF681
14:45:37.0609 3440        UserName: Administrator
14:45:37.0609 3440        Windows directory: C:\WINDOWS
14:45:37.0609 3440        System windows directory: C:\WINDOWS
14:45:37.0609 3440        Processor architecture: Intel x86
14:45:37.0609 3440        Number of processors: 2
14:45:37.0609 3440        Page size: 0x1000
14:45:37.0609 3440        Boot type: Normal boot
14:45:37.0609 3440        ============================================================
14:45:38.0718 3440        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000, SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000054
14:45:38.0734 3440        Drive \Device\Harddisk1\DR1 - Size: 0x4A85D56000, SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000054
14:45:38.0750 3440        Drive \Device\Harddisk2\DR7 - Size: 0xE8E0DB6000, SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
14:45:39.0281 3440        Initialize success
14:45:41.0796 3172        ============================================================
14:45:41.0796 3172        Scan started
14:45:41.0796 3172        Mode: Manual;
14:45:41.0796 3172        ============================================================
14:45:42.0500 3172        Abiosdsk - ok
14:45:42.0515 3172        abp480n5 - ok
14:45:42.0562 3172        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
14:45:42.0562 3172        ACPI - ok
14:45:42.0578 3172        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
14:45:42.0578 3172        ACPIEC - ok
14:45:42.0609 3172        ADIHdAudAddService (d80d1d73d1dbf38d0afe692c8bdc939a) C:\WINDOWS\system32\drivers\ADIHdAud.sys
14:45:42.0609 3172        ADIHdAudAddService - ok
14:45:42.0625 3172        adpu160m - ok
14:45:42.0640 3172        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
14:45:42.0640 3172        aec - ok
14:45:42.0671 3172        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
14:45:42.0671 3172        AFD - ok
14:45:42.0671 3172        Aha154x - ok
14:45:42.0687 3172        aic78u2 - ok
14:45:42.0703 3172        aic78xx - ok
14:45:42.0703 3172        AliIde - ok
14:45:42.0718 3172        amsint - ok
14:45:42.0718 3172        asc - ok
14:45:42.0734 3172        asc3350p - ok
14:45:42.0734 3172        asc3550 - ok
14:45:42.0781 3172        Aspi32          (b979979ab8027f7f53fb16ec4229b7db) C:\WINDOWS\system32\drivers\Aspi32.sys
14:45:42.0781 3172        Aspi32 - ok
14:45:42.0796 3172        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
14:45:42.0796 3172        AsyncMac - ok
14:45:42.0828 3172        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
14:45:42.0828 3172        atapi - ok
14:45:42.0828 3172        Atdisk - ok
14:45:42.0859 3172        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
14:45:42.0859 3172        Atmarpc - ok
14:45:42.0875 3172        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
14:45:42.0875 3172        audstub - ok
14:45:42.0906 3172        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
14:45:42.0906 3172        Beep - ok
14:45:42.0921 3172        BthEnum        (b279426e3c0c344893ed78a613a73bde) C:\WINDOWS\system32\DRIVERS\BthEnum.sys
14:45:42.0921 3172        BthEnum - ok
14:45:42.0937 3172        BTHMODEM        (fca6f069597b62d42495191ace3fc6c1) C:\WINDOWS\system32\DRIVERS\bthmodem.sys
14:45:42.0937 3172        BTHMODEM - ok
14:45:42.0953 3172        BthPan          (80602b8746d3738f5886ce3d67ef06b6) C:\WINDOWS\system32\DRIVERS\bthpan.sys
14:45:42.0953 3172        BthPan - ok
14:45:42.0984 3172        BTHPORT        (592e1cedbe314d0ef184dc6f46141e76) C:\WINDOWS\system32\Drivers\BTHport.sys
14:45:42.0984 3172        BTHPORT - ok
14:45:42.0984 3172        BTHUSB          (61364cd71ef63b0f038b7e9df00f1efa) C:\WINDOWS\system32\Drivers\BTHUSB.sys
14:45:43.0000 3172        BTHUSB - ok
14:45:43.0015 3172        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
14:45:43.0015 3172        cbidf2k - ok
14:45:43.0031 3172        cd20xrnt - ok
14:45:43.0031 3172        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
14:45:43.0031 3172        Cdaudio - ok
14:45:43.0046 3172        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
14:45:43.0046 3172        Cdfs - ok
14:45:43.0062 3172        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
14:45:43.0078 3172        Cdrom - ok
14:45:43.0078 3172        Changer - ok
14:45:43.0093 3172        CmdIde - ok
14:45:43.0093 3172        Cpqarray - ok
14:45:43.0109 3172        dac2w2k - ok
14:45:43.0109 3172        dac960nt - ok
14:45:43.0125 3172        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
14:45:43.0125 3172        Disk - ok
14:45:43.0140 3172        DLABMFSM        (a0500678a33802d8954153839301d539) C:\WINDOWS\system32\Drivers\DLABMFSM.SYS
14:45:43.0140 3172        DLABMFSM - ok
14:45:43.0156 3172        DLABOIOM        (b8d2f68cac54d46281399f9092644794) C:\WINDOWS\system32\Drivers\DLABOIOM.SYS
14:45:43.0156 3172        DLABOIOM - ok
14:45:43.0171 3172        DLACDBHM        (0ee93ab799d1cb4ec90b36f3612fe907) C:\WINDOWS\system32\Drivers\DLACDBHM.SYS
14:45:43.0171 3172        DLACDBHM - ok
14:45:43.0171 3172        DLADResM        (f8b70d38845c4694b28adc4768676fd0) C:\WINDOWS\system32\Drivers\DLADResM.SYS
14:45:43.0171 3172        DLADResM - ok
14:45:43.0187 3172        DLAIFS_M        (766a148235be1c0039c974446e4c0edc) C:\WINDOWS\system32\Drivers\DLAIFS_M.SYS
14:45:43.0187 3172        DLAIFS_M - ok
14:45:43.0187 3172        DLAOPIOM        (38267cca177354f1c64450a43a4f7627) C:\WINDOWS\system32\Drivers\DLAOPIOM.SYS
14:45:43.0187 3172        DLAOPIOM - ok
14:45:43.0203 3172        DLAPoolM        (fd363369fd313b46b5aeab1a688b52e9) C:\WINDOWS\system32\Drivers\DLAPoolM.SYS
14:45:43.0203 3172        DLAPoolM - ok
14:45:43.0203 3172        DLARTL_M        (336ae18f0912ef4fbe5518849e004d74) C:\WINDOWS\system32\Drivers\DLARTL_M.SYS
14:45:43.0203 3172        DLARTL_M - ok
14:45:43.0234 3172        DLAUDFAM        (fd85f682c1cc2a7ca878c7a448e6d87e) C:\WINDOWS\system32\Drivers\DLAUDFAM.SYS
14:45:43.0234 3172        DLAUDFAM - ok
14:45:43.0234 3172        DLAUDF_M        (af389ce587b6bf5bbdcd6f6abe5eabc0) C:\WINDOWS\system32\Drivers\DLAUDF_M.SYS
14:45:43.0234 3172        DLAUDF_M - ok
14:45:43.0265 3172        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
14:45:43.0281 3172        dmboot - ok
14:45:43.0296 3172        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
14:45:43.0296 3172        dmio - ok
14:45:43.0296 3172        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
14:45:43.0296 3172        dmload - ok
14:45:43.0312 3172        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
14:45:43.0312 3172        DMusic - ok
14:45:43.0328 3172        dpti2o - ok
14:45:43.0343 3172        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
14:45:43.0343 3172        drmkaud - ok
14:45:43.0343 3172        DRVMCDB        (5d3b71bb2bb0009d65d290e2ef374bd3) C:\WINDOWS\system32\Drivers\DRVMCDB.SYS
14:45:43.0343 3172        DRVMCDB - ok
14:45:43.0359 3172        DRVNDDM        (c591ba9f96f40a1fd6494dafdcd17185) C:\WINDOWS\system32\Drivers\DRVNDDM.SYS
14:45:43.0359 3172        DRVNDDM - ok
14:45:43.0375 3172        e1kexpress      (d60759140694150360bbefd9cab7c920) C:\WINDOWS\system32\DRIVERS\e1k5132.sys
14:45:43.0375 3172        e1kexpress - ok
14:45:43.0390 3172        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
14:45:43.0390 3172        Fastfat - ok
14:45:43.0406 3172        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
14:45:43.0406 3172        Fdc - ok
14:45:43.0421 3172        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
14:45:43.0421 3172        Fips - ok
14:45:43.0421 3172        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
14:45:43.0437 3172        Flpydisk - ok
14:45:43.0437 3172        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
14:45:43.0437 3172        FltMgr - ok
14:45:43.0453 3172        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
14:45:43.0453 3172        Fs_Rec - ok
14:45:43.0468 3172        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
14:45:43.0468 3172        Ftdisk - ok
14:45:43.0484 3172        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
14:45:43.0484 3172        Gpc - ok
14:45:43.0500 3172        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
14:45:43.0500 3172        HDAudBus - ok
14:45:43.0515 3172        HECI            (e4a123ad734a3731d29ebd3a01b3e535) C:\WINDOWS\system32\DRIVERS\HECI.sys
14:45:43.0515 3172        HECI - ok
14:45:43.0531 3172        hidusb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
14:45:43.0531 3172        hidusb - ok
14:45:43.0546 3172        hpn - ok
14:45:43.0562 3172        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
14:45:43.0578 3172        HTTP - ok
14:45:43.0578 3172        i2omgmt - ok
14:45:43.0593 3172        i2omp - ok
14:45:43.0609 3172        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
14:45:43.0609 3172        i8042prt - ok
14:45:43.0718 3172        ialm            (2da364ee62d4949620b6fae4ffea16a7) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
14:45:43.0796 3172        ialm - ok
14:45:43.0828 3172        iaStor          (707c1692214b1c290271067197f075f6) C:\WINDOWS\system32\DRIVERS\iaStor.sys
14:45:43.0828 3172        iaStor - ok
14:45:43.0843 3172        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
14:45:43.0843 3172        Imapi - ok
14:45:43.0859 3172        ini910u - ok
14:45:43.0875 3172        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
14:45:43.0875 3172        IntelIde - ok
14:45:43.0890 3172        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
14:45:43.0890 3172        intelppm - ok
14:45:43.0906 3172        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
14:45:43.0906 3172        Ip6Fw - ok
14:45:43.0921 3172        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
14:45:43.0921 3172        IpFilterDriver - ok
14:45:43.0937 3172        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
14:45:43.0937 3172        IpInIp - ok
14:45:43.0953 3172        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
14:45:43.0968 3172        IpNat - ok
14:45:43.0968 3172        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
14:45:43.0984 3172        IPSec - ok
14:45:43.0984 3172        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
14:45:44.0000 3172        IRENUM - ok
14:45:44.0000 3172        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
14:45:44.0000 3172        isapnp - ok
14:45:44.0015 3172        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
14:45:44.0015 3172        Kbdclass - ok
14:45:44.0031 3172        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
14:45:44.0031 3172        kbdhid - ok
14:45:44.0046 3172        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
14:45:44.0046 3172        kmixer - ok
14:45:44.0062 3172        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
14:45:44.0062 3172        KSecDD - ok
14:45:44.0078 3172        Lbd            (a5304ad519c34105f4b7049b136cc171) C:\WINDOWS\system32\DRIVERS\Lbd.sys
14:45:44.0078 3172        Lbd - ok
14:45:44.0093 3172        lbrtfdc - ok
14:45:44.0125 3172        mfeapfk        (af3baf4cded14d5fd7b8d94b78ae3f0a) C:\WINDOWS\system32\drivers\mfeapfk.sys
14:45:44.0125 3172        mfeapfk - ok
14:45:44.0140 3172        mfeavfk        (2ebf8d78f99e2f667fa5f65312a489ab) C:\WINDOWS\system32\drivers\mfeavfk.sys
14:45:44.0140 3172        mfeavfk - ok
14:45:44.0156 3172        mfebopk        (188324d4412103ed3b086b69d5d210e2) C:\WINDOWS\system32\drivers\mfebopk.sys
14:45:44.0156 3172        mfebopk - ok
14:45:44.0156 3172        mfehidk        (51897a0530ea0531898abbe566a9dd8a) C:\WINDOWS\system32\drivers\mfehidk.sys
14:45:44.0171 3172        mfehidk - ok
14:45:44.0187 3172        mferkdet        (192c71ea9990426372e1b803dbad2c59) C:\WINDOWS\system32\drivers\mferkdet.sys
14:45:44.0187 3172        mferkdet - ok
14:45:44.0187 3172        mfetdik        (61fc4dbe4a3e95973509da6b920e83aa) C:\WINDOWS\system32\drivers\mfetdik.sys
14:45:44.0187 3172        mfetdik - ok
14:45:44.0218 3172        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
14:45:44.0218 3172        mnmdd - ok
14:45:44.0234 3172        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
14:45:44.0234 3172        Modem - ok
14:45:44.0265 3172        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
14:45:44.0265 3172        Mouclass - ok
14:45:44.0296 3172        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
14:45:44.0296 3172        mouhid - ok
14:45:44.0296 3172        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
14:45:44.0296 3172        MountMgr - ok
14:45:44.0312 3172        mraid35x - ok
14:45:44.0343 3172        MRxDAV          (e3f17e1ea5256709d4e97ef0da04b3c9) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
14:45:44.0343 3172        MRxDAV - ok
14:45:44.0375 3172        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
14:45:44.0375 3172        MRxSmb - ok
14:45:44.0390 3172        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
14:45:44.0390 3172        Msfs - ok
14:45:44.0406 3172        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
14:45:44.0406 3172        MSKSSRV - ok
14:45:44.0421 3172        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
14:45:44.0421 3172        MSPCLOCK - ok
14:45:44.0421 3172        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
14:45:44.0421 3172        MSPQM - ok
14:45:44.0453 3172        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
14:45:44.0453 3172        mssmbios - ok
14:45:44.0468 3172        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
14:45:44.0468 3172        Mup - ok
14:45:44.0484 3172        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
14:45:44.0484 3172        NDIS - ok
14:45:44.0500 3172        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
14:45:44.0500 3172        NdisTapi - ok
14:45:44.0515 3172        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
14:45:44.0515 3172        Ndisuio - ok
14:45:44.0531 3172        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
14:45:44.0531 3172        NdisWan - ok
14:45:44.0546 3172        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
14:45:44.0546 3172        NDProxy - ok
14:45:44.0546 3172        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
14:45:44.0546 3172        NetBIOS - ok
14:45:44.0562 3172        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
14:45:44.0562 3172        NetBT - ok
14:45:44.0609 3172        nmwcd          (cfe3462a9e94a57dcd9676f6b7fe7f67) C:\WINDOWS\system32\drivers\ccdcmb.sys
14:45:44.0609 3172        nmwcd - ok
14:45:44.0609 3172        nmwcdc          (8f2a94f991f8c73cec26b4b5620d1edc) C:\WINDOWS\system32\drivers\ccdcmbo.sys
14:45:44.0609 3172        nmwcdc - ok
14:45:44.0625 3172        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
14:45:44.0625 3172        Npfs - ok
14:45:44.0656 3172        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
14:45:44.0656 3172        Ntfs - ok
14:45:44.0703 3172        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
14:45:44.0703 3172        Null - ok
14:45:44.0718 3172        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
14:45:44.0718 3172        NwlnkFlt - ok
14:45:44.0734 3172        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
14:45:44.0734 3172        NwlnkFwd - ok
14:45:44.0750 3172        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
14:45:44.0750 3172        Parport - ok
14:45:44.0765 3172        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
14:45:44.0765 3172        PartMgr - ok
14:45:44.0765 3172        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
14:45:44.0765 3172        ParVdm - ok
14:45:44.0796 3172        pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
14:45:44.0796 3172        pccsmcfd - ok
14:45:44.0812 3172        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
14:45:44.0812 3172        PCI - ok
14:45:44.0812 3172        PCIDump - ok
14:45:44.0828 3172        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
14:45:44.0828 3172        PCIIde - ok
14:45:44.0859 3172        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
14:45:44.0859 3172        Pcmcia - ok
14:45:44.0859 3172        PDCOMP - ok
14:45:44.0875 3172        PDFRAME - ok
14:45:44.0875 3172        PDRELI - ok
14:45:44.0890 3172        PDRFRAME - ok
14:45:44.0890 3172        perc2 - ok
14:45:44.0906 3172        perc2hib - ok
14:45:44.0937 3172        Point32        (273afc65fabf97326aa78ffe38b1e071) C:\WINDOWS\system32\DRIVERS\point32.sys
14:45:44.0937 3172        Point32 - ok
14:45:44.0953 3172        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
14:45:44.0953 3172        PptpMiniport - ok
14:45:44.0953 3172        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
14:45:44.0953 3172        PSched - ok
14:45:44.0968 3172        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
14:45:44.0968 3172        Ptilink - ok
14:45:44.0984 3172        PxHelp20        (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
14:45:44.0984 3172        PxHelp20 - ok
14:45:45.0000 3172        ql1080 - ok
14:45:45.0015 3172        Ql10wnt - ok
14:45:45.0015 3172        ql12160 - ok
14:45:45.0031 3172        ql1240 - ok
14:45:45.0031 3172        ql1280 - ok
14:45:45.0062 3172        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
14:45:45.0062 3172        RasAcd - ok
14:45:45.0062 3172        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
14:45:45.0062 3172        Rasl2tp - ok
14:45:45.0078 3172        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
14:45:45.0078 3172        RasPppoe - ok
14:45:45.0093 3172        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
14:45:45.0093 3172        Raspti - ok
14:45:45.0093 3172        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
14:45:45.0093 3172        Rdbss - ok
14:45:45.0109 3172        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
14:45:45.0109 3172        RDPCDD - ok
14:45:45.0125 3172        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
14:45:45.0125 3172        rdpdr - ok
14:45:45.0156 3172        RDPWD          (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
14:45:45.0156 3172        RDPWD - ok
14:45:45.0156 3172        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
14:45:45.0156 3172        redbook - ok
14:45:45.0203 3172        RFCOMM          (851c30df2807fcfa21e4c681a7d6440e) C:\WINDOWS\system32\DRIVERS\rfcomm.sys
14:45:45.0203 3172        RFCOMM - ok
14:45:45.0390 3172        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
14:45:45.0406 3172        Secdrv - ok
14:45:45.0484 3172        serenum        (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
14:45:45.0500 3172        serenum - ok
14:45:45.0515 3172        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
14:45:45.0515 3172        Serial - ok
14:45:45.0546 3172        SFAUDIO        (b6401608579b6431994425ba7653f774) C:\WINDOWS\system32\drivers\sfaudio.sys
14:45:45.0546 3172        SFAUDIO - ok
14:45:45.0562 3172        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
14:45:45.0562 3172        Sfloppy - ok
14:45:45.0578 3172        Simbad - ok
14:45:45.0578 3172        Sparrow - ok
14:45:45.0593 3172        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
14:45:45.0593 3172        splitter - ok
14:45:45.0609 3172        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
14:45:45.0609 3172        sr - ok
14:45:45.0640 3172        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
14:45:45.0640 3172        Srv - ok
14:45:45.0656 3172        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
14:45:45.0656 3172        swenum - ok
14:45:45.0671 3172        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
14:45:45.0671 3172        swmidi - ok
14:45:45.0687 3172        symc810 - ok
14:45:45.0703 3172        symc8xx - ok
14:45:45.0703 3172        sym_hi - ok
14:45:45.0718 3172        sym_u3 - ok
14:45:45.0718 3172        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
14:45:45.0718 3172        sysaudio - ok
14:45:45.0765 3172        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
14:45:45.0765 3172        Tcpip - ok
14:45:45.0765 3172        TDIMSYS - ok
14:45:45.0781 3172        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
14:45:45.0781 3172        TDPIPE - ok
14:45:45.0796 3172        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
14:45:45.0796 3172        TDTCP - ok
14:45:45.0812 3172        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
14:45:45.0812 3172        TermDD - ok
14:45:45.0828 3172        TosIde - ok
14:45:45.0859 3172        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
14:45:45.0859 3172        Udfs - ok
14:45:45.0859 3172        ultra - ok
14:45:45.0921 3172        UnlockerDriver5 (f365fa561c3ab455d8685770d208691a) C:\Programme\Unlocker\UnlockerDriver5.sys
14:45:45.0921 3172        UnlockerDriver5 - ok
14:45:45.0937 3172        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
14:45:45.0953 3172        Update - ok
14:45:45.0984 3172        upperdev        (ec01da44b090d2651fc032c8b9257232) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
14:45:45.0984 3172        upperdev - ok
14:45:46.0000 3172        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
14:45:46.0000 3172        usbccgp - ok
14:45:46.0015 3172        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
14:45:46.0015 3172        usbehci - ok
14:45:46.0031 3172        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
14:45:46.0046 3172        usbhub - ok
14:45:46.0078 3172        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
14:45:46.0078 3172        usbscan - ok
14:45:46.0093 3172        usbser          (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
14:45:46.0093 3172        usbser - ok
14:45:46.0109 3172        UsbserFilt      (4abd37cfbd710e64f01f9da8710c73f7) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
14:45:46.0109 3172        UsbserFilt - ok
14:45:46.0125 3172        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
14:45:46.0125 3172        USBSTOR - ok
14:45:46.0140 3172        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
14:45:46.0140 3172        usbuhci - ok
14:45:46.0140 3172        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
14:45:46.0140 3172        VgaSave - ok
14:45:46.0156 3172        ViaIde - ok
14:45:46.0171 3172        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
14:45:46.0171 3172        VolSnap - ok
14:45:46.0203 3172        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
14:45:46.0203 3172        Wanarp - ok
14:45:46.0218 3172        wceusbsh        (4a954a20a4c73d6db13c0fe25f3f1b0c) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
14:45:46.0218 3172        wceusbsh - ok
14:45:46.0265 3172        Wdf01000        (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
14:45:46.0265 3172        Wdf01000 - ok
14:45:46.0265 3172        WDICA - ok
14:45:46.0296 3172        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
14:45:46.0296 3172        wdmaud - ok
14:45:46.0328 3172        WmiAcpi        (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
14:45:46.0328 3172        WmiAcpi - ok
14:45:46.0375 3172        WudfPf          (eaa6324f51214d2f6718977ec9ce0def) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
14:45:46.0375 3172        WudfPf - ok
14:45:46.0390 3172        WudfRd          (f91ff1e51fca30b3c3981db7d5924252) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
14:45:46.0390 3172        WudfRd - ok
14:45:46.0421 3172        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
14:45:46.0578 3172        \Device\Harddisk0\DR0 - ok
14:45:46.0609 3172        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1
14:45:46.0609 3172        \Device\Harddisk1\DR1 - ok
14:45:46.0625 3172        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk2\DR7
14:45:46.0625 3172        \Device\Harddisk2\DR7 - ok
14:45:46.0625 3172        Boot (0x1200)  (ebcc8f7862f2302fa9e82a1d2efeebed) \Device\Harddisk0\DR0\Partition0
14:45:46.0625 3172        \Device\Harddisk0\DR0\Partition0 - ok
14:45:46.0640 3172        Boot (0x1200)  (dafd7e861e88eb7ba0b8b1aa5fb06736) \Device\Harddisk0\DR0\Partition1
14:45:46.0640 3172        \Device\Harddisk0\DR0\Partition1 - ok
14:45:46.0656 3172        Boot (0x1200)  (61805c5e89696959a12fc220002a1227) \Device\Harddisk0\DR0\Partition2
14:45:46.0656 3172        \Device\Harddisk0\DR0\Partition2 - ok
14:45:46.0656 3172        Boot (0x1200)  (1b1c7393d501ad57c519df9255df1ff8) \Device\Harddisk1\DR1\Partition0
14:45:46.0656 3172        \Device\Harddisk1\DR1\Partition0 - ok
14:45:46.0656 3172        Boot (0x1200)  (3eac0406837fef19fd09dc9d74e290a4) \Device\Harddisk2\DR7\Partition0
14:45:46.0671 3172        \Device\Harddisk2\DR7\Partition0 - ok
14:45:46.0671 3172        ============================================================
14:45:46.0671 3172        Scan finished
14:45:46.0671 3172        ============================================================
14:45:46.0671 2088        Detected object count: 0
14:45:46.0671 2088        Actual detected object count: 0
14:46:03.0312 1876        ============================================================
14:46:03.0312 1876        Scan started
14:46:03.0312 1876        Mode: Manual; SigCheck; TDLFS;
14:46:03.0312 1876        ============================================================
14:46:04.0015 1876        Abiosdsk - ok
14:46:04.0015 1876        abp480n5 - ok
14:46:04.0031 1876        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
14:46:05.0125 1876        ACPI - ok
14:46:05.0171 1876        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
14:46:05.0265 1876        ACPIEC - ok
14:46:05.0296 1876        ADIHdAudAddService (d80d1d73d1dbf38d0afe692c8bdc939a) C:\WINDOWS\system32\drivers\ADIHdAud.sys
14:46:05.0343 1876        ADIHdAudAddService - ok
14:46:05.0343 1876        adpu160m - ok
14:46:05.0375 1876        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
14:46:05.0453 1876        aec - ok
14:46:05.0484 1876        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
14:46:05.0515 1876        AFD - ok
14:46:05.0515 1876        Aha154x - ok
14:46:05.0531 1876        aic78u2 - ok
14:46:05.0531 1876        aic78xx - ok
14:46:05.0546 1876        AliIde - ok
14:46:05.0546 1876        amsint - ok
14:46:05.0562 1876        asc - ok
14:46:05.0562 1876        asc3350p - ok
14:46:05.0562 1876        asc3550 - ok
14:46:05.0609 1876        Aspi32          (b979979ab8027f7f53fb16ec4229b7db) C:\WINDOWS\system32\drivers\Aspi32.sys
14:46:05.0625 1876        Aspi32 ( UnsignedFile.Multi.Generic ) - warning
14:46:05.0625 1876        Aspi32 - detected UnsignedFile.Multi.Generic (1)
14:46:05.0640 1876        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
14:46:05.0703 1876        AsyncMac - ok
14:46:05.0734 1876        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
14:46:05.0812 1876        atapi - ok
14:46:05.0812 1876        Atdisk - ok
14:46:05.0843 1876        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
14:46:05.0906 1876        Atmarpc - ok
14:46:05.0937 1876        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
14:46:05.0984 1876        audstub - ok
14:46:06.0031 1876        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
14:46:06.0093 1876        Beep - ok
14:46:06.0093 1876        BthEnum        (b279426e3c0c344893ed78a613a73bde) C:\WINDOWS\system32\DRIVERS\BthEnum.sys
14:46:06.0156 1876        BthEnum - ok
14:46:06.0187 1876        BTHMODEM        (fca6f069597b62d42495191ace3fc6c1) C:\WINDOWS\system32\DRIVERS\bthmodem.sys
14:46:06.0250 1876        BTHMODEM - ok
14:46:06.0250 1876        BthPan          (80602b8746d3738f5886ce3d67ef06b6) C:\WINDOWS\system32\DRIVERS\bthpan.sys
14:46:06.0328 1876        BthPan - ok
14:46:06.0359 1876        BTHPORT        (592e1cedbe314d0ef184dc6f46141e76) C:\WINDOWS\system32\Drivers\BTHport.sys
14:46:06.0390 1876        BTHPORT - ok
14:46:06.0406 1876        BTHUSB          (61364cd71ef63b0f038b7e9df00f1efa) C:\WINDOWS\system32\Drivers\BTHUSB.sys
14:46:06.0468 1876        BTHUSB - ok
14:46:06.0500 1876        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
14:46:06.0562 1876        cbidf2k - ok
14:46:06.0562 1876        cd20xrnt - ok
14:46:06.0578 1876        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
14:46:06.0640 1876        Cdaudio - ok
14:46:06.0656 1876        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
14:46:06.0718 1876        Cdfs - ok
14:46:06.0734 1876        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
14:46:06.0796 1876        Cdrom - ok
14:46:06.0796 1876        Changer - ok
14:46:06.0812 1876        CmdIde - ok
14:46:06.0828 1876        Cpqarray - ok
14:46:06.0828 1876        dac2w2k - ok
14:46:06.0843 1876        dac960nt - ok
14:46:06.0843 1876        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
14:46:06.0921 1876        Disk - ok
14:46:06.0937 1876        DLABMFSM        (a0500678a33802d8954153839301d539) C:\WINDOWS\system32\Drivers\DLABMFSM.SYS
14:46:06.0953 1876        DLABMFSM - ok
14:46:06.0984 1876        DLABOIOM        (b8d2f68cac54d46281399f9092644794) C:\WINDOWS\system32\Drivers\DLABOIOM.SYS
14:46:06.0984 1876        DLABOIOM - ok
14:46:07.0000 1876        DLACDBHM        (0ee93ab799d1cb4ec90b36f3612fe907) C:\WINDOWS\system32\Drivers\DLACDBHM.SYS
14:46:07.0000 1876        DLACDBHM - ok
14:46:07.0015 1876        DLADResM        (f8b70d38845c4694b28adc4768676fd0) C:\WINDOWS\system32\Drivers\DLADResM.SYS
14:46:07.0015 1876        DLADResM - ok
14:46:07.0031 1876        DLAIFS_M        (766a148235be1c0039c974446e4c0edc) C:\WINDOWS\system32\Drivers\DLAIFS_M.SYS
14:46:07.0031 1876        DLAIFS_M - ok
14:46:07.0046 1876        DLAOPIOM        (38267cca177354f1c64450a43a4f7627) C:\WINDOWS\system32\Drivers\DLAOPIOM.SYS
14:46:07.0046 1876        DLAOPIOM - ok
14:46:07.0062 1876        DLAPoolM        (fd363369fd313b46b5aeab1a688b52e9) C:\WINDOWS\system32\Drivers\DLAPoolM.SYS
14:46:07.0062 1876        DLAPoolM - ok
14:46:07.0078 1876        DLARTL_M        (336ae18f0912ef4fbe5518849e004d74) C:\WINDOWS\system32\Drivers\DLARTL_M.SYS
14:46:07.0078 1876        DLARTL_M - ok
14:46:07.0093 1876        DLAUDFAM        (fd85f682c1cc2a7ca878c7a448e6d87e) C:\WINDOWS\system32\Drivers\DLAUDFAM.SYS
14:46:07.0093 1876        DLAUDFAM - ok
14:46:07.0109 1876        DLAUDF_M        (af389ce587b6bf5bbdcd6f6abe5eabc0) C:\WINDOWS\system32\Drivers\DLAUDF_M.SYS
14:46:07.0109 1876        DLAUDF_M - ok
14:46:07.0140 1876        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
14:46:07.0218 1876        dmboot - ok
14:46:07.0218 1876        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
14:46:07.0296 1876        dmio - ok
14:46:07.0312 1876        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
14:46:07.0375 1876        dmload - ok
14:46:07.0390 1876        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
14:46:07.0453 1876        DMusic - ok
14:46:07.0468 1876        dpti2o - ok
14:46:07.0484 1876        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
14:46:07.0562 1876        drmkaud - ok
14:46:07.0578 1876        DRVMCDB        (5d3b71bb2bb0009d65d290e2ef374bd3) C:\WINDOWS\system32\Drivers\DRVMCDB.SYS
14:46:07.0578 1876        DRVMCDB - ok
14:46:07.0593 1876        DRVNDDM        (c591ba9f96f40a1fd6494dafdcd17185) C:\WINDOWS\system32\Drivers\DRVNDDM.SYS
14:46:07.0593 1876        DRVNDDM - ok
14:46:07.0609 1876        e1kexpress      (d60759140694150360bbefd9cab7c920) C:\WINDOWS\system32\DRIVERS\e1k5132.sys
14:46:07.0625 1876        e1kexpress - ok
14:46:07.0640 1876        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
14:46:07.0703 1876        Fastfat - ok
14:46:07.0718 1876        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
14:46:07.0781 1876        Fdc - ok
14:46:07.0796 1876        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
14:46:07.0859 1876        Fips - ok
14:46:07.0875 1876        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
14:46:07.0937 1876        Flpydisk - ok
14:46:07.0937 1876        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
14:46:08.0140 1876        FltMgr - ok
14:46:08.0156 1876        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
14:46:08.0234 1876        Fs_Rec - ok
14:46:08.0234 1876        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
14:46:08.0296 1876        Ftdisk - ok
14:46:08.0328 1876        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
14:46:08.0390 1876        Gpc - ok
14:46:08.0406 1876        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
14:46:08.0484 1876        HDAudBus - ok
14:46:08.0500 1876        HECI            (e4a123ad734a3731d29ebd3a01b3e535) C:\WINDOWS\system32\DRIVERS\HECI.sys
14:46:08.0531 1876        HECI - ok
14:46:08.0546 1876        hidusb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
14:46:08.0609 1876        hidusb - ok
14:46:08.0609 1876        hpn - ok
14:46:08.0640 1876        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
14:46:08.0687 1876        HTTP - ok
14:46:08.0687 1876        i2omgmt - ok
14:46:08.0703 1876        i2omp - ok
14:46:08.0734 1876        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
14:46:08.0796 1876        i8042prt - ok
14:46:08.0921 1876        ialm            (2da364ee62d4949620b6fae4ffea16a7) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
14:46:09.0031 1876        ialm - ok
14:46:09.0062 1876        iaStor          (707c1692214b1c290271067197f075f6) C:\WINDOWS\system32\DRIVERS\iaStor.sys
14:46:09.0078 1876        iaStor - ok
14:46:09.0093 1876        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
14:46:09.0171 1876        Imapi - ok
14:46:09.0171 1876        ini910u - ok
14:46:09.0187 1876        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
14:46:09.0250 1876        IntelIde - ok
14:46:09.0265 1876        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
14:46:09.0328 1876        intelppm - ok
14:46:09.0328 1876        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
14:46:09.0406 1876        Ip6Fw - ok
14:46:09.0421 1876        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
14:46:09.0484 1876        IpFilterDriver - ok
14:46:09.0500 1876        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
14:46:09.0562 1876        IpInIp - ok
14:46:09.0593 1876        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
14:46:09.0671 1876        IpNat - ok
14:46:09.0687 1876        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
14:46:09.0765 1876        IPSec - ok
14:46:09.0781 1876        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
14:46:09.0843 1876        IRENUM - ok
14:46:09.0859 1876        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
14:46:09.0921 1876        isapnp - ok
14:46:09.0921 1876        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
14:46:09.0984 1876        Kbdclass - ok
14:46:10.0000 1876        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
14:46:10.0062 1876        kbdhid - ok
14:46:10.0093 1876        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
14:46:10.0171 1876        kmixer - ok
14:46:10.0187 1876        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
14:46:10.0234 1876        KSecDD - ok
14:46:10.0250 1876        Lbd            (a5304ad519c34105f4b7049b136cc171) C:\WINDOWS\system32\DRIVERS\Lbd.sys
14:46:10.0250 1876        Lbd - ok
14:46:10.0265 1876        lbrtfdc - ok
14:46:10.0296 1876        mfeapfk        (af3baf4cded14d5fd7b8d94b78ae3f0a) C:\WINDOWS\system32\drivers\mfeapfk.sys
14:46:10.0296 1876        mfeapfk - ok
14:46:10.0312 1876        mfeavfk        (2ebf8d78f99e2f667fa5f65312a489ab) C:\WINDOWS\system32\drivers\mfeavfk.sys
14:46:10.0328 1876        mfeavfk - ok
14:46:10.0328 1876        mfebopk        (188324d4412103ed3b086b69d5d210e2) C:\WINDOWS\system32\drivers\mfebopk.sys
14:46:10.0343 1876        mfebopk - ok
14:46:10.0359 1876        mfehidk        (51897a0530ea0531898abbe566a9dd8a) C:\WINDOWS\system32\drivers\mfehidk.sys
14:46:10.0359 1876        mfehidk - ok
14:46:10.0390 1876        mferkdet        (192c71ea9990426372e1b803dbad2c59) C:\WINDOWS\system32\drivers\mferkdet.sys
14:46:10.0390 1876        mferkdet - ok
14:46:10.0406 1876        mfetdik        (61fc4dbe4a3e95973509da6b920e83aa) C:\WINDOWS\system32\drivers\mfetdik.sys
14:46:10.0406 1876        mfetdik - ok
14:46:10.0437 1876        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
14:46:10.0515 1876        mnmdd - ok
14:46:10.0531 1876        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
14:46:10.0609 1876        Modem - ok
14:46:10.0640 1876        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
14:46:10.0703 1876        Mouclass - ok
14:46:10.0718 1876        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
14:46:10.0781 1876        mouhid - ok
14:46:10.0796 1876        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
14:46:10.0859 1876        MountMgr - ok
14:46:10.0859 1876        mraid35x - ok
14:46:10.0890 1876        MRxDAV          (e3f17e1ea5256709d4e97ef0da04b3c9) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
14:46:10.0937 1876        MRxDAV - ok
14:46:10.0953 1876        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
14:46:11.0015 1876        MRxSmb - ok
14:46:11.0015 1876        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
14:46:11.0078 1876        Msfs - ok
14:46:11.0093 1876        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
14:46:11.0156 1876        MSKSSRV - ok
14:46:11.0171 1876        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
14:46:11.0234 1876        MSPCLOCK - ok
14:46:11.0250 1876        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
14:46:11.0312 1876        MSPQM - ok
14:46:11.0328 1876        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
14:46:11.0390 1876        mssmbios - ok
14:46:11.0406 1876        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
14:46:11.0437 1876        Mup - ok
14:46:11.0437 1876        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
14:46:11.0515 1876        NDIS - ok
14:46:11.0531 1876        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
14:46:11.0562 1876        NdisTapi - ok
14:46:11.0578 1876        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
14:46:11.0640 1876        Ndisuio - ok
14:46:11.0656 1876        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
14:46:11.0718 1876        NdisWan - ok
14:46:11.0718 1876        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
14:46:11.0750 1876        NDProxy - ok
14:46:11.0750 1876        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
14:46:11.0828 1876        NetBIOS - ok
14:46:11.0843 1876        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
14:46:11.0906 1876        NetBT - ok
14:46:11.0937 1876        nmwcd          (cfe3462a9e94a57dcd9676f6b7fe7f67) C:\WINDOWS\system32\drivers\ccdcmb.sys
14:46:12.0093 1876        nmwcd - ok
14:46:12.0109 1876        nmwcdc          (8f2a94f991f8c73cec26b4b5620d1edc) C:\WINDOWS\system32\drivers\ccdcmbo.sys
14:46:12.0171 1876        nmwcdc - ok
14:46:12.0171 1876        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
14:46:12.0234 1876        Npfs - ok
14:46:12.0265 1876        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
14:46:12.0328 1876        Ntfs - ok
14:46:12.0359 1876        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
14:46:12.0437 1876        Null - ok
14:46:12.0453 1876        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
14:46:12.0531 1876        NwlnkFlt - ok
14:46:12.0531 1876        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
14:46:12.0609 1876        NwlnkFwd - ok
14:46:12.0625 1876        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
14:46:12.0687 1876        Parport - ok
14:46:12.0703 1876        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
14:46:12.0765 1876        PartMgr - ok
14:46:12.0781 1876        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
14:46:12.0859 1876        ParVdm - ok
14:46:12.0875 1876        pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
14:46:12.0890 1876        pccsmcfd - ok
14:46:12.0890 1876        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
14:46:12.0968 1876        PCI - ok
14:46:12.0968 1876        PCIDump - ok
14:46:12.0984 1876        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
14:46:13.0062 1876        PCIIde - ok
14:46:13.0156 1876        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
14:46:13.0250 1876        Pcmcia - ok
14:46:13.0250 1876        PDCOMP - ok
14:46:13.0265 1876        PDFRAME - ok
14:46:13.0265 1876        PDRELI - ok
14:46:13.0281 1876        PDRFRAME - ok
14:46:13.0281 1876        perc2 - ok
14:46:13.0296 1876        perc2hib - ok
14:46:13.0328 1876        Point32        (273afc65fabf97326aa78ffe38b1e071) C:\WINDOWS\system32\DRIVERS\point32.sys
14:46:13.0343 1876        Point32 - ok
14:46:13.0359 1876        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
14:46:13.0421 1876        PptpMiniport - ok
14:46:13.0437 1876        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
14:46:13.0500 1876        PSched - ok
14:46:13.0515 1876        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
14:46:13.0578 1876        Ptilink - ok
14:46:13.0593 1876        PxHelp20        (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
14:46:13.0593 1876        PxHelp20 - ok
14:46:13.0609 1876        ql1080 - ok
14:46:13.0609 1876        Ql10wnt - ok
14:46:13.0625 1876        ql12160 - ok
14:46:13.0625 1876        ql1240 - ok
14:46:13.0640 1876        ql1280 - ok
14:46:13.0656 1876        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
14:46:13.0718 1876        RasAcd - ok
14:46:13.0734 1876        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
14:46:13.0796 1876        Rasl2tp - ok
14:46:13.0828 1876        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
14:46:13.0890 1876        RasPppoe - ok
14:46:13.0906 1876        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
14:46:13.0968 1876        Raspti - ok
14:46:13.0984 1876        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
14:46:14.0046 1876        Rdbss - ok
14:46:14.0062 1876        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
14:46:14.0125 1876        RDPCDD - ok
14:46:14.0156 1876        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
14:46:14.0218 1876        rdpdr - ok
14:46:14.0250 1876        RDPWD          (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
14:46:14.0281 1876        RDPWD - ok
14:46:14.0281 1876        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
14:46:14.0343 1876        redbook - ok
14:46:14.0375 1876        RFCOMM          (851c30df2807fcfa21e4c681a7d6440e) C:\WINDOWS\system32\DRIVERS\rfcomm.sys
14:46:14.0437 1876        RFCOMM - ok
14:46:14.0453 1876        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
14:46:14.0531 1876        Secdrv - ok
14:46:14.0546 1876        serenum        (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
14:46:14.0609 1876        serenum - ok
14:46:14.0609 1876        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
14:46:14.0671 1876        Serial - ok
14:46:14.0703 1876        SFAUDIO        (b6401608579b6431994425ba7653f774) C:\WINDOWS\system32\drivers\sfaudio.sys
14:46:14.0734 1876        SFAUDIO - ok
14:46:14.0734 1876        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
14:46:14.0796 1876        Sfloppy - ok
14:46:14.0812 1876        Simbad - ok
14:46:14.0828 1876        Sparrow - ok
14:46:14.0843 1876        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
14:46:14.0906 1876        splitter - ok
14:46:14.0921 1876        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
14:46:14.0984 1876        sr - ok
14:46:15.0015 1876        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
14:46:15.0062 1876        Srv - ok
14:46:15.0093 1876        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
14:46:15.0156 1876        swenum - ok
14:46:15.0171 1876        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
14:46:15.0250 1876        swmidi - ok
14:46:15.0250 1876        symc810 - ok
14:46:15.0265 1876        symc8xx - ok
14:46:15.0265 1876        sym_hi - ok
14:46:15.0281 1876        sym_u3 - ok
14:46:15.0296 1876        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
14:46:15.0359 1876        sysaudio - ok
14:46:15.0406 1876        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
14:46:15.0453 1876        Tcpip - ok
14:46:15.0453 1876        TDIMSYS - ok
14:46:15.0484 1876        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
14:46:15.0531 1876        TDPIPE - ok
14:46:15.0546 1876        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
14:46:15.0609 1876        TDTCP - ok
14:46:15.0625 1876        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
14:46:15.0687 1876        TermDD - ok
14:46:15.0703 1876        TosIde - ok
14:46:15.0734 1876        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
14:46:15.0781 1876        Udfs - ok
14:46:15.0796 1876        ultra - ok
14:46:15.0843 1876        UnlockerDriver5 (f365fa561c3ab455d8685770d208691a) C:\Programme\Unlocker\UnlockerDriver5.sys
14:46:15.0859 1876        UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - warning
14:46:15.0859 1876        UnlockerDriver5 - detected UnsignedFile.Multi.Generic (1)
14:46:15.0875 1876        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
14:46:15.0937 1876        Update - ok
14:46:15.0968 1876        upperdev        (ec01da44b090d2651fc032c8b9257232) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
14:46:16.0000 1876        upperdev - ok
14:46:16.0031 1876        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
14:46:16.0109 1876        usbccgp - ok
14:46:16.0125 1876        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
14:46:16.0187 1876        usbehci - ok
14:46:16.0218 1876        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
14:46:16.0281 1876        usbhub - ok
14:46:16.0296 1876        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
14:46:16.0359 1876        usbscan - ok
14:46:16.0375 1876        usbser          (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
14:46:16.0437 1876        usbser - ok
14:46:16.0437 1876        UsbserFilt      (4abd37cfbd710e64f01f9da8710c73f7) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
14:46:16.0484 1876        UsbserFilt - ok
14:46:16.0500 1876        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
14:46:16.0578 1876        USBSTOR - ok
14:46:16.0593 1876        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
14:46:16.0656 1876        usbuhci - ok
14:46:16.0671 1876        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
14:46:16.0734 1876        VgaSave - ok
14:46:16.0734 1876        ViaIde - ok
14:46:16.0750 1876        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
14:46:16.0828 1876        VolSnap - ok
14:46:16.0843 1876        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
14:46:16.0921 1876        Wanarp - ok
14:46:16.0937 1876        wceusbsh        (4a954a20a4c73d6db13c0fe25f3f1b0c) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
14:46:16.0984 1876        wceusbsh - ok
14:46:17.0015 1876        Wdf01000        (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
14:46:17.0031 1876        Wdf01000 - ok
14:46:17.0031 1876        WDICA - ok
14:46:17.0046 1876        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
14:46:17.0109 1876        wdmaud - ok
14:46:17.0156 1876        WmiAcpi        (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
14:46:17.0218 1876        WmiAcpi - ok
14:46:17.0250 1876        WudfPf          (eaa6324f51214d2f6718977ec9ce0def) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
14:46:17.0265 1876        WudfPf - ok
14:46:17.0281 1876        WudfRd          (f91ff1e51fca30b3c3981db7d5924252) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
14:46:17.0296 1876        WudfRd - ok
14:46:17.0312 1876        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
14:46:17.0531 1876        \Device\Harddisk0\DR0 - ok
14:46:17.0562 1876        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1
14:46:17.0640 1876        \Device\Harddisk1\DR1 - ok
14:46:18.0093 1876        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk2\DR7
14:46:18.0203 1876        \Device\Harddisk2\DR7 - ok
14:46:18.0203 1876        Boot (0x1200)  (ebcc8f7862f2302fa9e82a1d2efeebed) \Device\Harddisk0\DR0\Partition0
14:46:18.0203 1876        \Device\Harddisk0\DR0\Partition0 - ok
14:46:18.0218 1876        Boot (0x1200)  (dafd7e861e88eb7ba0b8b1aa5fb06736) \Device\Harddisk0\DR0\Partition1
14:46:18.0218 1876        \Device\Harddisk0\DR0\Partition1 - ok
14:46:18.0234 1876        Boot (0x1200)  (61805c5e89696959a12fc220002a1227) \Device\Harddisk0\DR0\Partition2
14:46:18.0234 1876        \Device\Harddisk0\DR0\Partition2 - ok
14:46:18.0250 1876        Boot (0x1200)  (1b1c7393d501ad57c519df9255df1ff8) \Device\Harddisk1\DR1\Partition0
14:46:18.0250 1876        \Device\Harddisk1\DR1\Partition0 - ok
14:46:18.0250 1876        Boot (0x1200)  (3eac0406837fef19fd09dc9d74e290a4) \Device\Harddisk2\DR7\Partition0
14:46:18.0250 1876        \Device\Harddisk2\DR7\Partition0 - ok
14:46:18.0250 1876        ============================================================
14:46:18.0250 1876        Scan finished
14:46:18.0250 1876        ============================================================
14:46:18.0375 0708        Detected object count: 2
14:46:18.0375 0708        Actual detected object count: 2
14:46:39.0203 0708        Aspi32 ( UnsignedFile.Multi.Generic ) - skipped by user
14:46:39.0203 0708        Aspi32 ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:46:39.0203 0708        UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - skipped by user
14:46:39.0203 0708        UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - User select action: Skip
Beste Grüße
fn

cosinus 16.01.2012 15:52
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

fuchsneu 17.01.2012 11:24
Lieber Arne,
Combofix ist ohne Probleme durchgelaufen.
Combofix Logfile:
Code:
ComboFix 12-01-16.05 - Administrator 17.01.2012  11:12:10.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.43.1031.18.3292.2608 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Administrator\Desktop\ComboFix.exe
AV: VirusScan Enterprise + AntiSpyware Enterprise *Disabled/Updated* {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\Administrator\Anwendungsdaten\ACD Systems\ACDSee\ImageDB.ddf
c:\dokumente und einstellungen\Administrator\Eigene Dateien\~WRL0001.tmp
c:\dokumente und einstellungen\Administrator\Eigene Dateien\~WRL2471.tmp
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-17 bis 2012-01-17  ))))))))))))))))))))))))))))))
.
.
2012-01-16 10:54 . 2012-01-16 10:54        --------        d-----w-        C:\_OTL
2012-01-13 08:38 . 2012-01-13 08:38        --------        d-----w-        c:\programme\ESET
2012-01-12 11:39 . 2012-01-12 11:39        --------        d-----w-        c:\programme\7-Zip
2012-01-11 10:20 . 2012-01-12 09:21        --------        d-----w-        c:\programme\Spybot - Search & Destroy
2012-01-11 10:20 . 2012-01-12 09:21        --------        d-----w-        d:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2012-01-11 10:06 . 2012-01-11 10:06        626688        ----a-w-        c:\programme\Mozilla Firefox\msvcr80.dll
2012-01-11 10:06 . 2012-01-11 10:06        548864        ----a-w-        c:\programme\Mozilla Firefox\msvcp80.dll
2012-01-11 10:06 . 2012-01-11 10:06        479232        ----a-w-        c:\programme\Mozilla Firefox\msvcm80.dll
2012-01-11 10:06 . 2012-01-11 10:06        43992        ----a-w-        c:\programme\Mozilla Firefox\mozutils.dll
2012-01-11 09:50 . 2012-01-11 09:50        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2012-01-11 09:49 . 2012-01-11 09:49        --------        d-----w-        d:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-01-11 09:49 . 2012-01-11 09:50        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-01-11 09:49 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-12-21 20:59 . 2011-12-21 20:59        --------        d-----w-        d:\dokumente und einstellungen\All Users\Anwendungsdaten\boost_interprocess
2011-12-21 14:21 . 2011-12-21 14:22        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\FreeCDRipper
2011-12-21 14:21 . 2011-12-21 14:21        --------        d-----w-        c:\programme\Free CD Ripper
2011-12-20 20:47 . 2011-12-20 20:47        --------        d-----w-        c:\programme\QuickTime
2011-12-20 20:47 . 2011-12-20 20:47        --------        d-----w-        d:\dokumente und einstellungen\All Users\Anwendungsdaten\Apple Computer
2011-12-20 20:45 . 2011-12-20 20:45        --------        d-----w-        c:\programme\Apple Software Update
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-21 14:19 . 2011-08-15 14:55        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-25 21:57 . 2004-08-04 11:00        293888        ----a-w-        c:\windows\system32\winsrv.dll
2011-11-23 14:40 . 2004-08-04 11:00        1859712        ----a-w-        c:\windows\system32\win32k.sys
2011-11-20 06:12 . 2004-08-04 11:00        61952        ----a-w-        c:\windows\system32\packager.exe
2011-11-16 14:21 . 2004-08-04 11:00        354816        ----a-w-        c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2004-08-04 11:00        152064        ----a-w-        c:\windows\system32\schannel.dll
2011-11-04 19:13 . 2004-08-04 11:00        916992        ----a-w-        c:\windows\system32\wininet.dll
2011-11-04 19:13 . 2004-08-04 11:00        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2011-11-04 19:13 . 2004-08-04 11:00        1469440        ------w-        c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2004-08-04 11:00        385024        ----a-w-        c:\windows\system32\html.iec
2011-11-03 15:28 . 2004-08-04 11:00        387072        ----a-w-        c:\windows\system32\qdvd.dll
2011-11-03 15:28 . 2004-08-04 11:00        1297920        ----a-w-        c:\windows\system32\quartz.dll
2011-11-01 16:07 . 2004-08-04 11:00        1288704        ----a-w-        c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2004-08-04 11:00        33280        ----a-w-        c:\windows\system32\csrsrv.dll
2011-10-26 10:49 . 2004-08-04 11:00        2151424        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-10-26 10:49 . 2004-08-04 00:50        2029568        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2011-10-24 13:29 . 2011-10-24 13:29        94208        ----a-w-        c:\windows\system32\QuickTimeVR.qtx
2011-10-24 13:29 . 2011-10-24 13:29        69632        ----a-w-        c:\windows\system32\QuickTime.qts
2008-08-16 16:42 . 2008-08-16 16:42        13112        ----a-w-        c:\programme\mozilla firefox\plugins\cgpcfg.dll
2008-08-16 16:42 . 2008-08-16 16:42        70456        ----a-w-        c:\programme\mozilla firefox\plugins\CgpCore.dll
2008-08-16 16:42 . 2008-08-16 16:42        91448        ----a-w-        c:\programme\mozilla firefox\plugins\confmgr.dll
2008-08-16 16:42 . 2008-08-16 16:42        20800        ----a-w-        c:\programme\mozilla firefox\plugins\ctxlogging.dll
2008-08-16 16:43 . 2008-08-16 16:43        206136        ----a-w-        c:\programme\mozilla firefox\plugins\ctxmui.dll
2008-08-16 16:42 . 2008-08-16 16:42        31032        ----a-w-        c:\programme\mozilla firefox\plugins\icafile.dll
2008-08-16 16:42 . 2008-08-16 16:42        40248        ----a-w-        c:\programme\mozilla firefox\plugins\icalogon.dll
2008-05-21 07:41 . 2008-05-21 07:41        479232        ----a-w-        c:\programme\mozilla firefox\plugins\msvcm80.dll
2008-05-21 07:41 . 2008-05-21 07:41        548864        ----a-w-        c:\programme\mozilla firefox\plugins\msvcp80.dll
2008-05-21 07:41 . 2008-05-21 07:41        626688        ----a-w-        c:\programme\mozilla firefox\plugins\msvcr80.dll
2008-06-05 12:58 . 2008-06-05 12:58        648504        ----a-w-        c:\programme\mozilla firefox\plugins\sslsdk_b.dll
2008-08-16 16:42 . 2008-08-16 16:42        23864        ----a-w-        c:\programme\mozilla firefox\plugins\TcpPServ.dll
2012-01-11 10:06 . 2011-07-27 10:39        121816        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
2011-07-29 14:07 . 2011-07-29 14:07        119808        ----a-w-        c:\programme\mozilla firefox\components\GoogleDesktopMozilla.dll
2011-02-04 18:07 . 2011-07-27 10:10        23864        ----a-w-        c:\programme\mozilla firefox\components\Scriptff.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"H/PC Connection Agent"="c:\programme\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 1211176]
"PC Suite Tray"="c:\programme\Nokia\Nokia PC Suite 7\PCSuite.exe" [2011-06-16 1500160]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"SoundMAXPnP"="c:\programme\Analog Devices\Core\smax4pnp.exe" [2008-07-24 1044480]
"IAAnotif"="c:\programme\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-08-06 182808]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-29 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-29 178712]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-29 150040]
"PDVDDXSrv"="c:\programme\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-09-11 128232]
"GrooveMonitor"="c:\programme\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"picon"="c:\programme\Gemeinsame Dateien\Intel\Privacy Icon\PrivacyIconClient.exe" [2008-07-23 773144]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"ShStatEXE"="c:\programme\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2011-02-04 124224]
"ScanSoft OmniPage 16-reminder"="c:\programme\ScanSoft\OmniPage16\Ereg\Ereg.exe" [2007-08-31 328992]
"Google Desktop Search"="c:\programme\Google\Google Desktop Search\GoogleDesktop.exe" [2011-07-29 30192]
"Acrobat Assistant 8.0"="c:\programme\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 620152]
"IntelliPoint"="c:\programme\Microsoft IntelliPoint\ipoint.exe" [2009-11-11 1468256]
"McAfeeUpdaterUI"="c:\programme\McAfee\Common Framework\udaterui.exe" [2011-05-19 161088]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-06-09 254696]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"APSDaemon"="c:\programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2011-10-24 421888]
.
c:\dokumente und einstellungen\Administrator\Startmenü\Programme\Autostart\
Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Hardcopy.LNK - c:\programme\Hardcopy\hardcopy.exe [2004-7-26 1093632]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\programme\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OneNote Inhaltsverzeichnis.onetoc2 [2011-2-7 3656]
.
c:\dokumente und einstellungen\Administrator\Startmenü\Programme\Autostart\
Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Hardcopy.LNK - c:\programme\Hardcopy\hardcopy.exe [2004-7-26 1093632]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\programme\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OneNote Inhaltsverzeichnis.onetoc2 [2011-2-7 3656]
.
c:\dokumente und einstellungen\Administrator\Startmenü\Programme\Autostart\
Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Hardcopy.LNK - c:\programme\Hardcopy\hardcopy.exe [2004-7-26 1093632]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\programme\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OneNote Inhaltsverzeichnis.onetoc2 [2011-2-7 3656]
.
c:\dokumente und einstellungen\Administrator\Startmenü\Programme\Autostart\
Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Hardcopy.LNK - c:\programme\Hardcopy\hardcopy.exe [2004-7-26 1093632]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\programme\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OneNote Inhaltsverzeichnis.onetoc2 [2011-2-7 3656]
.
d:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Adobe Acrobat - Schnellstart.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2011-8-9 295606]
Adobe Reader Synchronizer.lnk - c:\programme\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-22 734872]
.
c:\dokumente und einstellungen\Administrator\Startmenü\Programme\Autostart\
Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Hardcopy.LNK - c:\programme\Hardcopy\hardcopy.exe [2004-7-26 1093632]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\programme\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OneNote Inhaltsverzeichnis.onetoc2 [2011-2-7 3656]
.
c:\dokumente und einstellungen\Administrator\Startmenü\Programme\Autostart\
Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Hardcopy.LNK - c:\programme\Hardcopy\hardcopy.exe [2004-7-26 1093632]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\programme\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OneNote Inhaltsverzeichnis.onetoc2 [2011-2-7 3656]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"DisableLocalUserRunOnce"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\McAfee\\Common Framework\\FrameworkService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\windows\system32\DWRCS.EXE"= c:\windows\system32\DWRCS.EXE:143.50.128.0/255.255.255.0,143.50.250.0/255.255.255.0:Enabled:ZID-Fernwartung
"c:\\WINDOWS\\system32\\BFCRX.exe"= c:\\WINDOWS\\system32\\bfcrx.exe
"c:\\Programme\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\programme\Microsoft ActiveSync\rapimgr.exe"= c:\programme\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programme\Microsoft ActiveSync\wcescomm.exe"= c:\programme\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programme\Microsoft ActiveSync\WCESMgr.exe"= c:\programme\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Programme\\MyPhoneExplorer\\MyPhoneExplorer.exe"=
"c:\\Programme\\FileZilla FTP Client\\filezilla.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10099:TCP"= 10099:TCP:BFCRX-10099-TCP
"10087:UDP"= 10087:UDP:BMA-10087-UDP
"445:TCP"= 445:TCP:LocalSubNet,143.50.15.0/255.255.255.0,143.50.128.0/255.255.255.0,143.50.250.0/255.255.255.0:Enabled:@xpsp2res.dll,-22005
"5985:TCP"= 5985:TCP:*:Disabled:Windows-Remoteverwaltung
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [20.01.2009 17:43 64160]
R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [04.12.2008 11:19 24064]
R2 BFCRX;BFC Remote Executor;c:\windows\system32\BFCRX.exe [21.08.2007 15:18 286720]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [27.07.2011 11:10 69192]
R2 UNS;Intel(R) Active Management Technology User Notification Service;c:\programme\Gemeinsame Dateien\Intel\Privacy Icon\UNS\UNS.exe [09.02.2010 14:55 2054680]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [04.12.2008 11:22 144480]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 12:16 130384]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\programme\Google\Google Desktop Search\GoogleDesktop.exe [29.07.2011 15:07 30192]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [27.07.2011 11:10 67240]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [04.08.2004 12:00 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 12:16 753504]
S4 McAfeeEngineService;McAfee Engine Service;c:\programme\McAfee\VirusScan Enterprise\EngineServer.exe [04.02.2011 19:07 22816]
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
WINRM        REG_MULTI_SZ          WINRM
.
Inhalt des "geplante Tasks" Ordners
.
2011-12-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2011-12-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-627158298-2154700328-2256013073-500Core.job
- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [2011-12-28 22:26]
.
2012-01-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-627158298-2154700328-2256013073-500UA.job
- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [2011-12-28 22:26]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.at/
IE: &Citavi Picker... - file://c:\programme\Internet Explorer\PLUGINS\Citavi Picker\ShowContextMenu.html
IE: An vorhandenes PDF anfügen - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Auswahl in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
TCP: Interfaces\{2272904F-4A85-4522-994C-A666625C046F}: NameServer = 143.50.19.25,143.50.56.25
FF - ProfilePath - c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ti3q0tmt.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - www.google.at
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-OpAgent - OpAgent.exe
Notify-AtiExtEvent - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-Adobe PageMaker 7.0 - c:\windows\ISUN0407.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-01-17 11:16
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-627158298-2154700328-2256013073-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
  d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,de,80,e0,b5,27,e6,ea,41,ac,c6,2b,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
  d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,de,80,e0,b5,27,e6,ea,41,ac,c6,2b,\
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'explorer.exe'(584)
c:\programme\Hardcopy\hcdll2_C.dll
c:\programme\McAfee\Common Framework\McTrayLegacySupportPlugin.dll
c:\programme\McAfee\Common Framework\McTrayInterfaceLib.dll
c:\programme\McAfee\Common Framework\McAfeeWin32GUISupportDLL.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\programme\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\programme\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\programme\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_ger.nlr
c:\programme\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\programme\Roxio\Drag-to-Disc\Shellex.dll
c:\programme\Gemeinsame Dateien\Roxio Shared\9.0\DLLShared\DLAAPI_W.DLL
c:\programme\Roxio\Drag-to-Disc\ShellRes.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\Intel\AMT\LMS.exe
c:\programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe
c:\programme\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\rundll32.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\programme\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe
c:\programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
c:\programme\PC Connectivity Solution\ServiceLayer.exe
c:\programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\programme\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe
c:\programme\McAfee\Common Framework\McTray.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-01-17  11:20:02 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-01-17 10:19
.
Vor Suchlauf: 62 Verzeichnis(se), 24.993.759.232 Bytes frei
Nach Suchlauf: 64 Verzeichnis(se), 24.976.809.984 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - BC69E58F3E90647B6CC0F2C9E110C27A
--- --- ---


Beste Grüße
g. fuchs

cosinus 17.01.2012 13:35
Zitat:
R2 BFCRX;BFC Remote Executor;c:\windows\system32\BFCRX.exe [21.08.2007 15:18 286720]
Mal ne Frage, das Teil kennst du? Du weißt was ein Remote Executor ist?


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:11 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131