Trojaner-Board - Extreme Internet/Rechnerverlangsamung

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Extreme Internet/Rechnerverlangsamung (https://www.trojaner-board.de/115524-extreme-internet-rechnerverlangsamung.html)

Extreme Internet/Rechnerverlangsamung

Guten Tag,

ich entschuldige mich hiermit im Voraus für alle formalen Fehler, die ich hier begehe/begehen werde. Da ich neu bin ist mir hier der genaue Ablauf nicht 100% bekannt.

Ich versuche nun die Situation zu beschreiben:

Zunächst ist mir der genaue Zeitpunkt des Eintretens und das Wie/Was unbekannt, da ich leider übers Wochenende nicht zuhause war und den genauen Werdegang nicht nachvollziehen kann ( da Verwandter am Rechner war).

Fazit mit folgenden Symptomen ist:

1) Ein extrem verlangsamter, teilweise eingefrorener Rechner
2) Ein extrem verlangsamtes, teilweise abbrechendes Internet

Antivir drüberlaufen lassen, aber 'EXP/Java.Blacole.CZ' [exploit] war das einzige, was gefunden wurde.
Problem besteht weiterhin.

Ich schätze, ich werde hier versch. Logs posten müssen. Es wäre freundlich, wenn ihr kurz einen DL-Link in eure Posts einfügen würdet, da sich die Suche mit meinem Inet gerade als etwas "schwierig" erweist. Danke fürs Verständnis..

mfg

1. Scan mit mbam

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.05.21.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Besitzer :: ACER-F5DADEF16C [Administrator]

21.05.2012 18:28:44
mbam-log-2012-05-21 (18-40-14).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 244716
Laufzeit: 11 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Desktopicon\eBayShortcuts.exe (Adware.ADON) -> Keine Aktion durchgeführt.
C:\Dokumente und Einstellungen\Besitzer\Eigene Dateien\Downloads\SoftonicDownloader_for_aol.exe (PUP.ToolbarDownloader) -> Keine Aktion durchgeführt.
C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\538078.Uninstall\Uninstall.exe (PUP.Adware.InstallCore) -> Keine Aktion durchgeführt.

(Ende)

Danach meldete sich auch plötzlich avira 2x :

In der Datei 'C:\Dokumente und Einstellungen\Besitzer\Eigene Dateien\Downloads\SoftonicDownloader_for_aol.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Trash.Gen' [trojan] gefunden.
Ausgeführte Aktion: Datei löschen

In der Datei 'C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\538078.Uninstall\Uninstall.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Trash.Gen' [trojan] gefunden.
Ausgeführte Aktion: Datei löschen

2. Scan drüberlaufen lassen

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.05.21.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Besitzer :: ACER-F5DADEF16C [Administrator]

21.05.2012 18:49:15
mbam-log-2012-05-21 (18-49-15).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 244551
Laufzeit: 11 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Code:

 # unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-05-21 09:26:07

# local_time=2012-05-21 11:26:07 (+0100, Westeuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=1797 16775141 100 100 37761 113150351 31156 0

# compatibility_mode=8192 67108863 100 0 473 473 0 0

# scanned=12915

# found=0

# cleaned=0

# scan_time=523

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=980e2cdd60721b4f8310ebe5aad30622

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-05-23 02:19:23

# local_time=2012-05-23 04:19:23 (+0100, Westeuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=1797 16775141 100 100 180021 113292611 173416 0

# compatibility_mode=8192 67108863 100 0 142733 142733 0 0

# scanned=158408

# found=7

# cleaned=0

# scan_time=5457

C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\aTube_Catcher_Installer.exe        Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I

C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\A56E4DA7-BAB0-7891-9508-56FD958CA7ED\Latest\MyBabylonTB.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\ICReinstall\Facemoods.exe        probably a variant of Win32/InstallCore.A application (unable to clean)        00000000000000000000000000000000        I

C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\is1293846689\MyBabylonTB.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Programme\Ocean Technologies & Media\GG E-Sports Platform\plugins\FixedUpdatePlugin.dll        probably a variant of Win32/TrojanDownloader.Agent.JOPAUPF trojan (unable to clean)        00000000000000000000000000000000        I

D:\Eigene Dateien\HL2_UK\Steam.dll.bak        probably a variant of Win32/Agent.JBGSCWH trojan (unable to clean)        00000000000000000000000000000000        I

Hoffe alles ist richtig so.

mfg

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

OTL Logfile:

Code:

OTL logfile created on: 23.05.2012 21:20:54 - Run 1

OTL by OldTimer - Version 3.2.43.1     Folder = C:\Dokumente und Einstellungen\Besitzer\Desktop

Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1023,36 Mb Total Physical Memory | 631,25 Mb Available Physical Memory | 61,68% Memory free

2,40 Gb Paging File | 1,86 Gb Available in Paging File | 77,27% Paging File free

Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 93,91 Gb Total Space | 20,18 Gb Free Space | 21,49% Space Free | Partition Type: NTFS

Drive D: | 92,38 Gb Total Space | 59,34 Gb Free Space | 64,23% Space Free | Partition Type: FAT32

 

Computer Name: ACER-F5DADEF16C | User Name: Besitzer | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.05.23 21:19:15 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Besitzer\Desktop\OTL.exe

PRC - [2009.08.05 15:32:29 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2009.03.02 13:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2008.02.01 04:02:26 | 000,065,536 | ---- | M] (PostgreSQL Global Development Group) -- C:\Programme\PostgreSQL\8.3\bin\pg_ctl.exe

PRC - [2008.02.01 04:00:54 | 003,661,824 | ---- | M] (PostgreSQL Global Development Group) -- C:\Programme\PostgreSQL\8.3\bin\postgres.exe

PRC - [2004.11.09 22:36:02 | 000,497,240 | ---- | M] (America Online, Inc) -- C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe

PRC - [2004.11.09 22:36:01 | 001,140,312 | ---- | M] (America Online, Inc.) -- C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe

PRC - [2003.06.17 17:14:40 | 000,050,688 | ---- | M] (Microsoft® Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU

MOD - [2011.10.14 18:38:00 | 000,456,192 | ---- | M] () -- C:\WINDOWS\system32\encdec.dll

MOD - [2011.02.04 18:48:30 | 000,291,840 | ---- | M] () -- C:\WINDOWS\system32\sbe.dll

MOD - [2009.01.28 16:03:49 | 000,326,401 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll

MOD - [2008.04.14 04:22:16 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll

MOD - [2007.09.20 19:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll

MOD - [2005.08.05 15:26:04 | 000,239,104 | ---- | M] () -- C:\WINDOWS\system32\psisdecd.dll

MOD - [2005.08.05 15:26:04 | 000,224,256 | ---- | M] () -- C:\WINDOWS\system32\psisrndr.ax

MOD - [2005.08.05 15:26:02 | 000,062,976 | ---- | M] () -- C:\WINDOWS\system32\mpeg2data.ax

MOD - [2005.08.05 14:02:02 | 000,165,376 | ---- | M] () -- C:\WINDOWS\system32\mpg2splt.ax

MOD - [2005.08.05 14:01:14 | 000,064,512 | ---- | M] () -- C:\WINDOWS\system32\msnp.ax

MOD - [2004.11.09 21:36:12 | 000,069,632 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\aol\ACS\DE\DialerRes.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)

SRV - [2012.05.21 21:40:19 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.04.24 14:21:01 | 000,014,848 | ---- | M] () [Disabled | Stopped] -- C:\Programme\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe -- (SystemStore)

SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2009.08.05 15:32:29 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2008.02.01 04:02:26 | 000,065,536 | ---- | M] (PostgreSQL Global Development Group) [Auto | Running] -- C:\Programme\PostgreSQL\8.3\bin\pg_ctl.exe -- (pgsql-8.3)

SRV - [2005.06.21 00:10:30 | 000,053,248 | ---- | M] (Hewlett-Packard Company) [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)

SRV - [2004.11.09 22:36:01 | 001,140,312 | ---- | M] (America Online, Inc.) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe -- (AOL ACS)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\xpsec.sys -- (xpsec)

DRV - File not found [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\xcpip.sys -- (xcpip)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)

DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfSysMon.sys -- (TfSysMon)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TfNetMon.sys -- (TfNetMon)

DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfFsMon.sys -- (TfFsMon)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)

DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)

DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)

DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)

DRV - File not found [Kernel | On_Demand | Stopped] -- I:\INSTALL\GMSIPCI.SYS -- (GMSIPCI)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Garena\safedrv.sys -- (GGSAFERDriver)

DRV - File not found [Kernel | System | Stopped] --  -- (Changer)

DRV - [2010.09.04 15:10:53 | 000,025,616 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\PRFCC8.tmp -- (GarenaPEngine)

DRV - [2010.01.30 13:41:21 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2009.05.11 10:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.03.30 10:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008.04.13 20:46:22 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)

DRV - [2007.04.10 13:04:40 | 004,397,568 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2007.02.06 18:43:26 | 000,090,880 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)

DRV - [2006.06.13 20:09:14 | 000,969,728 | ---- | M] (Philips Semiconductors GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\3xHybrid.sys -- (3xHybrid)

DRV - [2005.03.09 08:53:00 | 000,036,352 | R--- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)

DRV - [2004.01.25 07:56:47 | 000,029,696 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\krdpdre.sys -- (krdpdre)

DRV - [2003.01.10 23:13:04 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = 

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=109986&babsrc=HP_ss&mntrId=a0ed97790000000000000019dbc2cad6

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\URLSearchHook:  - No CLSID value found

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=109986&babsrc=SP_ss&mntrId=a0ed97790000000000000019dbc2cad6

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ATU2&o=14670&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=T8&apn_dtid=YYYYYYYYDE&apn_uid=30d11c04-714e-49fc-b675-c4596f09a4f5&apn_sauid=0A4B73D3-1F66-4D8B-94DD-DD0187EA0C7F

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"

FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"

FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"

FF - prefs.js..browser.startup.homepage: "hxxp://search.babylon.com/?affID=109986&babsrc=HP_ss&mntrId=a0ed97790000000000000019dbc2cad6"

FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?affID=109986&babsrc=KW_ss&mntrId=a0ed97790000000000000019dbc2cad6&q="

 

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Programme\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Programme\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@octoshape.com/Octoshape Streaming Services,version=1.0: C:\Programme\Octoshape Streaming Services\Besitzer\octoprogram-L03-NMS1010120_SUA_001\npoctoshape.dll (Octoshape ApS)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.05.21 23:45:06 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins

 

[2012.04.11 15:14:21 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Mozilla\Extensions

[2012.05.21 18:05:04 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\5uwxdfjn.default\extensions

[2012.04.11 15:11:52 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2012.05.21 21:40:20 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2012.05.21 21:40:12 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.05.21 17:44:43 | 000,002,313 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml

[2012.05.21 21:40:12 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2012.05.21 21:40:12 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2012.05.21 21:40:12 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.05.21 21:40:12 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.05.21 21:40:12 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2004.08.10 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O3 - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.

O3 - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.

O3 - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [AOLDialer] C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe (America Online, Inc)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1214440339-484763869-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1214440339-484763869-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O15 - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab (SysInfo Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AF18D33F-54F0-4846-9CAB-A38BFE1176F5}: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008.02.14 14:32:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 

NetSvcs: 6to4 -  File not found

NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

MsConfig - Services: "RichVideo"

MsConfig - Services: "LightScribeService"

MsConfig - Services: "Browser Defender Update Service"

MsConfig - Services: "sdCoreService"

MsConfig - Services: "sdAuxService"

MsConfig - Services: "Brother XP spl Service"

MsConfig - Services: "SkypeUpdate"

MsConfig - Services: "SystemStore"

MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Status Monitor.lnk - C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe - (Brother Industries, Ltd.)

MsConfig - StartUpFolder: C:^DOKUME~1^ALLUSE~1^Startmenü^Programme^Autostart^AOL 9.0 Tray-Symbol.lnk - C:\Programme\AOL 9.0\aoltray.exe - (America Online, Inc.)

MsConfig - StartUpFolder: C:^DOKUME~1^ALLUSE~1^Startmenü^Programme^Autostart^Microsoft Office.lnk - C:\Programme\Microsoft Office\Office10\OSA.EXE - (Microsoft Corporation)

MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= -  File not found

MsConfig - StartUpReg: ApnUpdater - hkey= - key= -  File not found

MsConfig - StartUpReg: ControlCenter2.0 - hkey= - key= - C:\Programme\Brother\ControlCenter2\brctrcen.exe (Brother Industries, Ltd.)

MsConfig - StartUpReg: DVDTray - hkey= - key= - C:\Programme\Ahead\ODD Toolkit\dvdtray.exe (Hewlett-Packard Company)

MsConfig - StartUpReg: DW6 - hkey= - key= -  File not found

MsConfig - StartUpReg: Guard.Mail.ru.gui - hkey= - key= -  File not found

MsConfig - StartUpReg: ICQ - hkey= - key= -  File not found

MsConfig - StartUpReg: ISTray - hkey= - key= -  File not found

MsConfig - StartUpReg: LanguageShortcut - hkey= - key= - C:\Programme\CyberLink\PowerDVD\Language\Language.exe ()

MsConfig - StartUpReg: MSMSGS - hkey= - key= - C:\Programme\Messenger\msmsgs.exe (Microsoft Corporation)

MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= -  File not found

MsConfig - StartUpReg: Octoshape Streaming Services - hkey= - key= - C:\Programme\Octoshape Streaming Services\Besitzer\OctoshapeClient.exe ()

MsConfig - StartUpReg: Performance Center - hkey= - key= -  File not found

MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Programme\QuickTime\qttask.exe (Apple Computer, Inc.)

MsConfig - StartUpReg: RealTray - hkey= - key= -  File not found

MsConfig - StartUpReg: RemoteControl - hkey= - key= - C:\Programme\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)

MsConfig - StartUpReg: SetDefPrt - hkey= - key= - C:\Programme\Brother\Brmfl05a\BrStDvPt.exe (Brother Industories, Ltd.)

MsConfig - StartUpReg: Skype - hkey= - key= - C:\Programme\Skype\Phone\Skype.exe (Skype Technologies S.A.)

MsConfig - StartUpReg: Steam - hkey= - key= -  File not found

MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

MsConfig - State: "system.ini" - 1

MsConfig - State: "win.ini" - 2

MsConfig - State: "bootini" - 0

MsConfig - State: "services" - 2

MsConfig - State: "startup" - 2

 

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vds - Service

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {14F4D1F6-79E4-4256-A10B-3CCD138698C6} - Microsoft .NET Framework 1.0 Hotfix (KB2656378)

ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 8.5.1

ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)

ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {29E7D24F-BF30-45E7-8A40-AD27AFD8F5C6} - Microsoft .NET Framework 1.0 Hotfix (KB979904)

ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 8.5.1

ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {339E9413-F230-4F0F-ADDD-17914D95FD6D} - Microsoft .NET Framework 1.0 Hotfix (KB2604042)

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {407408d4-94ed-4d86-ab69-a7f649d112ee} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection QuickLaunchShortcut 640 %systemroot%\inf\mcdftreg.inf

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4F00D11B-8327-4C55-B7DA-B8D8C10F28A8} - Microsoft .NET Framework 1.0 Hotfix (KB2572066)

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider

ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework

ActiveX: {BDE0FA43-6952-4BA8-8C58-09AF690F88E1} - Microsoft .NET Framework 1.0 Hotfix (KB930494)

ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework

ActiveX: {E8EA5BD6-D931-4001-ABF6-81BAA500360A} - Microsoft .NET Framework 1.0 Hotfix (KB953295)

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {EA29D410-CE41-4953-A862-2DE706A1DAD7} - Microsoft .NET Framework 1.0 Service Pack 3

ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate

ActiveX: {FDC11A6F-17D1-48f9-9EA3-9051954BAA24} - .NET Framework

ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

ActiveX: KB910393 - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\EasyCDBlock.inf,PerUserInstall

ActiveX: Microsoft Base Smart Card Crypto Provider Package - 

 

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.lhacm - lhacm.acm File not found

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.05.23 21:19:11 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Besitzer\Desktop\OTL.exe

[2012.05.23 20:57:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Besitzer\Desktop\58

[2012.05.21 23:45:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\You've Got Pictures Screensaver

[2012.05.21 23:45:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\occache

[2012.05.21 23:45:08 | 000,086,016 | ---- | C] (MindVision) -- C:\WINDOWS\unvise32qt.exe

[2012.05.21 23:45:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\QuickTime

[2012.05.21 23:45:01 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime

[2012.05.21 23:45:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QuickTime

[2012.05.21 23:43:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\AOL

[2012.05.21 23:43:33 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\aolshare

[2012.05.21 23:43:29 | 000,000,000 | ---D | C] -- C:\Programme\AOL 9.0

[2012.05.21 23:09:31 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2012.05.21 21:40:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla

[2012.05.21 21:40:23 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service

[2012.05.21 20:03:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Besitzer\Eigene Dateien\Simply Super Software

[2012.05.21 18:17:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware

[2012.05.21 18:17:10 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2012.05.21 18:17:10 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2012.05.21 17:44:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Babylon

[2012.05.21 17:44:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Babylon

[2012.05.21 17:44:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon

[2012.05.21 09:36:59 | 000,000,000 | ---D | C] -- C:\Programme\Freemium

[2012.05.11 14:34:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Besitzer\Eigene Dateien\TubeBox

[2012.05.11 14:32:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Freemium TubeBox

[2012.05.11 14:32:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Freemium TubeBox

[2012.05.11 14:31:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Freemium

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[20 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[14 C:\Dokumente und Einstellungen\Besitzer\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\Besitzer\Desktop\*.tmp -> ]

[1 C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.05.23 21:19:15 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Besitzer\Desktop\OTL.exe

[2012.05.23 20:58:50 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[2012.05.23 20:58:43 | 000,051,712 | ---- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.05.23 17:42:35 | 000,026,682 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2012.05.23 17:42:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012.05.23 17:40:56 | 000,000,209 | ---- | M] () -- C:\boot.ini

[2012.05.23 13:42:51 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012.05.21 23:45:28 | 000,000,725 | ---- | M] () -- C:\WINDOWS\aolback.exe.lnk

[2012.05.21 23:45:17 | 000,000,574 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\AOL 9.0.lnk

[2012.05.21 23:37:12 | 000,051,750 | ---- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\wklnhst.dat

[2012.05.21 17:45:00 | 000,000,237 | ---- | M] () -- C:\user.js

[2012.05.21 12:54:09 | 000,000,006 | ---- | M] () -- C:\WINDOWS\msoffice.ini

[2012.05.21 09:38:54 | 000,255,064 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2012.05.17 01:32:54 | 000,000,095 | ---- | M] () -- C:\WINDOWS\winamp.ini

[2012.05.10 00:05:41 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2012.05.09 23:59:03 | 000,528,964 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2012.05.09 23:59:03 | 000,504,060 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2012.05.09 23:59:03 | 000,106,428 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2012.05.09 23:59:03 | 000,088,914 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[20 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[14 C:\Dokumente und Einstellungen\Besitzer\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\Besitzer\Desktop\*.tmp -> ]

[1 C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.05.21 23:45:17 | 000,000,574 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\AOL 9.0.lnk

[2012.05.21 17:44:59 | 000,000,237 | ---- | C] () -- C:\user.js

[2012.05.21 10:49:09 | 000,000,006 | ---- | C] () -- C:\WINDOWS\msoffice.ini

[2012.02.16 18:54:44 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2011.11.13 01:36:36 | 000,223,446 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat

[2011.11.12 18:02:15 | 000,421,475 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1214440339-484763869-839522115-1003-0.dat

[2011.05.27 14:18:36 | 000,045,202 | ---- | C] () -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\room_v3.dat

[2011.04.16 15:06:59 | 000,046,658 | ---- | C] () -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\room.dat

[2011.03.10 18:29:31 | 000,248,579 | ---- | C] () -- C:\WINDOWS\War3Unin.dat

[2010.11.21 15:51:12 | 000,000,379 | ---- | C] () -- C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\postgresinstall.bat

[2010.09.04 21:33:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\HMHud.INI

 
 ========== LOP Check ==========

 

[2012.05.21 17:44:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon

[2012.01.20 19:33:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ

[2009.01.01 16:15:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Jlcm

[2009.07.17 20:27:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PPLive

[2012.05.21 20:07:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP

[2011.08.02 14:32:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint

[2011.08.01 23:42:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\XHEO INC

[2012.05.21 17:44:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Babylon

[2009.04.25 21:52:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Desktopicon

[2012.05.11 14:31:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Freemium

[2011.08.01 23:15:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\HEM Data

[2011.09.17 12:48:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\HoldemManager

[2012.02.17 18:12:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\ICQ

[2008.02.15 15:08:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\ICQ Toolbar

[2009.04.17 16:36:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\ICQLite

[2011.10.18 17:17:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Jens Lorek

[2011.11.24 19:35:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\PacificPoker

[2010.10.03 21:51:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\RayV

[2011.08.02 00:11:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Roaming

[2010.09.11 21:11:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\TeamViewer

[2009.08.15 14:51:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Viewpoint

[2012.01.20 19:34:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\{DCD48218-E972-4d0c-9E5F-43462BC13E3B}

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.04.15 19:35:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Adobe

[2012.05.21 23:46:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\AOL

[2012.05.21 17:44:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Babylon

[2008.02.20 23:22:05 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Brother

[2008.02.14 15:18:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\CyberLink

[2009.04.25 21:52:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Desktopicon

[2008.12.25 00:02:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\dvdcss

[2012.05.11 14:31:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Freemium

[2008.04.16 17:52:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Help

[2011.08.01 23:15:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\HEM Data

[2011.09.17 12:48:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\HoldemManager

[2012.02.17 18:12:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\ICQ

[2008.02.15 15:08:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\ICQ Toolbar

[2009.04.17 16:36:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\ICQLite

[2008.02.14 14:37:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Identities

[2008.02.15 14:33:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\InstallShield

[2011.10.18 17:17:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Jens Lorek

[2008.02.15 14:35:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Macromedia

[2010.02.21 14:41:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Malwarebytes

[2012.04.15 19:35:44 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Microsoft

[2009.04.14 16:01:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\mIRC

[2012.04.11 15:14:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Mozilla

[2011.09.05 23:10:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Mozilla-Cache

[2011.11.24 19:35:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\PacificPoker

[2010.10.03 21:51:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\RayV

[2011.08.02 00:11:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Roaming

[2012.04.16 15:51:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Skype

[2011.08.08 00:54:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\skypePM

[2008.02.18 18:11:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Sun

[2010.10.12 19:16:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\teamspeak2

[2010.09.11 21:11:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\TeamViewer

[2008.10.27 18:19:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Ventrilo

[2009.08.15 14:51:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Viewpoint

[2008.04.17 16:50:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\vlc

[2008.02.17 18:09:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\WinRAR

[2012.05.21 23:45:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\You've Got Pictures Screensaver

 
 < %APPDATA%\*.exe /s >

[2008.09.03 17:11:11 | 000,323,936 | ---- | M] (Octoshape ApS) -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe

[2011.10.18 17:17:02 | 000,034,494 | R--- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Microsoft\Installer\{24F5BFDD-18E0-41F6-8A68-A22C742FC4A1}\_6FEFF9B68218417F98F549.exe

[2012.03.06 00:24:24 | 000,009,158 | R--- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Microsoft\Installer\{47EA4DDF-FD99-46B3-846C-9F3F315268AD}\_6FEFF9B68218417F98F549.exe

[2012.03.06 00:24:24 | 000,009,158 | R--- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Microsoft\Installer\{47EA4DDF-FD99-46B3-846C-9F3F315268AD}\_B06349111D5E7CEE2A3C50.exe

[2012.03.06 00:24:24 | 000,009,158 | R--- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Microsoft\Installer\{47EA4DDF-FD99-46B3-846C-9F3F315268AD}\_BBE843A4210D005E08B21E.exe

[2012.03.06 00:24:24 | 000,009,158 | R--- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Microsoft\Installer\{47EA4DDF-FD99-46B3-846C-9F3F315268AD}\_ECF5B0A15121D905E30873.exe

[2012.01.27 20:54:09 | 000,034,494 | R--- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Microsoft\Installer\{6B48554C-9089-4177-A38D-B8FE122F11FC}\_6FEFF9B68218417F98F549.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2004.08.10 14:00:00 | 017,006,491 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2008.08.19 16:27:39 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2008.08.19 16:27:39 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

 
 < MD5 for: ATAPI.SYS  >

[2004.08.10 14:00:00 | 017,006,491 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2008.08.19 16:27:39 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2008.08.19 16:27:39 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2004.08.03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

[2004.08.10 14:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll

[2004.08.10 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

 
 < MD5 for: NETLOGON.DLL  >

[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll

[2004.08.10 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll

[2004.08.10 14:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2005.03.02 20:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll

[2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll

[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll

[2004.08.10 14:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll

[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll

[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll

[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

[2004.08.10 14:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2004.08.10 14:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2004.08.10 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2004.08.10 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.02.14 15:09:47 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav

[2008.02.14 15:09:47 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav

[2008.02.14 15:09:47 | 000,450,560 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[20 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 146 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CB0AACC9

@Alternate Data Stream - 143 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2

@Alternate Data Stream - 115 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8
 

< End of report >

--- --- ---

[/code]

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

DRV - File not found [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\xpsec.sys -- (xpsec)

DRV - File not found [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\xcpip.sys -- (xcpip)

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=109986&babsrc=SP_ss&mntrId=a0ed97790000000000000019dbc2cad6

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ATU2&o=14670&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=T8&apn_dtid=YYYYYYYYDE&apn_uid=30d11c04-714e-49fc-b675-c4596f09a4f5&apn_sauid=0A4B73D3-1F66-4D8B-94DD-DD0187EA0C7F

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = http://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = 

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=109986&babsrc=HP_ss&mntrId=a0ed97790000000000000019dbc2cad6

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\URLSearchHook:  - No CLSID value found

IE - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"

FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"

FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"

FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?affID=109986&babsrc=HP_ss&mntrId=a0ed97790000000000000019dbc2cad6"

FF - prefs.js..keyword.URL: "http://search.babylon.com/?affID=109986&babsrc=KW_ss&mntrId=a0ed97790000000000000019dbc2cad6&q="

[2012.05.21 17:44:43 | 000,002,313 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml

O3 - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.

O3 - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.

O3 - HKU\S-1-5-21-1214440339-484763869-839522115-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1214440339-484763869-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1214440339-484763869-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008.02.14 14:32:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

[2012.05.21 17:44:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Babylon

[2012.05.21 17:44:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Babylon

[2012.05.21 17:44:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon

[2012.05.21 17:44:59 | 000,000,237 | ---- | C] () -- C:\user.js

[2008.02.15 15:08:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\ICQ Toolbar

@Alternate Data Stream - 146 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CB0AACC9

@Alternate Data Stream - 143 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2

@Alternate Data Stream - 115 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Code:



All processes killed

========== OTL ==========

Error: Unable to stop service xpsec!

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xpsec deleted successfully.

File C:\WINDOWS\system32\drivers\xpsec.sys not found.

Error: Unable to stop service xcpip!

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xcpip deleted successfully.

File C:\WINDOWS\system32\drivers\xcpip.sys not found.

Registry key HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.

Registry key HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.

Registry key HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.

Registry key HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}\ not found.

HKU\S-1-5-21-1214440339-484763869-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!

HKU\S-1-5-21-1214440339-484763869-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

Registry value HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.

HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Prefs.js: "Search the web (Babylon)" removed from browser.search.defaultenginename

Prefs.js: "Search the web (Babylon)" removed from browser.search.order.1

Prefs.js: "Search the web (Babylon)" removed from browser.search.selectedEngine

Prefs.js: "hxxp://search.babylon.com/?affID=109986&babsrc=HP_ss&mntrId=a0ed97790000000000000019dbc2cad6" removed from browser.startup.homepage

Prefs.js: "hxxp://search.babylon.com/?affID=109986&babsrc=KW_ss&mntrId=a0ed97790000000000000019dbc2cad6&q=" removed from keyword.URL

C:\Programme\Mozilla Firefox\searchplugins\babylon.xml moved successfully.

Registry value HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{472734EA-242A-422B-ADF8-83D1E48CC825} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ not found.

Registry value HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.

Registry value HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.

Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.

Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\AUTOEXEC.BAT moved successfully.

C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\HtmlScreens folder moved successfully.

C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup folder moved successfully.

C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Babylon folder moved successfully.

C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Babylon folder moved successfully.

C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon folder moved successfully.

C:\user.js moved successfully.

C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\ICQ Toolbar folder moved successfully.

ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CB0AACC9 deleted successfully.

ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2 deleted successfully.

ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8 deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

->Flash cache emptied: 35 bytes

 

User: Besitzer

->Temp folder emptied: 6561470023 bytes

->Temporary Internet Files folder emptied: 29117068 bytes

->Java cache emptied: 22755315 bytes

->FireFox cache emptied: 149074359 bytes

->Flash cache emptied: 9790558 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 352980 bytes

 

User: mrpgrey

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: postgres

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 1225817 bytes

%systemroot%\System32 .tmp files removed: 21690943 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 24518743 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 6.504,00 mb

 

 

[EMPTYFLASH]

 

User: All Users

->Flash cache emptied: 0 bytes

 

User: Besitzer

->Flash cache emptied: 0 bytes

 

User: Default User

 

User: LocalService

 

User: mrpgrey

 

User: NetworkService

 

User: postgres

 

Total Flash Files Cleaned = 0,00 mb

 

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.43.1 log created on 05232012_223112
 

Files\Folders moved on Reboot...

C:\WINDOWS\temp\1e39981a moved successfully.

C:\WINDOWS\temp\1e4d8fcc moved successfully.

C:\WINDOWS\temp\2c96148e moved successfully.

C:\WINDOWS\temp\c9d8ca moved successfully.
 

Registry entries deleted on Reboot...

ARGH! Merke grad, dass ich den AntivirGuard nicht gestoppt hab... soll ichs nochmal machen?

Sry 4 Doppelpost,
habs nun nochmal ohne Guard gemacht.

Code:



All processes killed

========== OTL ==========

Error: Unable to stop service xpsec!

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xpsec deleted successfully.

File C:\WINDOWS\system32\drivers\xpsec.sys not found.

Error: Unable to stop service xcpip!

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xcpip deleted successfully.

File C:\WINDOWS\system32\drivers\xcpip.sys not found.

Registry key HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.

Registry key HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.

Registry key HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.

Registry key HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}\ not found.

HKU\S-1-5-21-1214440339-484763869-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!

HKU\S-1-5-21-1214440339-484763869-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

Registry value HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\ not found.

HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Prefs.js: "Search the web (Babylon)" removed from browser.search.defaultenginename

Prefs.js: "Search the web (Babylon)" removed from browser.search.order.1

Prefs.js: "Search the web (Babylon)" removed from browser.search.selectedEngine

Prefs.js: "hxxp://search.babylon.com/?affID=109986&babsrc=HP_ss&mntrId=a0ed97790000000000000019dbc2cad6" removed from browser.startup.homepage

Prefs.js: "hxxp://search.babylon.com/?affID=109986&babsrc=KW_ss&mntrId=a0ed97790000000000000019dbc2cad6&q=" removed from keyword.URL

File C:\Programme\mozilla firefox\searchplugins\babylon.xml not found.

Registry value HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{472734EA-242A-422B-ADF8-83D1E48CC825} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ not found.

Registry value HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.

Registry value HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.

Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.

Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.

Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.

Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.

Registry value HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.

Registry value HKEY_USERS\S-1-5-21-1214440339-484763869-839522115-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

File C:\AUTOEXEC.BAT not found.

Folder C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Babylon\ not found.

Folder C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Babylon\ not found.

Folder C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon\ not found.

File C:\user.js not found.

Folder C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\ICQ Toolbar\ not found.

Unable to delete ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CB0AACC9 .

Unable to delete ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2 .

Unable to delete ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8 .

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

->Flash cache emptied: 35 bytes

 

User: Besitzer

->Temp folder emptied: 916853 bytes

->Temporary Internet Files folder emptied: 8694633 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 39320039 bytes

->Flash cache emptied: 947 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33505 bytes

 

User: mrpgrey

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: postgres

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 66349 bytes

RecycleBin emptied: 574 bytes

 

Total Files Cleaned = 47,00 mb

 

 

[EMPTYFLASH]

 

User: All Users

->Flash cache emptied: 0 bytes

 

User: Besitzer

->Flash cache emptied: 0 bytes

 

User: Default User

 

User: LocalService

 

User: mrpgrey

 

User: NetworkService

 

User: postgres

 

Total Flash Files Cleaned = 0,00 mb

 

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.43.1 log created on 05232012_233349
 

Files\Folders moved on Reboot...

C:\WINDOWS\temp\25b5db7f moved successfully.

C:\WINDOWS\temp\5fc344f3 moved successfully.

C:\WINDOWS\temp\714bc546 moved successfully.

C:\WINDOWS\temp\de24e5c moved successfully.
 

Registry entries deleted on Reboot...

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Code:



12:29:24.0953 5904        TDSS rootkit removing tool 2.7.37.0 May 23 2012 08:15:30

12:29:25.0203 5904        ============================================================

12:29:25.0203 5904        Current date / time: 2012/05/24 12:29:25.0203

12:29:25.0203 5904        SystemInfo:

12:29:25.0203 5904        

12:29:25.0203 5904        OS Version: 5.1.2600 ServicePack: 3.0

12:29:25.0203 5904        Product type: Workstation

12:29:25.0203 5904        ComputerName: ACER-F5DADEF16C

12:29:25.0203 5904        UserName: Besitzer

12:29:25.0203 5904        Windows directory: C:\WINDOWS

12:29:25.0203 5904        System windows directory: C:\WINDOWS

12:29:25.0203 5904        Processor architecture: Intel x86

12:29:25.0203 5904        Number of processors: 2

12:29:25.0203 5904        Page size: 0x1000

12:29:25.0203 5904        Boot type: Normal boot

12:29:25.0203 5904        ============================================================

12:29:26.0671 5904        Drive \Device\Harddisk0\DR0 - Size: 0x2E93E36000 (186.31 Gb), SectorSize: 0x200, Cylinders: 0x5F01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

12:29:26.0734 5904        ============================================================

12:29:26.0734 5904        \Device\Harddisk0\DR0:

12:29:26.0734 5904        MBR partitions:

12:29:26.0734 5904        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xBBD13E4

12:29:26.0750 5904        \Device\Harddisk0\DR0\Partition1: MBR, Type 0xB, StartLBA 0xBBD1462, BlocksNum 0xB8CC95F

12:29:26.0750 5904        ============================================================

12:29:26.0750 5904        D: <-> \Device\Harddisk0\DR0\Partition1

12:29:26.0765 5904        C: <-> \Device\Harddisk0\DR0\Partition0

12:29:26.0765 5904        ============================================================

12:29:26.0765 5904        Initialize success

12:29:26.0765 5904        ============================================================

12:30:18.0734 4480        ============================================================

12:30:18.0734 4480        Scan started

12:30:18.0734 4480        Mode: Manual; SigCheck; TDLFS; 

12:30:18.0734 4480        ============================================================

12:30:19.0062 4480        3xHybrid        (b985bd6230ac8cc7526d89ef92ce05be) C:\WINDOWS\system32\DRIVERS\3xHybrid.sys

12:30:19.0234 4480        3xHybrid - ok

12:30:19.0234 4480        Abiosdsk - ok

12:30:19.0250 4480        abp480n5 - ok

12:30:19.0296 4480        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys

12:30:19.0406 4480        ACPI - ok

12:30:19.0453 4480        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys

12:30:20.0218 4480        ACPIEC - ok

12:30:20.0218 4480        adpu160m - ok

12:30:20.0250 4480        aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

12:30:20.0375 4480        aec - ok

12:30:20.0406 4480        AFD             (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

12:30:20.0437 4480        AFD - ok

12:30:20.0437 4480        Aha154x - ok

12:30:20.0437 4480        aic78u2 - ok

12:30:20.0453 4480        aic78xx - ok

12:30:20.0484 4480        Alerter         (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll

12:30:20.0640 4480        Alerter - ok

12:30:20.0656 4480        ALG             (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe

12:30:20.0718 4480        ALG - ok

12:30:20.0718 4480        AliIde - ok

12:30:20.0765 4480        AmdK8           (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys

12:30:20.0765 4480        AmdK8 - ok

12:30:20.0765 4480        amsint - ok

12:30:20.0875 4480        AntiVirSchedulerService (9015bc03f62940527ec92d45ee89e46f) C:\Programme\Avira\AntiVir Desktop\sched.exe

12:30:20.0890 4480        AntiVirSchedulerService ( UnsignedFile.Multi.Generic ) - warning

12:30:20.0890 4480        AntiVirSchedulerService - detected UnsignedFile.Multi.Generic (1)

12:30:20.0937 4480        AntiVirService  (b8720a787c1223492e6f319465e996ce) C:\Programme\Avira\AntiVir Desktop\avguard.exe

12:30:20.0953 4480        AntiVirService ( UnsignedFile.Multi.Generic ) - warning

12:30:20.0953 4480        AntiVirService - detected UnsignedFile.Multi.Generic (1)

12:30:21.0031 4480        AOL ACS         (85180cf88c5ebad73b452a43a004ca51) C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe

12:30:21.0031 4480        AOL ACS - ok

12:30:21.0078 4480        AppMgmt         (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll

12:30:21.0140 4480        AppMgmt - ok

12:30:21.0156 4480        asc - ok

12:30:21.0156 4480        asc3350p - ok

12:30:21.0171 4480        asc3550 - ok

12:30:21.0296 4480        aspnet_state    (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

12:30:21.0375 4480        aspnet_state - ok

12:30:21.0390 4480        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

12:30:21.0515 4480        AsyncMac - ok

12:30:21.0531 4480        atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

12:30:21.0687 4480        atapi - ok

12:30:21.0703 4480        Atdisk - ok

12:30:21.0718 4480        Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

12:30:21.0875 4480        Atmarpc - ok

12:30:21.0921 4480        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll

12:30:22.0078 4480        AudioSrv - ok

12:30:22.0109 4480        audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

12:30:22.0250 4480        audstub - ok

12:30:22.0281 4480        avgio           (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys

12:30:22.0296 4480        avgio - ok

12:30:22.0328 4480        avgntflt        (14fe36d8f2c6a2435275338d061a0b66) C:\WINDOWS\system32\DRIVERS\avgntflt.sys

12:30:22.0375 4480        avgntflt - ok

12:30:22.0406 4480        avipbb          (6d52060b59e7d79cd2a044b6add1f1ef) C:\WINDOWS\system32\DRIVERS\avipbb.sys

12:30:22.0406 4480        avipbb - ok

12:30:22.0453 4480        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

12:30:22.0609 4480        Beep - ok

12:30:22.0656 4480        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll

12:30:22.0875 4480        BITS - ok

12:30:22.0906 4480        Brother XP spl Service (d3facb34fff5db91adb70987838f8ba7) C:\WINDOWS\system32\brsvc01a.exe

12:30:22.0906 4480        Brother XP spl Service - ok

12:30:22.0968 4480        Browser         (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll

12:30:23.0125 4480        Browser - ok

12:30:23.0156 4480        BrScnUsb        (92a964547b96d697e5e9ed43b4297f5a) C:\WINDOWS\system32\Drivers\BrScnUsb.sys

12:30:23.0156 4480        BrScnUsb - ok

12:30:23.0187 4480        cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

12:30:23.0343 4480        cbidf2k - ok

12:30:23.0359 4480        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

12:30:23.0515 4480        CCDECODE - ok

12:30:23.0531 4480        cd20xrnt - ok

12:30:23.0531 4480        Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

12:30:23.0687 4480        Cdaudio - ok

12:30:23.0703 4480        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

12:30:23.0875 4480        Cdfs - ok

12:30:23.0890 4480        Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

12:30:24.0046 4480        Cdrom - ok

12:30:24.0046 4480        Changer - ok

12:30:24.0078 4480        CiSvc           (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe

12:30:24.0234 4480        CiSvc - ok

12:30:24.0265 4480        ClipSrv         (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe

12:30:24.0437 4480        ClipSrv - ok

12:30:24.0640 4480        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

12:30:24.0859 4480        clr_optimization_v2.0.50727_32 - ok

12:30:24.0890 4480        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

12:30:24.0953 4480        clr_optimization_v4.0.30319_32 - ok

12:30:24.0953 4480        CmdIde - ok

12:30:24.0953 4480        COMSysApp - ok

12:30:24.0968 4480        Cpqarray - ok

12:30:25.0000 4480        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll

12:30:25.0156 4480        CryptSvc - ok

12:30:25.0156 4480        dac2w2k - ok

12:30:25.0171 4480        dac960nt - ok

12:30:25.0218 4480        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll

12:30:25.0281 4480        DcomLaunch - ok

12:30:25.0312 4480        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll

12:30:25.0484 4480        Dhcp - ok

12:30:25.0515 4480        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

12:30:25.0656 4480        Disk - ok

12:30:25.0656 4480        dmadmin - ok

12:30:25.0718 4480        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys

12:30:25.0921 4480        dmboot - ok

12:30:25.0937 4480        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys

12:30:26.0062 4480        dmio - ok

12:30:26.0078 4480        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

12:30:26.0250 4480        dmload - ok

12:30:26.0281 4480        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll

12:30:26.0421 4480        dmserver - ok

12:30:26.0437 4480        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

12:30:26.0593 4480        DMusic - ok

12:30:26.0625 4480        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll

12:30:26.0640 4480        Dnscache - ok

12:30:26.0687 4480        Dot3svc         (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll

12:30:26.0828 4480        Dot3svc - ok

12:30:26.0828 4480        dpti2o - ok

12:30:26.0843 4480        drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

12:30:26.0984 4480        drmkaud - ok

12:30:27.0000 4480        EapHost         (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll

12:30:27.0156 4480        EapHost - ok

12:30:27.0234 4480        ehRecvr         (8301243bde5b6cd316d79c0191d50d9a) C:\WINDOWS\eHome\ehRecvr.exe

12:30:27.0250 4480        ehRecvr - ok

12:30:27.0296 4480        ehSched         (e774bf24a6cb798dce67ad1c8e917152) C:\WINDOWS\eHome\ehSched.exe

12:30:27.0312 4480        ehSched - ok

12:30:27.0343 4480        ERSvc           (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll

12:30:27.0500 4480        ERSvc - ok

12:30:27.0546 4480        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe

12:30:27.0578 4480        Eventlog - ok

12:30:27.0640 4480        EventSystem     (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll

12:30:27.0671 4480        EventSystem - ok

12:30:27.0718 4480        Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

12:30:27.0875 4480        Fastfat - ok

12:30:27.0921 4480        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll

12:30:27.0937 4480        FastUserSwitchingCompatibility - ok

12:30:28.0000 4480        Fax             (08b8b302af0d1b3b8543429bbac8f21f) C:\WINDOWS\system32\fxssvc.exe

12:30:28.0156 4480        Fax - ok

12:30:28.0171 4480        Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

12:30:28.0328 4480        Fdc - ok

12:30:28.0375 4480        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys

12:30:28.0531 4480        Fips - ok

12:30:28.0593 4480        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

12:30:28.0765 4480        Flpydisk - ok

12:30:28.0812 4480        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

12:30:28.0968 4480        FltMgr - ok

12:30:29.0140 4480        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

12:30:29.0156 4480        FontCache3.0.0.0 - ok

12:30:29.0171 4480        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

12:30:29.0328 4480        Fs_Rec - ok

12:30:29.0343 4480        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

12:30:29.0484 4480        Ftdisk - ok

12:30:29.0609 4480        GarenaPEngine - ok

12:30:29.0640 4480        GGSAFERDriver - ok

12:30:29.0656 4480        GMSIPCI - ok

12:30:29.0687 4480        Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

12:30:29.0843 4480        Gpc - ok

12:30:29.0890 4480        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

12:30:30.0015 4480        HDAudBus - ok

12:30:30.0062 4480        helpsvc         (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

12:30:30.0218 4480        helpsvc - ok

12:30:30.0218 4480        HidServ - ok

12:30:30.0234 4480        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

12:30:30.0375 4480        HidUsb - ok

12:30:30.0421 4480        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll

12:30:30.0578 4480        hkmsvc - ok

12:30:30.0578 4480        hpn - ok

12:30:30.0625 4480        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

12:30:30.0671 4480        HTTP - ok

12:30:30.0687 4480        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll

12:30:30.0796 4480        HTTPFilter - ok

12:30:30.0796 4480        i2omgmt - ok

12:30:30.0812 4480        i2omp - ok

12:30:30.0843 4480        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

12:30:30.0984 4480        i8042prt - ok

12:30:31.0078 4480        idsvc           (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

12:30:31.0125 4480        idsvc - ok

12:30:31.0140 4480        Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

12:30:31.0265 4480        Imapi - ok

12:30:31.0312 4480        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe

12:30:31.0468 4480        ImapiService - ok

12:30:31.0468 4480        ini910u - ok

12:30:31.0796 4480        IntcAzAudAddService (cdfd5a68a2e1caa89c5c0e0b3cb98731) C:\WINDOWS\system32\drivers\RtkHDAud.sys

12:30:31.0984 4480        IntcAzAudAddService - ok

12:30:32.0078 4480        IntelIde - ok

12:30:32.0109 4480        Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

12:30:32.0265 4480        Ip6Fw - ok

12:30:32.0296 4480        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

12:30:32.0453 4480        IpFilterDriver - ok

12:30:32.0484 4480        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

12:30:32.0625 4480        IpInIp - ok

12:30:32.0640 4480        IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

12:30:32.0796 4480        IpNat - ok

12:30:32.0812 4480        IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

12:30:32.0984 4480        IPSec - ok

12:30:33.0000 4480        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

12:30:33.0062 4480        IRENUM - ok

12:30:33.0078 4480        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys

12:30:33.0218 4480        isapnp - ok

12:30:33.0359 4480        JavaQuickStarterService (1834c96fb1f9280bcf6ddfa6de8338bf) C:\Programme\Java\jre6\bin\jqs.exe

12:30:33.0375 4480        JavaQuickStarterService - ok

12:30:33.0375 4480        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

12:30:33.0531 4480        Kbdclass - ok

12:30:33.0531 4480        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

12:30:33.0703 4480        kmixer - ok

12:30:33.0812 4480        krdpdre - ok

12:30:33.0859 4480        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

12:30:33.0875 4480        KSecDD - ok

12:30:33.0921 4480        lanmanserver    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll

12:30:33.0953 4480        lanmanserver - ok

12:30:33.0984 4480        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll

12:30:34.0000 4480        lanmanworkstation - ok

12:30:34.0015 4480        lbrtfdc - ok

12:30:34.0078 4480        LightScribeService (00944d59948596721d17510c94cd3e4f) C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

12:30:34.0093 4480        LightScribeService ( UnsignedFile.Multi.Generic ) - warning

12:30:34.0093 4480        LightScribeService - detected UnsignedFile.Multi.Generic (1)

12:30:34.0109 4480        LmHosts         (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll

12:30:34.0281 4480        LmHosts - ok

12:30:34.0343 4480        McrdSvc         (52404cc76e9d53843bdf97564bb16bed) C:\WINDOWS\ehome\mcrdsvc.exe

12:30:34.0375 4480        McrdSvc - ok

12:30:34.0375 4480        Messenger       (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll

12:30:34.0515 4480        Messenger - ok

12:30:34.0546 4480        MHN             (ded60230e3019c508769ec3c15bcda44) C:\WINDOWS\System32\mhn.dll

12:30:34.0562 4480        MHN ( UnsignedFile.Multi.Generic ) - warning

12:30:34.0562 4480        MHN - detected UnsignedFile.Multi.Generic (1)

12:30:34.0578 4480        MHNDRV          (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys

12:30:34.0578 4480        MHNDRV ( UnsignedFile.Multi.Generic ) - warning

12:30:34.0578 4480        MHNDRV - detected UnsignedFile.Multi.Generic (1)

12:30:34.0609 4480        mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

12:30:34.0765 4480        mnmdd - ok

12:30:34.0796 4480        mnmsrvc         (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe

12:30:34.0953 4480        mnmsrvc - ok

12:30:34.0984 4480        Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys

12:30:35.0140 4480        Modem - ok

12:30:35.0156 4480        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys

12:30:35.0312 4480        Mouclass - ok

12:30:35.0343 4480        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys

12:30:35.0484 4480        mouhid - ok

12:30:35.0500 4480        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

12:30:35.0656 4480        MountMgr - ok

12:30:35.0687 4480        MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe

12:30:35.0703 4480        MozillaMaintenance - ok

12:30:35.0718 4480        MPE             (c0f8e0c2c3c0437cf37c6781896dc3ec) C:\WINDOWS\system32\DRIVERS\MPE.sys

12:30:35.0859 4480        MPE - ok

12:30:35.0859 4480        mraid35x - ok

12:30:35.0906 4480        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

12:30:36.0031 4480        MRxDAV - ok

12:30:36.0093 4480        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

12:30:36.0125 4480        MRxSmb - ok

12:30:36.0156 4480        MSDTC           (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe

12:30:36.0312 4480        MSDTC - ok

12:30:36.0328 4480        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

12:30:36.0468 4480        Msfs - ok

12:30:36.0468 4480        MSIServer - ok

12:30:36.0484 4480        MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

12:30:36.0625 4480        MSKSSRV - ok

12:30:36.0703 4480        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

12:30:36.0859 4480        MSPCLOCK - ok

12:30:36.0875 4480        MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

12:30:37.0031 4480        MSPQM - ok

12:30:37.0046 4480        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

12:30:37.0187 4480        mssmbios - ok

12:30:37.0218 4480        MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

12:30:37.0343 4480        MSTEE - ok

12:30:37.0421 4480        Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

12:30:37.0484 4480        Mup - ok

12:30:37.0515 4480        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

12:30:37.0703 4480        NABTSFEC - ok

12:30:37.0750 4480        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll

12:30:37.0859 4480        napagent - ok

12:30:37.0937 4480        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

12:30:38.0093 4480        NDIS - ok

12:30:38.0125 4480        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

12:30:38.0281 4480        NdisIP - ok

12:30:38.0328 4480        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

12:30:38.0343 4480        NdisTapi - ok

12:30:38.0375 4480        Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

12:30:38.0515 4480        Ndisuio - ok

12:30:38.0531 4480        NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

12:30:38.0703 4480        NdisWan - ok

12:30:38.0750 4480        NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

12:30:38.0796 4480        NDProxy - ok

12:30:38.0828 4480        NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

12:30:38.0953 4480        NetBIOS - ok

12:30:38.0968 4480        NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

12:30:39.0093 4480        NetBT - ok

12:30:39.0156 4480        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe

12:30:39.0312 4480        NetDDE - ok

12:30:39.0312 4480        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe

12:30:39.0453 4480        NetDDEdsdm - ok

12:30:39.0484 4480        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

12:30:39.0625 4480        Netlogon - ok

12:30:39.0640 4480        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll

12:30:39.0781 4480        Netman - ok

12:30:39.0890 4480        NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

12:30:39.0890 4480        NetTcpPortSharing - ok

12:30:39.0937 4480        Nla             (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll

12:30:39.0968 4480        Nla - ok

12:30:40.0015 4480        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

12:30:40.0156 4480        Npfs - ok

12:30:40.0203 4480        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

12:30:40.0375 4480        Ntfs - ok

12:30:40.0390 4480        NtLmSsp         (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

12:30:40.0546 4480        NtLmSsp - ok

12:30:40.0609 4480        NtmsSvc         (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll

12:30:40.0750 4480        NtmsSvc - ok

12:30:40.0781 4480        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

12:30:40.0906 4480        Null - ok

12:30:41.0171 4480        nv              (10458bfc0968e7e69d77f292942b27b1) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

12:30:41.0281 4480        nv - ok

12:30:41.0390 4480        NVSvc           (f6fca6047879de7a2964757eb8b2101b) C:\WINDOWS\system32\nvsvc32.exe

12:30:41.0406 4480        NVSvc - ok

12:30:41.0437 4480        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

12:30:41.0578 4480        NwlnkFlt - ok

12:30:41.0593 4480        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

12:30:41.0765 4480        NwlnkFwd - ok

12:30:41.0812 4480        Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys

12:30:41.0937 4480        Parport - ok

12:30:41.0968 4480        PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

12:30:42.0140 4480        PartMgr - ok

12:30:42.0171 4480        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys

12:30:42.0296 4480        ParVdm - ok

12:30:42.0296 4480        PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys

12:30:42.0468 4480        PCI - ok

12:30:42.0468 4480        PCIDump - ok

12:30:42.0484 4480        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys

12:30:42.0625 4480        PCIIde - ok

12:30:42.0656 4480        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys

12:30:42.0875 4480        Pcmcia - ok

12:30:42.0875 4480        PDCOMP - ok

12:30:42.0875 4480        PDFRAME - ok

12:30:42.0890 4480        PDRELI - ok

12:30:42.0890 4480        PDRFRAME - ok

12:30:42.0890 4480        perc2 - ok

12:30:42.0906 4480        perc2hib - ok

12:30:43.0031 4480        pgsql-8.3 - ok

12:30:43.0093 4480        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe

12:30:43.0125 4480        PlugPlay - ok

12:30:43.0218 4480        PolicyAgent     (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

12:30:43.0343 4480        PolicyAgent - ok

12:30:43.0375 4480        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

12:30:43.0500 4480        PptpMiniport - ok

12:30:43.0515 4480        Processor       (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys

12:30:43.0656 4480        Processor - ok

12:30:43.0671 4480        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

12:30:43.0796 4480        ProtectedStorage - ok

12:30:43.0812 4480        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

12:30:43.0968 4480        PSched - ok

12:30:44.0000 4480        Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

12:30:44.0125 4480        Ptilink - ok

12:30:44.0156 4480        PxHelp20        (617accada2e0a0f43ec6030bbac49513) C:\WINDOWS\system32\Drivers\PxHelp20.sys

12:30:44.0171 4480        PxHelp20 - ok

12:30:44.0171 4480        ql1080 - ok

12:30:44.0171 4480        Ql10wnt - ok

12:30:44.0187 4480        ql12160 - ok

12:30:44.0187 4480        ql1240 - ok

12:30:44.0187 4480        ql1280 - ok

12:30:44.0218 4480        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

12:30:44.0343 4480        RasAcd - ok

12:30:44.0375 4480        RasAuto         (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll

12:30:44.0546 4480        RasAuto - ok

12:30:44.0562 4480        Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

12:30:44.0687 4480        Rasl2tp - ok

12:30:44.0734 4480        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll

12:30:44.0859 4480        RasMan - ok

12:30:44.0875 4480        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

12:30:45.0015 4480        RasPppoe - ok

12:30:45.0031 4480        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

12:30:45.0171 4480        Raspti - ok

12:30:45.0203 4480        Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

12:30:45.0328 4480        Rdbss - ok

12:30:45.0328 4480        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

12:30:45.0468 4480        RDPCDD - ok

12:30:45.0500 4480        rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

12:30:45.0625 4480        rdpdr - ok

12:30:45.0687 4480        RDPWD           (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys

12:30:45.0718 4480        RDPWD - ok

12:30:45.0750 4480        RDSessMgr       (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe

12:30:45.0890 4480        RDSessMgr - ok

12:30:46.0015 4480        redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys

12:30:46.0171 4480        redbook - ok

12:30:46.0187 4480        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll

12:30:46.0328 4480        RemoteAccess - ok

12:30:46.0359 4480        RemoteRegistry  (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll

12:30:46.0500 4480        RemoteRegistry - ok

12:30:46.0625 4480        RichVideo       (bd517c7fb119997effbe39d5e4b37b05) C:\Programme\CyberLink\Shared Files\RichVideo.exe

12:30:46.0640 4480        RichVideo ( UnsignedFile.Multi.Generic ) - warning

12:30:46.0640 4480        RichVideo - detected UnsignedFile.Multi.Generic (1)

12:30:46.0671 4480        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe

12:30:46.0812 4480        RpcLocator - ok

12:30:46.0859 4480        RpcSs           (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll

12:30:46.0875 4480        RpcSs - ok

12:30:46.0921 4480        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe

12:30:47.0046 4480        RSVP - ok

12:30:47.0093 4480        RTLE8023xp      (bb0ae2171f08129f4f3ff9df20ffbf89) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys

12:30:47.0125 4480        RTLE8023xp - ok

12:30:47.0171 4480        SamSs           (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

12:30:47.0312 4480        SamSs - ok

12:30:47.0343 4480        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe

12:30:47.0484 4480        SCardSvr - ok

12:30:47.0531 4480        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll

12:30:47.0703 4480        Schedule - ok

12:30:47.0718 4480        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

12:30:47.0781 4480        Secdrv - ok

12:30:47.0796 4480        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll

12:30:47.0921 4480        seclogon - ok

12:30:47.0937 4480        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll

12:30:48.0078 4480        SENS - ok

12:30:48.0109 4480        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys

12:30:48.0265 4480        Serial - ok

12:30:48.0296 4480        Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

12:30:48.0437 4480        Sfloppy - ok

12:30:48.0484 4480        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll

12:30:48.0609 4480        SharedAccess - ok

12:30:48.0656 4480        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll

12:30:48.0671 4480        ShellHWDetection - ok

12:30:48.0687 4480        Simbad - ok

12:30:48.0750 4480        SkypeUpdate     (6128e98eaaed364ed1a32708d2fd22cb) C:\Programme\Skype\Updater\Updater.exe

12:30:48.0765 4480        SkypeUpdate - ok

12:30:48.0796 4480        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

12:30:48.0937 4480        SLIP - ok

12:30:48.0937 4480        Sparrow - ok

12:30:48.0953 4480        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

12:30:49.0109 4480        splitter - ok

12:30:49.0140 4480        Spooler         (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe

12:30:49.0156 4480        Spooler - ok

12:30:49.0171 4480        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys

12:30:49.0234 4480        sr - ok

12:30:49.0265 4480        srservice       (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll

12:30:49.0343 4480        srservice - ok

12:30:49.0375 4480        Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

12:30:49.0421 4480        Srv - ok

12:30:49.0437 4480        SSDPSRV         (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll

12:30:49.0500 4480        SSDPSRV - ok

12:30:49.0546 4480        ssmdrv          (5ec550b8952882ee856b862cf648522d) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

12:30:49.0546 4480        ssmdrv - ok

12:30:49.0609 4480        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll

12:30:49.0718 4480        stisvc - ok

12:30:49.0750 4480        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

12:30:49.0890 4480        streamip - ok

12:30:49.0906 4480        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

12:30:50.0031 4480        swenum - ok

12:30:50.0046 4480        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

12:30:50.0187 4480        swmidi - ok

12:30:50.0187 4480        SwPrv - ok

12:30:50.0187 4480        symc810 - ok

12:30:50.0203 4480        symc8xx - ok

12:30:50.0203 4480        sym_hi - ok

12:30:50.0203 4480        sym_u3 - ok

12:30:50.0234 4480        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

12:30:50.0375 4480        sysaudio - ok

12:30:50.0406 4480        SysmonLog       (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe

12:30:50.0546 4480        SysmonLog - ok

12:30:50.0640 4480        SystemStore     (1a78d70d7a02c920a18843426682899b) C:\Programme\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe

12:30:50.0656 4480        SystemStore ( UnsignedFile.Multi.Generic ) - warning

12:30:50.0656 4480        SystemStore - detected UnsignedFile.Multi.Generic (1)

12:30:50.0703 4480        TapiSrv         (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll

12:30:50.0812 4480        TapiSrv - ok

12:30:50.0875 4480        Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

12:30:50.0921 4480        Tcpip - ok

12:30:50.0953 4480        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

12:30:51.0109 4480        TDPIPE - ok

12:30:51.0125 4480        TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

12:30:51.0250 4480        TDTCP - ok

12:30:51.0312 4480        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

12:30:51.0421 4480        TermDD - ok

12:30:51.0484 4480        TermService     (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll

12:30:51.0640 4480        TermService - ok

12:30:51.0640 4480        TfFsMon - ok

12:30:51.0640 4480        TfNetMon - ok

12:30:51.0656 4480        TfSysMon - ok

12:30:51.0687 4480        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll

12:30:51.0703 4480        Themes - ok

12:30:51.0750 4480        TlntSvr         (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\system32\tlntsvr.exe

12:30:51.0812 4480        TlntSvr - ok

12:30:51.0812 4480        TosIde - ok

12:30:51.0843 4480        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll

12:30:52.0000 4480        TrkWks - ok

12:30:52.0031 4480        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

12:30:52.0156 4480        Udfs - ok

12:30:52.0171 4480        ultra - ok

12:30:52.0203 4480        UMWdf           (9651e5d850b6f6bd7c77c70aa06f02bf) C:\WINDOWS\system32\wdfmgr.exe

12:30:52.0218 4480        UMWdf - ok

12:30:52.0281 4480        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

12:30:52.0421 4480        Update - ok

12:30:52.0468 4480        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll

12:30:52.0531 4480        upnphost - ok

12:30:52.0562 4480        UPS             (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe

12:30:52.0703 4480        UPS - ok

12:30:52.0718 4480        usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

12:30:52.0875 4480        usbccgp - ok

12:30:52.0906 4480        usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

12:30:53.0046 4480        usbehci - ok

12:30:53.0078 4480        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

12:30:53.0218 4480        usbhub - ok

12:30:53.0234 4480        usbohci         (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

12:30:53.0343 4480        usbohci - ok

12:30:53.0359 4480        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

12:30:53.0484 4480        usbprint - ok

12:30:53.0500 4480        usbstor         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

12:30:53.0625 4480        usbstor - ok

12:30:53.0640 4480        VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

12:30:53.0750 4480        VgaSave - ok

12:30:53.0765 4480        ViaIde - ok

12:30:53.0781 4480        VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys

12:30:53.0906 4480        VolSnap - ok

12:30:53.0968 4480        VSS             (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe

12:30:54.0015 4480        VSS - ok

12:30:54.0062 4480        W32Time         (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll

12:30:54.0187 4480        W32Time - ok

12:30:54.0218 4480        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

12:30:54.0343 4480        Wanarp - ok

12:30:54.0375 4480        wanatw          (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys

12:30:54.0406 4480        wanatw - ok

12:30:54.0406 4480        WDICA - ok

12:30:54.0437 4480        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

12:30:54.0578 4480        wdmaud - ok

12:30:54.0609 4480        WebClient       (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll

12:30:54.0765 4480        WebClient - ok

12:30:54.0843 4480        winmgmt         (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll

12:30:54.0953 4480        winmgmt - ok

12:30:55.0000 4480        WmdmPmSN        (b9715b9c18bc6c8f4b66733d208cc9f7) C:\WINDOWS\system32\MsPMSNSv.dll

12:30:55.0015 4480        WmdmPmSN - ok

12:30:55.0093 4480        Wmi             (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll

12:30:55.0125 4480        Wmi - ok

12:30:55.0156 4480        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe

12:30:55.0265 4480        WmiApSrv - ok

12:30:55.0453 4480        WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

12:30:55.0515 4480        WPFFontCache_v0400 - ok

12:30:55.0578 4480        WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

12:30:55.0703 4480        WS2IFSL - ok

12:30:55.0750 4480        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll

12:30:55.0875 4480        wscsvc - ok

12:30:55.0921 4480        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

12:30:56.0031 4480        WSTCODEC - ok

12:30:56.0046 4480        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll

12:30:56.0156 4480        wuauserv - ok

12:30:56.0218 4480        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll

12:30:56.0375 4480        WZCSVC - ok

12:30:56.0390 4480        xcpip - ok

12:30:56.0406 4480        xmlprov         (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll

12:30:56.0531 4480        xmlprov - ok

12:30:56.0531 4480        xpsec - ok

12:30:56.0562 4480        MBR (0x1B8)     (eeadaf356113e54427e990a5bcad82b5) \Device\Harddisk0\DR0

12:30:56.0562 4480        \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - infected

12:30:56.0562 4480        \Device\Harddisk0\DR0 - detected Rootkit.Boot.Sinowal.b (0)

12:30:56.0640 4480        Boot (0x1200)   (b137f492af53146361b746e889df95bb) \Device\Harddisk0\DR0\Partition0

12:30:56.0640 4480        \Device\Harddisk0\DR0\Partition0 - ok

12:30:56.0656 4480        Boot (0x1200)   (c6ae6dc64faf9b3d8a9ccac454dd624f) \Device\Harddisk0\DR0\Partition1

12:30:56.0656 4480        \Device\Harddisk0\DR0\Partition1 - ok

12:30:56.0656 4480        ============================================================

12:30:56.0656 4480        Scan finished

12:30:56.0656 4480        ============================================================

12:30:56.0781 1812        Detected object count: 8

12:30:56.0781 1812        Actual detected object count: 8

12:31:51.0015 1812        AntiVirSchedulerService ( UnsignedFile.Multi.Generic ) - skipped by user

12:31:51.0015 1812        AntiVirSchedulerService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:31:51.0015 1812        AntiVirService ( UnsignedFile.Multi.Generic ) - skipped by user

12:31:51.0015 1812        AntiVirService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:31:51.0015 1812        LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user

12:31:51.0015 1812        LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:31:51.0015 1812        MHN ( UnsignedFile.Multi.Generic ) - skipped by user

12:31:51.0015 1812        MHN ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:31:51.0015 1812        MHNDRV ( UnsignedFile.Multi.Generic ) - skipped by user

12:31:51.0015 1812        MHNDRV ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:31:51.0031 1812        RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user

12:31:51.0031 1812        RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:31:51.0031 1812        SystemStore ( UnsignedFile.Multi.Generic ) - skipped by user

12:31:51.0031 1812        SystemStore ( UnsignedFile.Multi.Generic ) - User select action: Skip 

12:31:51.0031 1812        \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - skipped by user

12:31:51.0031 1812        \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - User select action: Skip

Obwohl Avir eig. aus was steht oben was mit Antivir... naja, warsch. nicht so tragisch.

Zitat:

12:31:51.0031 1812 \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - skipped by user

Das Root/Bootkit Sinowal bitte mit dem TDSS-Killer löschen lassen, starte Windows danach neu und mach ein neues Log mit diesem Tool. Poste es wieder mit CODE-Tags umschlossen.

besser später als nie..

Code:



16:47:56.0750 3608        TDSS rootkit removing tool 2.7.38.0 May 25 2012 17:35:31

16:47:57.0312 3608        ============================================================

16:47:57.0312 3608        Current date / time: 2012/05/28 16:47:57.0312

16:47:57.0312 3608        SystemInfo:

16:47:57.0312 3608        

16:47:57.0312 3608        OS Version: 5.1.2600 ServicePack: 3.0

16:47:57.0312 3608        Product type: Workstation

16:47:57.0312 3608        ComputerName: ACER-F5DADEF16C

16:47:57.0312 3608        UserName: Besitzer

16:47:57.0312 3608        Windows directory: C:\WINDOWS

16:47:57.0312 3608        System windows directory: C:\WINDOWS

16:47:57.0312 3608        Processor architecture: Intel x86

16:47:57.0312 3608        Number of processors: 2

16:47:57.0312 3608        Page size: 0x1000

16:47:57.0312 3608        Boot type: Normal boot

16:47:57.0312 3608        ============================================================

16:48:00.0453 3608        Drive \Device\Harddisk0\DR0 - Size: 0x2E93E36000 (186.31 Gb), SectorSize: 0x200, Cylinders: 0x5F01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

16:48:00.0546 3608        Drive \Device\Harddisk6\DR13 - Size: 0x1DD60000 (0.47 Gb), SectorSize: 0x200, Cylinders: 0x3C, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

16:48:00.0546 3608        ============================================================

16:48:00.0546 3608        \Device\Harddisk0\DR0:

16:48:00.0546 3608        MBR partitions:

16:48:00.0546 3608        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xBBD13E4

16:48:00.0562 3608        \Device\Harddisk0\DR0\Partition1: MBR, Type 0xB, StartLBA 0xBBD1462, BlocksNum 0xB8CC95F

16:48:00.0562 3608        \Device\Harddisk6\DR13:

16:48:00.0562 3608        MBR partitions:

16:48:00.0562 3608        \Device\Harddisk6\DR13\Partition0: MBR, Type 0xE, StartLBA 0x20, BlocksNum 0xEEAE0

16:48:00.0562 3608        ============================================================

16:48:00.0562 3608        D: <-> \Device\Harddisk0\DR0\Partition1

16:48:00.0593 3608        C: <-> \Device\Harddisk0\DR0\Partition0

16:48:00.0593 3608        ============================================================

16:48:00.0593 3608        Initialize success

16:48:00.0593 3608        ============================================================

16:48:04.0281 2116        ============================================================

16:48:04.0281 2116        Scan started

16:48:04.0281 2116        Mode: Manual; SigCheck; TDLFS; 

16:48:04.0281 2116        ============================================================

16:48:05.0218 2116        3xHybrid        (b985bd6230ac8cc7526d89ef92ce05be) C:\WINDOWS\system32\DRIVERS\3xHybrid.sys

16:48:06.0500 2116        3xHybrid - ok

16:48:06.0515 2116        Abiosdsk - ok

16:48:06.0515 2116        abp480n5 - ok

16:48:06.0562 2116        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys

16:48:07.0343 2116        ACPI - ok

16:48:07.0359 2116        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys

16:48:07.0531 2116        ACPIEC - ok

16:48:07.0531 2116        adpu160m - ok

16:48:07.0578 2116        aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

16:48:07.0750 2116        aec - ok

16:48:07.0765 2116        AFD             (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

16:48:07.0812 2116        AFD - ok

16:48:07.0812 2116        Aha154x - ok

16:48:07.0828 2116        aic78u2 - ok

16:48:07.0828 2116        aic78xx - ok

16:48:07.0859 2116        Alerter         (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll

16:48:08.0031 2116        Alerter - ok

16:48:08.0046 2116        ALG             (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe

16:48:08.0125 2116        ALG - ok

16:48:08.0125 2116        AliIde - ok

16:48:08.0156 2116        AmdK8           (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys

16:48:08.0203 2116        AmdK8 - ok

16:48:08.0203 2116        amsint - ok

16:48:08.0296 2116        AntiVirSchedulerService (9015bc03f62940527ec92d45ee89e46f) C:\Programme\Avira\AntiVir Desktop\sched.exe

16:48:08.0312 2116        AntiVirSchedulerService ( UnsignedFile.Multi.Generic ) - warning

16:48:08.0312 2116        AntiVirSchedulerService - detected UnsignedFile.Multi.Generic (1)

16:48:08.0359 2116        AntiVirService  (b8720a787c1223492e6f319465e996ce) C:\Programme\Avira\AntiVir Desktop\avguard.exe

16:48:08.0390 2116        AntiVirService ( UnsignedFile.Multi.Generic ) - warning

16:48:08.0390 2116        AntiVirService - detected UnsignedFile.Multi.Generic (1)

16:48:08.0453 2116        AOL ACS         (85180cf88c5ebad73b452a43a004ca51) C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe

16:48:08.0468 2116        AOL ACS - ok

16:48:08.0515 2116        AppMgmt         (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll

16:48:08.0593 2116        AppMgmt - ok

16:48:08.0609 2116        asc - ok

16:48:08.0609 2116        asc3350p - ok

16:48:08.0609 2116        asc3550 - ok

16:48:08.0734 2116        aspnet_state    (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

16:48:08.0750 2116        aspnet_state - ok

16:48:08.0781 2116        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

16:48:08.0921 2116        AsyncMac - ok

16:48:08.0937 2116        atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

16:48:09.0109 2116        atapi - ok

16:48:09.0109 2116        Atdisk - ok

16:48:09.0125 2116        Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

16:48:09.0312 2116        Atmarpc - ok

16:48:09.0343 2116        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll

16:48:09.0515 2116        AudioSrv - ok

16:48:09.0546 2116        audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

16:48:09.0718 2116        audstub - ok

16:48:09.0750 2116        avgio           (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys

16:48:09.0765 2116        avgio - ok

16:48:09.0796 2116        avgntflt        (14fe36d8f2c6a2435275338d061a0b66) C:\WINDOWS\system32\DRIVERS\avgntflt.sys

16:48:09.0859 2116        avgntflt - ok

16:48:09.0890 2116        avipbb          (6d52060b59e7d79cd2a044b6add1f1ef) C:\WINDOWS\system32\DRIVERS\avipbb.sys

16:48:09.0906 2116        avipbb - ok

16:48:09.0921 2116        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

16:48:10.0109 2116        Beep - ok

16:48:10.0156 2116        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll

16:48:10.0406 2116        BITS - ok

16:48:10.0421 2116        Brother XP spl Service (d3facb34fff5db91adb70987838f8ba7) C:\WINDOWS\system32\brsvc01a.exe

16:48:10.0468 2116        Brother XP spl Service - ok

16:48:10.0500 2116        Browser         (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll

16:48:10.0687 2116        Browser - ok

16:48:10.0906 2116        BrScnUsb        (92a964547b96d697e5e9ed43b4297f5a) C:\WINDOWS\system32\Drivers\BrScnUsb.sys

16:48:10.0937 2116        BrScnUsb - ok

16:48:10.0968 2116        cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

16:48:11.0140 2116        cbidf2k - ok

16:48:11.0156 2116        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

16:48:11.0328 2116        CCDECODE - ok

16:48:11.0328 2116        cd20xrnt - ok

16:48:11.0359 2116        Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

16:48:11.0531 2116        Cdaudio - ok

16:48:11.0562 2116        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

16:48:11.0750 2116        Cdfs - ok

16:48:11.0781 2116        Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

16:48:11.0953 2116        Cdrom - ok

16:48:11.0953 2116        Changer - ok

16:48:11.0984 2116        CiSvc           (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe

16:48:12.0140 2116        CiSvc - ok

16:48:12.0187 2116        ClipSrv         (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe

16:48:12.0390 2116        ClipSrv - ok

16:48:12.0484 2116        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

16:48:12.0562 2116        clr_optimization_v2.0.50727_32 - ok

16:48:12.0625 2116        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

16:48:12.0703 2116        clr_optimization_v4.0.30319_32 - ok

16:48:12.0703 2116        CmdIde - ok

16:48:12.0718 2116        COMSysApp - ok

16:48:12.0718 2116        Cpqarray - ok

16:48:12.0750 2116        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll

16:48:12.0890 2116        CryptSvc - ok

16:48:12.0906 2116        dac2w2k - ok

16:48:12.0906 2116        dac960nt - ok

16:48:12.0968 2116        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll

16:48:13.0046 2116        DcomLaunch - ok

16:48:13.0078 2116        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll

16:48:13.0265 2116        Dhcp - ok

16:48:13.0281 2116        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

16:48:13.0484 2116        Disk - ok

16:48:13.0484 2116        dmadmin - ok

16:48:13.0546 2116        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys

16:48:13.0750 2116        dmboot - ok

16:48:13.0765 2116        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys

16:48:13.0921 2116        dmio - ok

16:48:13.0937 2116        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

16:48:14.0109 2116        dmload - ok

16:48:14.0140 2116        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll

16:48:14.0312 2116        dmserver - ok

16:48:14.0328 2116        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

16:48:14.0484 2116        DMusic - ok

16:48:14.0515 2116        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll

16:48:14.0562 2116        Dnscache - ok

16:48:14.0625 2116        Dot3svc         (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll

16:48:14.0781 2116        Dot3svc - ok

16:48:14.0781 2116        dpti2o - ok

16:48:14.0781 2116        drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

16:48:14.0953 2116        drmkaud - ok

16:48:15.0046 2116        EapHost         (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll

16:48:15.0234 2116        EapHost - ok

16:48:15.0734 2116        ehRecvr         (8301243bde5b6cd316d79c0191d50d9a) C:\WINDOWS\eHome\ehRecvr.exe

16:48:15.0937 2116        ehRecvr - ok

16:48:16.0000 2116        ehSched         (e774bf24a6cb798dce67ad1c8e917152) C:\WINDOWS\eHome\ehSched.exe

16:48:16.0062 2116        ehSched - ok

16:48:16.0125 2116        ERSvc           (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll

16:48:16.0281 2116        ERSvc - ok

16:48:16.0312 2116        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe

16:48:16.0343 2116        Eventlog - ok

16:48:16.0406 2116        EventSystem     (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll

16:48:16.0484 2116        EventSystem - ok

16:48:16.0515 2116        Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

16:48:16.0703 2116        Fastfat - ok

16:48:16.0734 2116        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll

16:48:16.0796 2116        FastUserSwitchingCompatibility - ok

16:48:16.0843 2116        Fax             (08b8b302af0d1b3b8543429bbac8f21f) C:\WINDOWS\system32\fxssvc.exe

16:48:17.0015 2116        Fax - ok

16:48:17.0031 2116        Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

16:48:17.0203 2116        Fdc - ok

16:48:17.0234 2116        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys

16:48:17.0390 2116        Fips - ok

16:48:17.0406 2116        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

16:48:17.0578 2116        Flpydisk - ok

16:48:17.0609 2116        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

16:48:17.0750 2116        FltMgr - ok

16:48:17.0859 2116        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

16:48:17.0875 2116        FontCache3.0.0.0 - ok

16:48:17.0906 2116        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

16:48:18.0062 2116        Fs_Rec - ok

16:48:18.0078 2116        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

16:48:18.0234 2116        Ftdisk - ok

16:48:18.0312 2116        GarenaPEngine - ok

16:48:18.0359 2116        GGSAFERDriver - ok

16:48:18.0359 2116        GMSIPCI - ok

16:48:18.0421 2116        Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

16:48:18.0593 2116        Gpc - ok

16:48:18.0625 2116        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

16:48:18.0765 2116        HDAudBus - ok

16:48:18.0796 2116        helpsvc         (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

16:48:18.0968 2116        helpsvc - ok

16:48:18.0984 2116        HidServ - ok

16:48:19.0015 2116        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

16:48:19.0234 2116        HidUsb - ok

16:48:19.0265 2116        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll

16:48:19.0421 2116        hkmsvc - ok

16:48:19.0421 2116        hpn - ok

16:48:19.0468 2116        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

16:48:19.0531 2116        HTTP - ok

16:48:19.0546 2116        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll

16:48:19.0718 2116        HTTPFilter - ok

16:48:19.0718 2116        i2omgmt - ok

16:48:19.0718 2116        i2omp - ok

16:48:19.0750 2116        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

16:48:19.0906 2116        i8042prt - ok

16:48:20.0000 2116        idsvc           (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

16:48:20.0062 2116        idsvc - ok

16:48:20.0078 2116        Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

16:48:20.0218 2116        Imapi - ok

16:48:20.0250 2116        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe

16:48:20.0406 2116        ImapiService - ok

16:48:20.0406 2116        ini910u - ok

16:48:20.0703 2116        IntcAzAudAddService (cdfd5a68a2e1caa89c5c0e0b3cb98731) C:\WINDOWS\system32\drivers\RtkHDAud.sys

16:48:20.0984 2116        IntcAzAudAddService - ok

16:48:21.0062 2116        IntelIde - ok

16:48:21.0093 2116        Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

16:48:21.0281 2116        Ip6Fw - ok

16:48:21.0296 2116        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

16:48:21.0468 2116        IpFilterDriver - ok

16:48:21.0500 2116        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

16:48:21.0656 2116        IpInIp - ok

16:48:21.0671 2116        IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

16:48:21.0828 2116        IpNat - ok

16:48:21.0843 2116        IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

16:48:22.0031 2116        IPSec - ok

16:48:22.0046 2116        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

16:48:22.0109 2116        IRENUM - ok

16:48:22.0125 2116        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys

16:48:22.0296 2116        isapnp - ok

16:48:22.0437 2116        JavaQuickStarterService (1834c96fb1f9280bcf6ddfa6de8338bf) C:\Programme\Java\jre6\bin\jqs.exe

16:48:22.0453 2116        JavaQuickStarterService - ok

16:48:22.0468 2116        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

16:48:22.0656 2116        Kbdclass - ok

16:48:22.0671 2116        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

16:48:22.0828 2116        kmixer - ok

16:48:22.0921 2116        krdpdre - ok

16:48:22.0953 2116        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

16:48:23.0046 2116        KSecDD - ok

16:48:23.0093 2116        lanmanserver    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll

16:48:23.0125 2116        lanmanserver - ok

16:48:23.0156 2116        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll

16:48:23.0203 2116        lanmanworkstation - ok

16:48:23.0203 2116        lbrtfdc - ok

16:48:23.0281 2116        LightScribeService (00944d59948596721d17510c94cd3e4f) C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

16:48:23.0281 2116        LightScribeService ( UnsignedFile.Multi.Generic ) - warning

16:48:23.0281 2116        LightScribeService - detected UnsignedFile.Multi.Generic (1)

16:48:23.0312 2116        LmHosts         (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll

16:48:23.0468 2116        LmHosts - ok

16:48:23.0531 2116        McrdSvc         (52404cc76e9d53843bdf97564bb16bed) C:\WINDOWS\ehome\mcrdsvc.exe

16:48:23.0562 2116        McrdSvc - ok

16:48:23.0593 2116        Messenger       (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll

16:48:23.0765 2116        Messenger - ok

16:48:23.0796 2116        MHN             (ded60230e3019c508769ec3c15bcda44) C:\WINDOWS\System32\mhn.dll

16:48:23.0812 2116        MHN ( UnsignedFile.Multi.Generic ) - warning

16:48:23.0812 2116        MHN - detected UnsignedFile.Multi.Generic (1)

16:48:23.0828 2116        MHNDRV          (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys

16:48:23.0828 2116        MHNDRV ( UnsignedFile.Multi.Generic ) - warning

16:48:23.0828 2116        MHNDRV - detected UnsignedFile.Multi.Generic (1)

16:48:23.0859 2116        mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

16:48:23.0984 2116        mnmdd - ok

16:48:24.0031 2116        mnmsrvc         (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe

16:48:24.0218 2116        mnmsrvc - ok

16:48:24.0250 2116        Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys

16:48:24.0421 2116        Modem - ok

16:48:24.0437 2116        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys

16:48:24.0625 2116        Mouclass - ok

16:48:24.0656 2116        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys

16:48:24.0796 2116        mouhid - ok

16:48:24.0796 2116        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

16:48:24.0968 2116        MountMgr - ok

16:48:25.0015 2116        MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe

16:48:25.0046 2116        MozillaMaintenance - ok

16:48:25.0046 2116        MPE             (c0f8e0c2c3c0437cf37c6781896dc3ec) C:\WINDOWS\system32\DRIVERS\MPE.sys

16:48:25.0218 2116        MPE - ok

16:48:25.0218 2116        mraid35x - ok

16:48:25.0250 2116        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

16:48:25.0390 2116        MRxDAV - ok

16:48:25.0453 2116        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

16:48:25.0531 2116        MRxSmb - ok

16:48:25.0546 2116        MSDTC           (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe

16:48:25.0703 2116        MSDTC - ok

16:48:25.0718 2116        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

16:48:25.0875 2116        Msfs - ok

16:48:25.0875 2116        MSIServer - ok

16:48:25.0906 2116        MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

16:48:26.0046 2116        MSKSSRV - ok

16:48:26.0046 2116        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

16:48:26.0187 2116        MSPCLOCK - ok

16:48:26.0218 2116        MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

16:48:26.0359 2116        MSPQM - ok

16:48:26.0390 2116        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

16:48:26.0562 2116        mssmbios - ok

16:48:26.0609 2116        MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

16:48:26.0750 2116        MSTEE - ok

16:48:26.0781 2116        Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

16:48:26.0828 2116        Mup - ok

16:48:26.0843 2116        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

16:48:26.0984 2116        NABTSFEC - ok

16:48:27.0031 2116        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll

16:48:27.0187 2116        napagent - ok

16:48:27.0234 2116        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

16:48:27.0390 2116        NDIS - ok

16:48:27.0406 2116        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

16:48:27.0562 2116        NdisIP - ok

16:48:27.0593 2116        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

16:48:27.0625 2116        NdisTapi - ok

16:48:27.0656 2116        Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

16:48:27.0812 2116        Ndisuio - ok

16:48:27.0828 2116        NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

16:48:27.0984 2116        NdisWan - ok

16:48:28.0000 2116        NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

16:48:28.0046 2116        NDProxy - ok

16:48:28.0078 2116        NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

16:48:28.0203 2116        NetBIOS - ok

16:48:28.0234 2116        NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

16:48:28.0390 2116        NetBT - ok

16:48:28.0437 2116        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe

16:48:28.0593 2116        NetDDE - ok

16:48:28.0609 2116        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe

16:48:28.0750 2116        NetDDEdsdm - ok

16:48:28.0781 2116        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

16:48:28.0953 2116        Netlogon - ok

16:48:28.0984 2116        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll

16:48:29.0140 2116        Netman - ok

16:48:29.0250 2116        NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

16:48:29.0265 2116        NetTcpPortSharing - ok

16:48:29.0312 2116        Nla             (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll

16:48:29.0359 2116        Nla - ok

16:48:29.0390 2116        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

16:48:29.0546 2116        Npfs - ok

16:48:29.0625 2116        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

16:48:29.0781 2116        Ntfs - ok

16:48:29.0796 2116        NtLmSsp         (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

16:48:29.0937 2116        NtLmSsp - ok

16:48:29.0984 2116        NtmsSvc         (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll

16:48:30.0140 2116        NtmsSvc - ok

16:48:30.0171 2116        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

16:48:30.0328 2116        Null - ok

16:48:30.0593 2116        nv              (10458bfc0968e7e69d77f292942b27b1) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

16:48:30.0812 2116        nv - ok

16:48:30.0921 2116        NVSvc           (f6fca6047879de7a2964757eb8b2101b) C:\WINDOWS\system32\nvsvc32.exe

16:48:30.0953 2116        NVSvc - ok

16:48:31.0015 2116        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

16:48:31.0171 2116        NwlnkFlt - ok

16:48:31.0187 2116        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

16:48:31.0343 2116        NwlnkFwd - ok

16:48:31.0421 2116        ose             (7a56cf3e3f12e8af599963b16f50fb6a) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE

16:48:31.0437 2116        ose - ok

16:48:31.0453 2116        Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys

16:48:31.0609 2116        Parport - ok

16:48:31.0640 2116        PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

16:48:31.0796 2116        PartMgr - ok

16:48:31.0828 2116        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys

16:48:31.0953 2116        ParVdm - ok

16:48:31.0953 2116        PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys

16:48:32.0109 2116        PCI - ok

16:48:32.0109 2116        PCIDump - ok

16:48:32.0125 2116        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys

16:48:32.0281 2116        PCIIde - ok

16:48:32.0312 2116        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys

16:48:32.0437 2116        Pcmcia - ok

16:48:32.0437 2116        PDCOMP - ok

16:48:32.0437 2116        PDFRAME - ok

16:48:32.0453 2116        PDRELI - ok

16:48:32.0453 2116        PDRFRAME - ok

16:48:32.0453 2116        perc2 - ok

16:48:32.0453 2116        perc2hib - ok

16:48:32.0593 2116        pgsql-8.3 - ok

16:48:32.0625 2116        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe

16:48:32.0640 2116        PlugPlay - ok

16:48:32.0671 2116        PolicyAgent     (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

16:48:32.0812 2116        PolicyAgent - ok

16:48:32.0828 2116        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

16:48:32.0984 2116        PptpMiniport - ok

16:48:33.0000 2116        Processor       (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys

16:48:33.0156 2116        Processor - ok

16:48:33.0171 2116        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

16:48:33.0296 2116        ProtectedStorage - ok

16:48:33.0312 2116        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

16:48:33.0437 2116        PSched - ok

16:48:33.0453 2116        Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

16:48:33.0578 2116        Ptilink - ok

16:48:33.0625 2116        PxHelp20        (617accada2e0a0f43ec6030bbac49513) C:\WINDOWS\system32\Drivers\PxHelp20.sys

16:48:33.0625 2116        PxHelp20 - ok

16:48:33.0640 2116        ql1080 - ok

16:48:33.0640 2116        Ql10wnt - ok

16:48:33.0640 2116        ql12160 - ok

16:48:33.0656 2116        ql1240 - ok

16:48:33.0656 2116        ql1280 - ok

16:48:33.0656 2116        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

16:48:33.0781 2116        RasAcd - ok

16:48:33.0828 2116        RasAuto         (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll

16:48:33.0968 2116        RasAuto - ok

16:48:34.0000 2116        Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

16:48:34.0218 2116        Rasl2tp - ok

16:48:34.0265 2116        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll

16:48:34.0437 2116        RasMan - ok

16:48:34.0437 2116        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

16:48:34.0593 2116        RasPppoe - ok

16:48:34.0625 2116        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

16:48:34.0750 2116        Raspti - ok

16:48:34.0781 2116        Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

16:48:34.0937 2116        Rdbss - ok

16:48:34.0953 2116        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

16:48:35.0062 2116        RDPCDD - ok

16:48:35.0093 2116        rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

16:48:35.0218 2116        rdpdr - ok

16:48:35.0265 2116        RDPWD           (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys

16:48:35.0312 2116        RDPWD - ok

16:48:35.0359 2116        RDSessMgr       (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe

16:48:35.0500 2116        RDSessMgr - ok

16:48:35.0531 2116        redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys

16:48:35.0671 2116        redbook - ok

16:48:35.0703 2116        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll

16:48:35.0843 2116        RemoteAccess - ok

16:48:35.0859 2116        RemoteRegistry  (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll

16:48:36.0015 2116        RemoteRegistry - ok

16:48:36.0140 2116        RichVideo       (bd517c7fb119997effbe39d5e4b37b05) C:\Programme\CyberLink\Shared Files\RichVideo.exe

16:48:36.0156 2116        RichVideo ( UnsignedFile.Multi.Generic ) - warning

16:48:36.0156 2116        RichVideo - detected UnsignedFile.Multi.Generic (1)

16:48:36.0171 2116        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe

16:48:36.0328 2116        RpcLocator - ok

16:48:36.0390 2116        RpcSs           (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll

16:48:36.0421 2116        RpcSs - ok

16:48:36.0453 2116        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe

16:48:36.0593 2116        RSVP - ok

16:48:36.0640 2116        RTLE8023xp      (bb0ae2171f08129f4f3ff9df20ffbf89) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys

16:48:36.0687 2116        RTLE8023xp - ok

16:48:36.0718 2116        SamSs           (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe

16:48:36.0875 2116        SamSs - ok

16:48:36.0921 2116        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe

16:48:37.0078 2116        SCardSvr - ok

16:48:37.0125 2116        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll

16:48:37.0265 2116        Schedule - ok

16:48:37.0296 2116        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

16:48:37.0359 2116        Secdrv - ok

16:48:37.0390 2116        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll

16:48:37.0578 2116        seclogon - ok

16:48:37.0593 2116        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll

16:48:37.0750 2116        SENS - ok

16:48:37.0781 2116        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys

16:48:37.0921 2116        Serial - ok

16:48:37.0937 2116        Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

16:48:38.0093 2116        Sfloppy - ok

16:48:38.0156 2116        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll

16:48:38.0296 2116        SharedAccess - ok

16:48:38.0343 2116        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll

16:48:38.0359 2116        ShellHWDetection - ok

16:48:38.0359 2116        Simbad - ok

16:48:38.0437 2116        SkypeUpdate     (6128e98eaaed364ed1a32708d2fd22cb) C:\Programme\Skype\Updater\Updater.exe

16:48:38.0453 2116        SkypeUpdate - ok

16:48:38.0500 2116        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

16:48:38.0671 2116        SLIP - ok

16:48:38.0671 2116        Sparrow - ok

16:48:38.0687 2116        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

16:48:38.0828 2116        splitter - ok

16:48:38.0875 2116        Spooler         (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe

16:48:38.0906 2116        Spooler - ok

16:48:38.0937 2116        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys

16:48:39.0000 2116        sr - ok

16:48:39.0046 2116        srservice       (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll

16:48:39.0109 2116        srservice - ok

16:48:39.0140 2116        Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

16:48:39.0187 2116        Srv - ok

16:48:39.0234 2116        SSDPSRV         (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll

16:48:39.0296 2116        SSDPSRV - ok

16:48:39.0328 2116        ssmdrv          (5ec550b8952882ee856b862cf648522d) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

16:48:39.0343 2116        ssmdrv - ok

16:48:39.0406 2116        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll

16:48:39.0562 2116        stisvc - ok

16:48:39.0609 2116        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

16:48:39.0781 2116        streamip - ok

16:48:39.0796 2116        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

16:48:39.0921 2116        swenum - ok

16:48:39.0937 2116        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

16:48:40.0078 2116        swmidi - ok

16:48:40.0078 2116        SwPrv - ok

16:48:40.0093 2116        symc810 - ok

16:48:40.0093 2116        symc8xx - ok

16:48:40.0093 2116        sym_hi - ok

16:48:40.0109 2116        sym_u3 - ok

16:48:40.0125 2116        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

16:48:40.0250 2116        sysaudio - ok

16:48:40.0281 2116        SysmonLog       (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe

16:48:40.0453 2116        SysmonLog - ok

16:48:40.0546 2116        SystemStore     (1a78d70d7a02c920a18843426682899b) C:\Programme\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe

16:48:40.0562 2116        SystemStore ( UnsignedFile.Multi.Generic ) - warning

16:48:40.0562 2116        SystemStore - detected UnsignedFile.Multi.Generic (1)

16:48:40.0609 2116        TapiSrv         (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll

16:48:40.0750 2116        TapiSrv - ok

16:48:40.0796 2116        Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

16:48:40.0843 2116        Tcpip - ok

16:48:40.0890 2116        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

16:48:41.0046 2116        TDPIPE - ok

16:48:41.0046 2116        TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

16:48:41.0187 2116        TDTCP - ok

16:48:41.0218 2116        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

16:48:41.0375 2116        TermDD - ok

16:48:41.0421 2116        TermService     (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll

16:48:41.0578 2116        TermService - ok

16:48:41.0578 2116        TfFsMon - ok

16:48:41.0593 2116        TfNetMon - ok

16:48:41.0593 2116        TfSysMon - ok

16:48:41.0640 2116        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll

16:48:41.0640 2116        Themes - ok

16:48:41.0687 2116        TlntSvr         (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\system32\tlntsvr.exe

16:48:41.0750 2116        TlntSvr - ok

16:48:41.0750 2116        TosIde - ok

16:48:41.0796 2116        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll

16:48:41.0937 2116        TrkWks - ok

16:48:41.0968 2116        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

16:48:42.0109 2116        Udfs - ok

16:48:42.0125 2116        ultra - ok

16:48:42.0156 2116        UMWdf           (9651e5d850b6f6bd7c77c70aa06f02bf) C:\WINDOWS\system32\wdfmgr.exe

16:48:42.0203 2116        UMWdf - ok

16:48:42.0250 2116        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

16:48:42.0390 2116        Update - ok

16:48:42.0437 2116        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll

16:48:42.0515 2116        upnphost - ok

16:48:42.0546 2116        UPS             (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe

16:48:42.0718 2116        UPS - ok

16:48:42.0765 2116        usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

16:48:42.0906 2116        usbccgp - ok

16:48:42.0953 2116        usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

16:48:43.0078 2116        usbehci - ok

16:48:43.0093 2116        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

16:48:43.0250 2116        usbhub - ok

16:48:43.0265 2116        usbohci         (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

16:48:43.0406 2116        usbohci - ok

16:48:43.0421 2116        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

16:48:43.0593 2116        usbprint - ok

16:48:43.0609 2116        usbstor         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

16:48:43.0765 2116        usbstor - ok

16:48:43.0765 2116        VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

16:48:43.0875 2116        VgaSave - ok

16:48:43.0890 2116        ViaIde - ok

16:48:43.0921 2116        VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys

16:48:44.0109 2116        VolSnap - ok

16:48:44.0171 2116        VSS             (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe

16:48:44.0265 2116        VSS - ok

16:48:44.0312 2116        W32Time         (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll

16:48:44.0453 2116        W32Time - ok

16:48:44.0484 2116        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

16:48:44.0640 2116        Wanarp - ok

16:48:44.0687 2116        wanatw          (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys

16:48:44.0734 2116        wanatw - ok

16:48:44.0734 2116        WDICA - ok

16:48:44.0750 2116        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

16:48:44.0890 2116        wdmaud - ok

16:48:44.0921 2116        WebClient       (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll

16:48:45.0093 2116        WebClient - ok

16:48:45.0187 2116        winmgmt         (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll

16:48:45.0328 2116        winmgmt - ok

16:48:45.0359 2116        WmdmPmSN        (b9715b9c18bc6c8f4b66733d208cc9f7) C:\WINDOWS\system32\MsPMSNSv.dll

16:48:45.0390 2116        WmdmPmSN - ok

16:48:45.0453 2116        Wmi             (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll

16:48:45.0531 2116        Wmi - ok

16:48:45.0562 2116        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe

16:48:45.0703 2116        WmiApSrv - ok

16:48:45.0875 2116        WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

16:48:45.0921 2116        WPFFontCache_v0400 - ok

16:48:45.0968 2116        WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

16:48:46.0109 2116        WS2IFSL - ok

16:48:46.0312 2116        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll

16:48:46.0500 2116        wscsvc - ok

16:48:46.0578 2116        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

16:48:46.0703 2116        WSTCODEC - ok

16:48:46.0718 2116        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll

16:48:46.0875 2116        wuauserv - ok

16:48:47.0296 2116        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll

16:48:47.0500 2116        WZCSVC - ok

16:48:47.0500 2116        xcpip - ok

16:48:47.0531 2116        xmlprov         (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll

16:48:47.0687 2116        xmlprov - ok

16:48:47.0687 2116        xpsec - ok

16:48:47.0703 2116        MBR (0x1B8)     (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0

16:48:48.0203 2116        \Device\Harddisk0\DR0 - ok

16:48:48.0218 2116        MBR (0x1B8)     (65e858a8a0293be11a920b0bc99d695e) \Device\Harddisk6\DR13

16:48:49.0187 2116        \Device\Harddisk6\DR13 - ok

16:48:49.0203 2116        Boot (0x1200)   (b137f492af53146361b746e889df95bb) \Device\Harddisk0\DR0\Partition0

16:48:49.0218 2116        \Device\Harddisk0\DR0\Partition0 - ok

16:48:49.0250 2116        Boot (0x1200)   (c50d5712cef1a0b1dcb6fe8945cb8afd) \Device\Harddisk0\DR0\Partition1

16:48:49.0250 2116        \Device\Harddisk0\DR0\Partition1 - ok

16:48:49.0265 2116        Boot (0x1200)   (eca493ba57436cb4a85cd0f9f24e0487) \Device\Harddisk6\DR13\Partition0

16:48:49.0265 2116        \Device\Harddisk6\DR13\Partition0 - ok

16:48:49.0265 2116        ============================================================

16:48:49.0265 2116        Scan finished

16:48:49.0265 2116        ============================================================

16:48:49.0375 2636        Detected object count: 7

16:48:49.0375 2636        Actual detected object count: 7

16:48:53.0281 2636        AntiVirSchedulerService ( UnsignedFile.Multi.Generic ) - skipped by user

16:48:53.0281 2636        AntiVirSchedulerService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:48:53.0296 2636        AntiVirService ( UnsignedFile.Multi.Generic ) - skipped by user

16:48:53.0296 2636        AntiVirService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:48:53.0296 2636        LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user

16:48:53.0296 2636        LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:48:53.0296 2636        MHN ( UnsignedFile.Multi.Generic ) - skipped by user

16:48:53.0296 2636        MHN ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:48:53.0296 2636        MHNDRV ( UnsignedFile.Multi.Generic ) - skipped by user

16:48:53.0296 2636        MHNDRV ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:48:53.0296 2636        RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user

16:48:53.0296 2636        RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:48:53.0296 2636        SystemStore ( UnsignedFile.Multi.Generic ) - skipped by user

16:48:53.0296 2636        SystemStore ( UnsignedFile.Multi.Generic ) - User select action: Skip 

16:49:02.0171 3532        Deinitialize success

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Combofix Logfile:

Code:

ComboFix 12-05-30.02 - Besitzer 30.05.2012  13:14:14.1.2 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1023.540 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\Besitzer\Desktop\ComboFix.exe

AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP

c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP\DFC5A2B2.TMP

c:\dokumente und einstellungen\Besitzer\Anwendungsdaten\~ygw.tmp

c:\dokumente und einstellungen\Besitzer\Anwendungsdaten\Desktopicon

c:\dokumente und einstellungen\Besitzer\Anwendungsdaten\Roaming

c:\dokumente und einstellungen\Besitzer\Anwendungsdaten\Roaming\HoldemManager\config\FTPRushTables.xml

c:\dokumente und einstellungen\Besitzer\WINDOWS

c:\dokumente und einstellungen\mrpgrey\ntuser.tmp

c:\windows\IsUn0407.exe

c:\windows\unin0407.exe

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_xcpip

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-04-28 bis 2012-05-30  ))))))))))))))))))))))))))))))

.

.

2012-05-28 12:49 . 2012-05-28 12:49        --------        d-----w-        C:\TDSSKiller_Quarantine

2012-05-24 13:44 . 2012-05-24 13:44        1409        ----a-w-        c:\windows\QTFont.for

2012-05-23 21:18 . 2012-05-23 21:18        --------        d-----w-        c:\programme\AOL 9.0 VR

2012-05-23 20:31 . 2012-05-23 20:31        --------        d-----w-        C:\_OTL

2012-05-21 21:44 . 2004-05-10 19:05        153088        ----a-w-        c:\windows\system32\jgdwmie.dll

2012-05-21 21:44 . 2004-05-10 19:05        1060864        ----a-w-        c:\windows\system32\mfc71.dll

2012-05-21 21:43 . 2012-05-23 21:25        --------        d-----w-        c:\programme\Gemeinsame Dateien\aolshare

2012-05-21 21:43 . 2012-05-23 12:10        --------        d-----w-        c:\programme\AOL 9.0

2012-05-21 18:11 . 2012-05-21 18:11        --------        d-sh--w-        c:\dokumente und einstellungen\NetworkService\IETldCache

2012-05-21 07:37 . 2012-05-21 07:37        --------        d-----w-        c:\windows\system32\wbem\Repository

2012-05-21 07:36 . 2012-05-21 07:37        --------        d-----w-        c:\programme\Freemium

2012-05-11 12:32 . 2012-05-11 12:32        --------        d-----w-        c:\dokumente und einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Freemium TubeBox

2012-05-11 12:31 . 2012-05-11 12:31        --------        d-----w-        c:\dokumente und einstellungen\Besitzer\Anwendungsdaten\Freemium

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-05-23 20:20 . 2011-06-24 16:46        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-04-11 13:51 . 2004-08-04 00:50        2029056        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2012-04-11 13:51 . 2004-08-10 12:00        2150912        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-04-11 13:51 . 2004-08-10 12:00        1862400        ----a-w-        c:\windows\system32\win32k.sys

2012-05-21 19:40 . 2012-04-11 13:11        97208        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AOL Fast Start"="c:\programme\AOL 9.0 VRa\AOL.EXE" [2007-06-21 50480]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 16126464]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-06-15 6803456]

"nwiz"="nwiz.exe" [2005-06-15 1519616]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-06-15 86016]

"Microsoft Works Update Detection"="c:\programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-17 50688]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"AOLDialer"="c:\programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe" [2007-06-21 70952]

"HostManager"="c:\programme\Gemeinsame Dateien\AOL\1337806936\ee\AOLSoftware.exe" [2006-09-26 50736]

"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2012-05-21 98304]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Status Monitor.lnk]

path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Status Monitor.lnk

backup=c:\windows\pss\Status Monitor.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^DOKUME~1^ALLUSE~1^Startmenü^Programme^Autostart^AOL 9.0 Tray-Symbol.lnk]

path=c:\dokume~1\ALLUSE~1\Startmenü\Programme\Autostart\AOL 9.0 Tray-Symbol.lnk

backup=c:\windows\pss\AOL 9.0 Tray-Symbol.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^DOKUME~1^ALLUSE~1^Startmenü^Programme^Autostart^Microsoft Office.lnk]

path=c:\dokume~1\ALLUSE~1\Startmenü\Programme\Autostart\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-04-04 05:53        843712        ----a-w-        c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0]

2005-05-17 16:42        933888        ------w-        c:\programme\Brother\ControlCenter2\brctrcen.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDTray]

2004-09-03 08:58        65536        ------w-        c:\programme\Ahead\ODD Toolkit\dvdtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]

2006-12-05 21:55        54832        ----a-w-        c:\programme\CyberLink\PowerDVD\Language\Language.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 02:22        1695232        ------w-        c:\programme\Messenger\msmsgs.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2001-07-09 10:50        155648        ----a-w-        c:\windows\system32\NeroCheck.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]

2006-02-13 16:33        214648        ----a-w-        c:\programme\Octoshape Streaming Services\Besitzer\OctoshapeClient.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2012-05-21 21:45        98304        ----a-w-        c:\programme\QuickTime\qttask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

2006-11-23 14:10        56928        ------w-        c:\programme\CyberLink\PowerDVD\PDVDServ.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt]

2005-01-26 17:02        49152        ------w-        c:\programme\Brother\Brmfl05a\BrStDvPt.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

2012-02-29 06:55        17148552        ----a-r-        c:\programme\Skype\Phone\Skype.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-02-18 09:43        248040        ----a-w-        c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"RichVideo"=2 (0x2)

"LightScribeService"=2 (0x2)

"Browser Defender Update Service"=2 (0x2)

"sdCoreService"=3 (0x3)

"sdAuxService"=3 (0x3)

"Brother XP spl Service"=2 (0x2)

"SkypeUpdate"=2 (0x2)

"SystemStore"=2 (0x2)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programme\\Gemeinsame Dateien\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"=

"c:\\Programme\\Gemeinsame Dateien\\aol\\Loader\\aolload.exe"=

"c:\\Programme\\Gemeinsame Dateien\\aol\\System Information\\sinf.exe"=

"c:\\Programme\\Gamers.IRC\\mirc.exe"=

"c:\\Programme\\Octoshape Streaming Services\\Besitzer\\OctoshapeClient.exe"=

"c:\\Programme\\Ocean Technologies & Media\\GG E-Sports Platform\\Garena.exe"=

"c:\\mIRC\\mirc.exe"=

"c:\\Programme\\Messenger\\msmsgs.exe"=

"d:\\Eigene Dateien\\HL2_UK\\hl2.exe"=

"c:\\Programme\\Java\\jre1.6.0_03\\bin\\javaw.exe"=

"c:\\Programme\\Trillian\\trillian.exe"=

"c:\\Programme\\Warcraft III\\Warcraft III.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Programme\\Java\\jre6\\bin\\javaw.exe"=

"c:\\Programme\\Veetle\\Player\\VeetleNet.exe"=

"c:\\Programme\\Skype\\Phone\\Skype.exe"=

"c:\\Programme\\Gemeinsame Dateien\\AOL\\ACS\\AOLAcsd.exe"=

"c:\\Programme\\Gemeinsame Dateien\\AOL\\ACS\\AOLDial.exe"=

"c:\\Programme\\AOL 9.0\\waol.exe"=

"c:\\Programme\\Gemeinsame Dateien\\aol\\1337806936\\ee\\aolsoftware.exe"=

"c:\\Programme\\AOL 9.0 VRa\\waol.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5432:TCP"= 5432:TCP:postgres

"3389:TCP"= 3389:TCP:Remote Desktop

"65533:TCP"= 65533:TCP:Services

"52344:TCP"= 52344:TCP:Services

.

R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [x]

R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 GarenaPEngine;GarenaPEngine;c:\dokume~1\Besitzer\LOKALE~1\Temp\PRFCC8.tmp [x]

R3 GGSAFERDriver;GGSAFER Driver;c:\programme\Garena\safedrv.sys [x]

R3 krdpdre;krdpdre;c:\dokume~1\Besitzer\LOKALE~1\Temp\krdpdre.sys [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\programme\Mozilla Maintenance Service\maintenanceservice.exe [2012-05-21 129976]

R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [x]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R3 xpsec;IPSEC-Treiber;c:\windows\system32\drivers\xpsec.sys [x]

R4 SkypeUpdate;Skype Updater;c:\programme\Skype\Updater\Updater.exe [2012-02-29 158856]

R4 SystemStore;System Store;c:\programme\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe [2012-04-24 14848]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]

S2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\programme\PostgreSQL\8.3\bin\pg_ctl.exe [2008-02-01 65536]

S3 3xHybrid;Pinnacle PCTV 300i Stereo DVB-T;c:\windows\system32\DRIVERS\3xHybrid.sys [2006-06-13 969728]

.

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

TCP: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\dokumente und einstellungen\Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\5uwxdfjn.default\

FF - prefs.js: browser.search.selectedEngine - 

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109986

FF - user.js: extensions.BabylonToolbar_i.babExt - 

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar_i.id - a0ed97790000000000000019dbc2cad6

FF - user.js: extensions.BabylonToolbar_i.hardId - a0ed97790000000000000019dbc2cad6

FF - user.js: extensions.BabylonToolbar_i.instlDay - 15481

FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1717:44

FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar_i.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9

FF - user.js: extensions.BabylonToolbar_i.instlRef - sst

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

MSConfigStartUp-Adobe Reader Speed Launcher - c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe

MSConfigStartUp-ApnUpdater - c:\programme\Ask.com\Updater\Updater.exe

MSConfigStartUp-DW6 - c:\programme\The Weather Channel FW\Desktop\DesktopWeather.exe

MSConfigStartUp-Guard.Mail.ru - c:\programme\Guard-ICQ\GuardICQ.exe

MSConfigStartUp-ICQ - c:\programme\ICQ7.7\ICQ.exe

MSConfigStartUp-ISTray - c:\programme\Spyware Doctor\pctsTray.exe

MSConfigStartUp-Performance Center - c:\programme\Ascentive\Performance Center\APCMain.exe

MSConfigStartUp-RealTray - c:\programme\Real\RealPlayer\RealPlay.exe

MSConfigStartUp-Steam - c:\programme\Steam\Steam.exe

AddRemove-AIM LINK - c:\progra~1\GEMEIN~1\aolshare\AIM\UNWISE.EXE

AddRemove-The Weather Channel Desktop 6 - c:\programme\The Weather Channel FW\Desktop\TheWeatherChannelCustomUninstall.exe

AddRemove-William Hill Poker - c:\poker\William Hill Poker\_SetupPoker_585002_en.exe

AddRemove-Octoshape add-in for Adobe Flash Player - c:\dokumente und einstellungen\Besitzer\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-05-30 13:27

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]

"ImagePath"="\??\c:\dokume~1\Besitzer\LOKALE~1\Temp\PRFCC8.tmp"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*]

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'explorer.exe'(3928)

c:\programme\Gemeinsame Dateien\AOL\ACS\WLHook.dll

c:\windows\system32\webcheck.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\programme\Avira\AntiVir Desktop\avguard.exe

c:\programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe

c:\windows\eHome\ehRecvr.exe

c:\windows\eHome\ehSched.exe

c:\programme\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\windows\RTHDCPL.EXE

c:\programme\AOL 9.0 VRa\waol.exe

c:\programme\PostgreSQL\8.3\bin\postgres.exe

c:\programme\PostgreSQL\8.3\bin\postgres.exe

c:\windows\eHome\ehmsas.exe

c:\programme\PostgreSQL\8.3\bin\postgres.exe

c:\programme\PostgreSQL\8.3\bin\postgres.exe

c:\programme\PostgreSQL\8.3\bin\postgres.exe

c:\programme\PostgreSQL\8.3\bin\postgres.exe

c:\windows\ehome\mcrdsvc.exe

c:\windows\system32\dllhost.exe

c:\programme\AOL 9.0 VRa\shellmon.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-05-30  13:31:34 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-05-30 11:31

.

Vor Suchlauf: 19 Verzeichnis(se), 26.127.790.080 Bytes frei

Nach Suchlauf: 20 Verzeichnis(se), 26.635.870.208 Bytes frei

.

- - End Of File - - 001490D74EF8294F043D1BE2691434CB

--- --- ---

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

Firefox::

FF - ProfilePath - c:\dokumente und einstellungen\Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\5uwxdfjn.default\

FF - prefs.js: browser.search.selectedEngine - 

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109986

FF - user.js: extensions.BabylonToolbar_i.babExt - 

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar_i.id - a0ed97790000000000000019dbc2cad6

FF - user.js: extensions.BabylonToolbar_i.hardId - a0ed97790000000000000019dbc2cad6

FF - user.js: extensions.BabylonToolbar_i.instlDay - 15481

FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1717:44

FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar_i.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9

FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
 

Registry::

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5432:TCP"=-

"3389:TCP"=-

"65533:TCP"=-

"52344:TCP"=-

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Combofix Logfile:

Code:

ComboFix 12-05-30.02 - Besitzer 30.05.2012  13:59:34.2.2 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1023.631 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\Besitzer\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Besitzer\Desktop\CFScript.txt

AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-04-28 bis 2012-05-30  ))))))))))))))))))))))))))))))

.

.

2012-05-28 12:49 . 2012-05-28 12:49        --------        d-----w-        C:\TDSSKiller_Quarantine

2012-05-24 13:44 . 2012-05-24 13:44        1409        ----a-w-        c:\windows\QTFont.for

2012-05-23 21:18 . 2012-05-23 21:18        --------        d-----w-        c:\programme\AOL 9.0 VR

2012-05-23 20:31 . 2012-05-23 20:31        --------        d-----w-        C:\_OTL

2012-05-21 21:44 . 2004-05-10 19:05        153088        ----a-w-        c:\windows\system32\jgdwmie.dll

2012-05-21 21:44 . 2004-05-10 19:05        1060864        ----a-w-        c:\windows\system32\mfc71.dll

2012-05-21 21:43 . 2012-05-23 21:25        --------        d-----w-        c:\programme\Gemeinsame Dateien\aolshare

2012-05-21 21:43 . 2012-05-23 12:10        --------        d-----w-        c:\programme\AOL 9.0

2012-05-21 18:11 . 2012-05-21 18:11        --------        d-sh--w-        c:\dokumente und einstellungen\NetworkService\IETldCache

2012-05-21 07:37 . 2012-05-21 07:37        --------        d-----w-        c:\windows\system32\wbem\Repository

2012-05-21 07:36 . 2012-05-21 07:37        --------        d-----w-        c:\programme\Freemium

2012-05-11 12:32 . 2012-05-11 12:32        --------        d-----w-        c:\dokumente und einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Freemium TubeBox

2012-05-11 12:31 . 2012-05-11 12:31        --------        d-----w-        c:\dokumente und einstellungen\Besitzer\Anwendungsdaten\Freemium

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-05-23 20:20 . 2011-06-24 16:46        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-04-11 13:51 . 2004-08-04 00:50        2029056        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2012-04-11 13:51 . 2004-08-10 12:00        2150912        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-04-11 13:51 . 2004-08-10 12:00        1862400        ----a-w-        c:\windows\system32\win32k.sys

2012-05-21 19:40 . 2012-04-11 13:11        97208        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AOL Fast Start"="c:\programme\AOL 9.0 VRa\AOL.EXE" [2007-06-21 50480]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 16126464]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-06-15 6803456]

"nwiz"="nwiz.exe" [2005-06-15 1519616]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-06-15 86016]

"Microsoft Works Update Detection"="c:\programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-17 50688]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"AOLDialer"="c:\programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe" [2007-06-21 70952]

"HostManager"="c:\programme\Gemeinsame Dateien\AOL\1337806936\ee\AOLSoftware.exe" [2006-09-26 50736]

"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2012-05-21 98304]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Status Monitor.lnk]

path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Status Monitor.lnk

backup=c:\windows\pss\Status Monitor.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^DOKUME~1^ALLUSE~1^Startmenü^Programme^Autostart^AOL 9.0 Tray-Symbol.lnk]

path=c:\dokume~1\ALLUSE~1\Startmenü\Programme\Autostart\AOL 9.0 Tray-Symbol.lnk

backup=c:\windows\pss\AOL 9.0 Tray-Symbol.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^DOKUME~1^ALLUSE~1^Startmenü^Programme^Autostart^Microsoft Office.lnk]

path=c:\dokume~1\ALLUSE~1\Startmenü\Programme\Autostart\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-04-04 05:53        843712        ----a-w-        c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0]

2005-05-17 16:42        933888        ------w-        c:\programme\Brother\ControlCenter2\brctrcen.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDTray]

2004-09-03 08:58        65536        ------w-        c:\programme\Ahead\ODD Toolkit\dvdtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]

2006-12-05 21:55        54832        ----a-w-        c:\programme\CyberLink\PowerDVD\Language\Language.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 02:22        1695232        ------w-        c:\programme\Messenger\msmsgs.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2001-07-09 10:50        155648        ----a-w-        c:\windows\system32\NeroCheck.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]

2006-02-13 16:33        214648        ----a-w-        c:\programme\Octoshape Streaming Services\Besitzer\OctoshapeClient.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2012-05-21 21:45        98304        ----a-w-        c:\programme\QuickTime\qttask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

2006-11-23 14:10        56928        ------w-        c:\programme\CyberLink\PowerDVD\PDVDServ.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt]

2005-01-26 17:02        49152        ------w-        c:\programme\Brother\Brmfl05a\BrStDvPt.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

2012-02-29 06:55        17148552        ----a-r-        c:\programme\Skype\Phone\Skype.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-02-18 09:43        248040        ----a-w-        c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"RichVideo"=2 (0x2)

"LightScribeService"=2 (0x2)

"Browser Defender Update Service"=2 (0x2)

"sdCoreService"=3 (0x3)

"sdAuxService"=3 (0x3)

"Brother XP spl Service"=2 (0x2)

"SkypeUpdate"=2 (0x2)

"SystemStore"=2 (0x2)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programme\\Gemeinsame Dateien\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"=

"c:\\Programme\\Gemeinsame Dateien\\aol\\Loader\\aolload.exe"=

"c:\\Programme\\Gemeinsame Dateien\\aol\\System Information\\sinf.exe"=

"c:\\Programme\\Gamers.IRC\\mirc.exe"=

"c:\\Programme\\Octoshape Streaming Services\\Besitzer\\OctoshapeClient.exe"=

"c:\\Programme\\Ocean Technologies & Media\\GG E-Sports Platform\\Garena.exe"=

"c:\\mIRC\\mirc.exe"=

"c:\\Programme\\Messenger\\msmsgs.exe"=

"d:\\Eigene Dateien\\HL2_UK\\hl2.exe"=

"c:\\Programme\\Java\\jre1.6.0_03\\bin\\javaw.exe"=

"c:\\Programme\\Trillian\\trillian.exe"=

"c:\\Programme\\Warcraft III\\Warcraft III.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Programme\\Java\\jre6\\bin\\javaw.exe"=

"c:\\Programme\\Veetle\\Player\\VeetleNet.exe"=

"c:\\Programme\\Skype\\Phone\\Skype.exe"=

"c:\\Programme\\Gemeinsame Dateien\\AOL\\ACS\\AOLAcsd.exe"=

"c:\\Programme\\Gemeinsame Dateien\\AOL\\ACS\\AOLDial.exe"=

"c:\\Programme\\AOL 9.0\\waol.exe"=

"c:\\Programme\\Gemeinsame Dateien\\aol\\1337806936\\ee\\aolsoftware.exe"=

"c:\\Programme\\AOL 9.0 VRa\\waol.exe"=

.

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [26.07.2009 15:31 108289]

R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\programme\PostgreSQL\8.3\bin\pg_ctl.exe runservice -w -N "pgsql-8.3" -D "c:\programme\PostgreSQL\8.3\data\" --> c:\programme\PostgreSQL\8.3\bin\pg_ctl.exe runservice -w -N pgsql-8.3 [?]

R3 3xHybrid;Pinnacle PCTV 300i Stereo DVB-T;c:\windows\system32\drivers\3xHybrid.sys [13.06.2006 22:04 969728]

S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]

S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 14:16 130384]

S3 GarenaPEngine;GarenaPEngine;\??\c:\dokume~1\Besitzer\LOKALE~1\Temp\PRFCC8.tmp --> c:\dokume~1\Besitzer\LOKALE~1\Temp\PRFCC8.tmp [?]

S3 GGSAFERDriver;GGSAFER Driver;\??\c:\programme\Garena\safedrv.sys --> c:\programme\Garena\safedrv.sys [?]

S3 krdpdre;krdpdre;\??\c:\dokume~1\Besitzer\LOKALE~1\Temp\krdpdre.sys --> c:\dokume~1\Besitzer\LOKALE~1\Temp\krdpdre.sys [?]

S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programme\Mozilla Maintenance Service\maintenanceservice.exe [21.05.2012 21:40 129976]

S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys --> c:\windows\system32\drivers\TfNetMon.sys [?]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 14:16 753504]

S3 xpsec;IPSEC-Treiber;c:\windows\system32\drivers\xpsec.sys --> c:\windows\system32\drivers\xpsec.sys [?]

S4 SkypeUpdate;Skype Updater;c:\programme\Skype\Updater\Updater.exe [29.02.2012 08:50 158856]

S4 SystemStore;System Store;c:\programme\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe [24.04.2012 14:21 14848]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

TCP: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\dokumente und einstellungen\Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\5uwxdfjn.default\

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-05-30 14:07

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]

"ImagePath"="\??\c:\dokume~1\Besitzer\LOKALE~1\Temp\PRFCC8.tmp"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*]

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'explorer.exe'(2712)

c:\windows\system32\webcheck.dll

.

Zeit der Fertigstellung: 2012-05-30  14:09:04

ComboFix-quarantined-files.txt  2012-05-30 12:09

ComboFix2.txt  2012-05-30 11:31

.

Vor Suchlauf: 19 Verzeichnis(se), 26.588.549.120 Bytes frei

Nach Suchlauf: 20 Verzeichnis(se), 26.586.636.288 Bytes frei

.

- - End Of File - - A5E764DFB50DB304A6F659A0CB319937

--- --- ---