Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Gesperrtes Windows und Zahlungsaufforderung (https://www.trojaner-board.de/115554-gesperrtes-windows-zahlungsaufforderung.html)

Bremser 22.05.2012 06:02
Gesperrtes Windows und Zahlungsaufforderung
 
Hallo Community.

Vermutlich habe ich mir ebenfalls einen Trojaner eingefangen und würde euch sehr gerne um Hilfe bitten.

Ich nutze einen Asus eeePC mit Windows XP. Eingerichtet sind 5 Benutzerkonten. Während des Internet surferns mit einem Dumm-User Account erhielt ich plötzlich die Mitteilung Windows ist gesperrt und 100€ sind für eine Entsperrung zu zahlen. Taskmanager kann gestartet werden, wird aber durch Sperrungsmitteilung überlagert und ist nicht erreichbar.
Beim Herunterfahren ist kurzzeitig der Taskmanager sichtbar.
Ein weiterer Dumm-user und ein Admin Account funktionieren. Auch Festplattendaten scheinen nicht verändert zu sein.

Klar, irgendwas habe ich falsch gemacht. Dessen Dummheit ist mir aber nicht so offensichtlich, dass ich sagen kann: "Das wars".

Ich poste mal die Logdateien ich würde mich über Hilfe freuen.
Vielen Dank vorab an euch.

Grüße

cosinus 22.05.2012 14:07
Führ bitte auch ESET aus, danach sehen wir weiter:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Bremser 22.05.2012 23:19
Hallo Cosinus

Danke für deine erste Info.:dankeschoen:
Eset habe ich durchlaufen lassen. Die Logdatei füge ich bei.

Viele Grüße

cosinus 23.05.2012 09:41
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Bremser 24.05.2012 20:11
Hallo Arne

Ich bin mir nicht sicher, ob ich das gleiche Verständnis habe wie du. Deswegen beschreibe ich (eventuell unnötig) etwas detaillierter.

1.Dumm-User Account:
- Kein Arbeiten mehr möglich.
- Startleiste nicht erreichbar

2.Dumm-User Account:
- Einige Programme gestartet (IE, Pdf, Avira, ppt)
- Startleiste geöffnet => keine leeren Verzeichnisse, keine Auffälligkeiten gefunden
- auf der Festplatte Dateiübersicht angeschaut und 2-3 Datei geöffnet => keine Auffälligkeiten
- Virenscanner aktualisiert Virenpattern wie gehabt
- Rechner ist weder unauffällig langsam noch bootet er länger
Fazit: Keinerlei Auffälligkeiten gegenüber dem Betrieb vor dem Befall.

Admin-Account:
- wie 2.Dumm-User Account => Keine Auffälligkeiten.

Ich hoffe das hilft dir weiter.

Grüße und vielen Dank !!:dankeschoen:

cosinus 24.05.2012 22:23
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Bremser 28.05.2012 19:51
Hallo Arne
Nach dem langen Wochenende komme ich nun dazu, die Scans durchzuführen

Der Inhalt von OTL.TXT
OTL Logfile:
Code:
OTL logfile created on: 28.05.2012 20:14:27 - Run 1
OTL by OldTimer - Version 3.2.43.2    Folder = C:\Dokumente und Einstellungen\Admin\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 65,45% Memory free
3,33 Gb Paging File | 2,71 Gb Available in Paging File | 81,35% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 72,06 Gb Total Space | 26,99 Gb Free Space | 37,46% Space Free | Partition Type: NTFS
Drive D: | 72,06 Gb Total Space | 45,49 Gb Free Space | 63,13% Space Free | Partition Type: NTFS
Drive E: | 1,92 Gb Total Space | 1,92 Gb Free Space | 100,00% Space Free | Partition Type: FAT
 
Computer Name: UNSERERSTER | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.05.28 20:10:44 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Admin\Desktop\OTL.exe
PRC - [2012.05.08 21:27:58 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 21:27:57 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 21:27:57 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 21:27:57 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.02.18 16:37:16 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010.10.29 14:49:28 | 000,249,064 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2009.06.25 20:28:35 | 000,518,488 | ---- | M] (Lavasoft) -- C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2009.06.25 20:28:34 | 001,003,344 | ---- | M] (Lavasoft) -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2009.04.10 19:29:08 | 000,037,888 | ---- | M] () -- C:\Programme\Winamp\winampa.exe
PRC - [2009.01.23 09:49:53 | 000,416,768 | ---- | M] (ELANTECH Devices Corp.) -- C:\Programme\Elantech\ETDCtrl.exe
PRC - [2008.12.17 20:59:50 | 000,622,592 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\EeePC\ACPI\AsAcpiSvr.exe
PRC - [2008.12.04 14:38:06 | 000,114,688 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\EeePC\ACPI\AsTray.exe
PRC - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () -- C:\Eigene_Programme\Steuertipps\Steuer-Spar-Erklaerung 2012\AAVUpdateManager\aavus.exe
PRC - [2008.06.09 10:21:58 | 000,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
PRC - [2008.06.09 10:16:32 | 002,363,392 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe
PRC - [2008.05.21 02:56:24 | 000,094,208 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\EeePC\ACPI\AsEPCMon.exe
PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008.03.17 18:06:00 | 001,848,648 | ---- | M] (CANON INC.) -- C:\Programme\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2008.03.09 17:12:24 | 000,240,640 | ---- | M] () -- C:\Programme\AutoHotkey\AutoHotkey.exe
PRC - [2007.06.27 19:04:00 | 001,213,736 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007.06.27 19:04:00 | 000,279,848 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
PRC - [2007.06.27 19:03:40 | 000,152,872 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
PRC - [2007.06.25 08:47:24 | 001,629,480 | ---- | M] (Nero AG) -- C:\Eigene_Programme\Nero 7\InCD\NBHGui.exe
PRC - [2007.06.25 08:47:12 | 001,552,680 | ---- | M] (Nero AG) -- C:\Eigene_Programme\Nero 7\InCD\InCDsrv.exe
PRC - [2007.06.25 08:47:02 | 001,057,064 | ---- | M] (Nero AG) -- C:\Eigene_Programme\Nero 7\InCD\InCD.exe
PRC - [1999.06.27 21:38:02 | 000,794,112 | ---- | M] (Fred's Software) -- C:\Eigene_Programme\PrintKey2000\Printkey2000.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.05.11 19:57:21 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll
MOD - [2012.05.08 21:27:58 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2009.11.03 16:51:42 | 000,067,872 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll
MOD - [2009.06.25 20:28:51 | 001,630,048 | ---- | M] () -- C:\Programme\Lavasoft\Ad-Aware\Resources.dll
MOD - [2009.06.25 20:28:47 | 000,212,848 | ---- | M] () -- C:\Programme\Lavasoft\Ad-Aware\RPAPI.dll
MOD - [2009.04.10 19:29:08 | 000,037,888 | ---- | M] () -- C:\Programme\Winamp\winampa.exe
MOD - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () -- C:\Eigene_Programme\Steuertipps\Steuer-Spar-Erklaerung 2012\AAVUpdateManager\aavus.exe
MOD - [2008.09.11 00:00:06 | 000,168,960 | ---- | M] () -- C:\Programme\Lavasoft\Ad-Aware\unrar.dll
MOD - [2008.03.09 17:12:24 | 000,240,640 | ---- | M] () -- C:\Programme\AutoHotkey\AutoHotkey.exe
MOD - [2007.08.14 13:59:54 | 006,365,184 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LightScribe\QtGui4.dll
MOD - [2007.07.12 13:55:52 | 000,131,072 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2007.07.12 13:55:28 | 001,581,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LightScribe\QtCore4.dll
MOD - [2001.10.28 17:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012.05.08 21:27:58 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 21:27:57 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Programme\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2011.02.18 16:37:16 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009.06.25 20:28:34 | 001,003,344 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Eigene_Programme\Steuertipps\Steuer-Spar-Erklaerung 2012\AAVUpdateManager\aavus.exe -- (AAV UpdateService)
SRV - [2008.06.09 10:21:58 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2007.06.29 19:16:56 | 000,800,040 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Eigene_Programme\Nero 7\Nero BackItUp\NBService.exe -- (NBService)
SRV - [2007.06.27 19:04:00 | 000,279,848 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007.06.25 08:47:12 | 001,552,680 | ---- | M] (Nero AG) [Auto | Running] -- C:\Eigene_Programme\Nero 7\InCD\InCDsrv.exe -- (InCDsrv)
SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2012.05.08 21:27:58 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 21:27:58 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.06.25 20:28:46 | 000,064,160 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\Lbd.sys -- (Lbd)
DRV - [2009.02.13 10:49:30 | 005,029,376 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.12.08 18:01:56 | 000,055,136 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)
DRV - [2008.09.24 21:30:08 | 000,704,384 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rt2860.sys -- (RT80x86)
DRV - [2008.09.23 19:15:00 | 000,038,400 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\l1e51x86.sys -- (L1e)
DRV - [2008.09.18 20:44:38 | 001,326,528 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2008.08.19 16:16:36 | 000,991,656 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2008.08.19 16:16:28 | 000,047,272 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2008.08.11 10:14:12 | 001,752,704 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008.08.05 14:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2008.07.24 11:37:10 | 000,156,816 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2008.05.30 05:46:12 | 000,534,568 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2008.04.08 16:59:28 | 000,010,752 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASUSACPI.SYS -- (AsusACPI)
DRV - [2008.03.10 12:18:42 | 000,057,384 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwhid.sys -- (btwhid)
DRV - [2008.02.04 11:57:44 | 000,037,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2007.06.25 08:47:12 | 000,038,440 | ---- | M] (Nero AG) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\InCDRm.sys -- (incdrm)
DRV - [2007.06.25 08:47:12 | 000,036,776 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDPass.sys -- (InCDPass)
DRV - [2007.06.25 08:47:12 | 000,016,040 | ---- | M] (Nero AG) [Recognizer | System | Unknown] -- C:\WINDOWS\System32\drivers\InCDrec.sys -- (InCDrec)
DRV - [2007.06.25 08:47:02 | 000,119,080 | ---- | M] (Nero AG) [File_System | Disabled | Running] -- C:\WINDOWS\system32\drivers\InCDfs.sys -- (InCDfs)
DRV - [2006.01.04 09:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=109986&babsrc=HP_ss&mntrId=64d0a91b00000000000000248c9e04e8
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=109986&babsrc=SP_ss&mntrId=64d0a91b00000000000000248c9e04e8
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}: "URL" = hxxp://search.pdfcreator-toolbar.org/search?p=Q&ts=ne&w={searchTerms}&csrc=search-field
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1351351
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Eigene_Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
 
 
O1 HOSTS File: ([2008.04.14 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (PDFCreator Toolbar Helper) - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\Toolbar\WebBrowser: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Ad-Watch] C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AsusACPIServer] C:\Programme\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AsusEPCMonitor] C:\Programme\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AsusTray] C:\Programme\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [ETDWare] C:\Programme\Elantech\ETDCtrl.exe (ELANTECH Devices Corp.)
O4 - HKLM..\Run: [InCD] C:\Eigene_Programme\Nero 7\InCD\InCD.exe (Nero AG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [SecurDisc] C:\Eigene_Programme\Nero 7\InCD\NBHGui.exe (Nero AG)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe ()
O4 - HKU\S-1-5-21-970361835-3776818119-144542300-1009..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-21-970361835-3776818119-144542300-1009..\Run: [LightScribe Control Panel] C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
O4 - HKU\S-1-5-21-970361835-3776818119-144542300-1009..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil11e_ActiveX.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\Autostart\ac'tivAid.lnk = C:\Eigene_Programme\ActivAid\ac'tivAid.ahk ()
O4 - Startup: C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\Autostart\Printkey2000.lnk = C:\Eigene_Programme\PrintKey2000\Printkey2000.exe (Fred's Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{01F7AE68-DB54-41C4-AF7D-5316FB3EEF2B}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.03.02 10:12:14 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{80deda88-fb07-11de-bb63-002243e55ba0}\Shell\AutoRun\command - "" = E:\Get_Started_for_Win.exe
O33 - MountPoints2\{80deda89-fb07-11de-bb63-002243e55ba0}\Shell\AutoRun\command - "" = F:\Get_Started_for_Win.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= -  File not found
MsConfig - StartUpReg: MsnMsgr - hkey= - key= -  File not found
 
SafeBootMin: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: Lavasoft Ad-Aware Service - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: Lavasoft Ad-Aware Service - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe"
ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.05.28 20:10:43 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Admin\Desktop\OTL.exe
[2012.05.22 19:34:53 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012.05.21 20:12:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Malwarebytes
[2012.05.21 20:12:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.05.21 20:12:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.05.21 20:12:21 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.05.21 20:12:21 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.05.21 07:18:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar
[2012.05.21 07:18:09 | 000,000,000 | ---D | C] -- C:\Programme\BabylonToolbar
[2012.05.21 07:17:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\Uncompressor
[2012.05.21 07:17:55 | 000,000,000 | ---D | C] -- C:\Programme\Uncompressor
[2012.05.21 07:17:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Babylon
[2012.05.21 07:17:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2012.05.21 07:17:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Babylon
[2012.05.20 19:03:39 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2012.05.20 19:02:33 | 000,607,260 | ---- | C] (Swearware) -- C:\Dokumente und Einstellungen\Admin\Desktop\dds.scr
[2012.05.20 19:01:54 | 000,607,260 | R--- | C] (Swearware) -- C:\Dokumente und Einstellungen\Admin\Desktop\dds.com
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.05.28 20:29:00 | 000,000,458 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2012.05.28 20:10:44 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Admin\Desktop\OTL.exe
[2012.05.28 19:37:12 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.05.28 19:37:09 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.05.24 20:49:54 | 000,003,136 | ---- | M] () -- C:\WINDOWS\WINCMD.INI
[2012.05.21 20:12:23 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.21 07:18:11 | 000,001,490 | ---- | M] () -- C:\user.js
[2012.05.21 07:17:56 | 000,000,704 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Uncompressor.lnk
[2012.05.20 19:17:24 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\i73phgsk.exe
[2012.05.20 19:02:37 | 000,607,260 | ---- | M] (Swearware) -- C:\Dokumente und Einstellungen\Admin\Desktop\dds.scr
[2012.05.20 19:01:59 | 000,607,260 | R--- | M] (Swearware) -- C:\Dokumente und Einstellungen\Admin\Desktop\dds.com
[2012.05.20 18:57:22 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\defogger_reenable
[2012.05.20 18:54:59 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Defogger.exe
[2012.05.11 20:08:56 | 000,185,016 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.05.11 19:56:16 | 000,527,552 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.05.11 19:56:16 | 000,502,762 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.05.11 19:56:16 | 000,105,646 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.05.11 19:56:16 | 000,088,286 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.05.11 19:45:13 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.05.08 21:27:58 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.05.08 21:27:58 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012.04.30 11:57:16 | 000,019,178 | ---- | M] () -- C:\WINDOWS\System32\AAWService_2012_04_30_11_57_16.dmp
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.05.21 20:12:23 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.21 07:18:08 | 000,001,490 | ---- | C] () -- C:\user.js
[2012.05.21 07:17:56 | 000,000,704 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Uncompressor.lnk
[2012.05.20 19:17:24 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\i73phgsk.exe
[2012.05.20 18:57:22 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\defogger_reenable
[2012.05.20 18:54:58 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Defogger.exe
[2012.04.30 11:57:16 | 000,019,178 | ---- | C] () -- C:\WINDOWS\System32\AAWService_2012_04_30_11_57_16.dmp
[2012.02.18 11:53:34 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.06.06 23:34:55 | 000,514,960 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-970361835-3776818119-144542300-1009-0.dat
[2011.06.06 21:06:03 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.06.06 16:50:03 | 000,516,759 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-970361835-3776818119-144542300-1006-0.dat
[2011.06.06 16:50:03 | 000,184,242 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2010.09.04 14:39:43 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
 
========== LOP Check ==========
 
[2012.05.21 07:17:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Babylon
[2012.05.21 07:18:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar
[2009.12.22 18:00:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\CD-LabelPrint
[2011.06.06 14:23:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\PriceGong
[2009.05.23 21:36:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Template
[2011.06.25 22:47:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Youtube Downloader HD
[2012.03.05 10:56:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AAV
[2012.05.21 07:17:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2009.12.18 19:08:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2009.12.18 20:17:37 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEGV
[2009.12.18 20:13:04 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan
[2009.05.23 23:32:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LightScribe
[2011.10.23 21:07:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
[2012.01.21 19:11:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\VS
[2010.05.02 18:15:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009.11.25 23:28:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009.06.25 20:24:56 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
[2009.12.18 20:13:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Canon
[2011.05.08 21:23:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\PriceGong
[2009.10.11 12:37:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Template
[2011.08.31 20:53:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Youtube Downloader HD
[2012.05.28 20:29:00 | 000,000,458 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2009.05.23 22:38:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Adobe
[2009.05.23 20:06:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Ahead
[2010.02.23 22:21:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Apple Computer
[2011.10.23 21:28:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Avira
[2012.05.21 07:17:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Babylon
[2012.05.21 07:18:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar
[2009.12.22 18:00:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\CD-LabelPrint
[2010.05.15 21:43:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\dvdcss
[2010.03.02 10:15:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Identities
[2009.03.02 10:43:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\InstallShield
[2009.05.22 21:16:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Macromedia
[2012.05.21 20:12:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Malwarebytes
[2009.07.05 13:48:11 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Microsoft
[2011.06.06 20:51:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Microsoft Corporation
[2011.06.06 14:23:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\PriceGong
[2009.05.22 23:14:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Sun
[2009.05.23 21:36:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Template
[2011.06.25 22:57:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\vlc
[2010.01.10 16:31:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Winamp
[2011.06.25 22:47:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Youtube Downloader HD
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
[2001.05.24 12:59:30 | 000,162,304 | ---- | M] () -- C:\UNWISE.EXE
 
< MD5 for: AGP440.SYS  >
[2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:atapi.sys
[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008.04.14 01:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008.04.14 14:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
 
< MD5 for: IASTOR.SYS  >
[2008.09.12 07:32:56 | 000,327,192 | ---- | M] (Intel Corporation) MD5=8EF427C54497C5F8A7A645990E4278C7 -- C:\WINDOWS\I386\$OEM$\TEXTMODE\IASTOR.SYS
[2008.09.12 07:32:56 | 000,327,192 | ---- | M] (Intel Corporation) MD5=8EF427C54497C5F8A7A645990E4278C7 -- C:\WINDOWS\OemDir\iaStor.sys
[2008.09.12 07:32:56 | 000,327,192 | ---- | M] (Intel Corporation) MD5=8EF427C54497C5F8A7A645990E4278C7 -- C:\WINDOWS\system32\drivers\iaStor.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 14:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008.04.14 14:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 14:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 14:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008.04.14 14:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008.04.14 14:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.04.14 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2008.04.14 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2010.03.02 11:05:06 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2010.03.02 11:05:06 | 001,069,056 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2010.03.02 11:05:06 | 000,450,560 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >
--- --- ---

[/code]

Der Inhalt von EXTRAS.TXT
OTL Logfile:
Code:
OTL Extras logfile created on: 28.05.2012 20:14:27 - Run 1
OTL by OldTimer - Version 3.2.43.2    Folder = C:\Dokumente und Einstellungen\Admin\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy       
 
1,99 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 65,45% Memory free
3,33 Gb Paging File | 2,71 Gb Available in Paging File | 81,35% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 72,06 Gb Total Space | 26,99 Gb Free Space | 37,46% Space Free | Partition Type: NTFS
Drive D: | 72,06 Gb Total Space | 45,49 Gb Free Space | 63,13% Space Free | Partition Type: NTFS
Drive E: | 1,92 Gb Total Space | 1,92 Gb Free Space | 100,00% Space Free | Partition Type: FAT
 
Computer Name: UNSERERSTER | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Eigene_Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Eigene_Programme\fotoservice\OnlineFotoservice\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OnlineFotoservice] -- "C:\Eigene_Programme\fotoservice\OnlineFotoservice\OnlineFotoservice.exe" "%1" ()
Directory [PlayWithVLC] -- "C:\Eigene_Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1"
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1"
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1"
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Disabled:Microsoft Management Console -- (Microsoft Corporation)
"C:\Programme\Avira\AntiVir Desktop\avcenter.exe" = C:\Programme\Avira\AntiVir Desktop\avcenter.exe:*:Enabled:AntiVir starten -- (Avira Operations GmbH & Co. KG)
"C:\Eigene_Programme\Rsync\rsync.exe" = C:\Eigene_Programme\Rsync\rsync.exe:*:Enabled:rsync -- ()
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software  1.14.17.1
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP630_series" = Canon MP630 series MP Drivers
"{19F5658D-92E8-4A08-8657-D38ABB1574B2}" = Asus ACPI Driver
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 24
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
"{3134052E-B1F0-465C-B320-5042095B1031}" = Nero 7 Essentials
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{353FE16B-30FE-469A-BF55-B978F4218003}" = iTunes
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3A608351-5980-4A47-AE08-3742C55B4016}" = Windows Live Family Safety
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{57BB52B7-6B7B-31F3-89F4-4EE8FE5CEF6D}" = Microsoft Help Viewer 1.1
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate for Eee PC
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5AB7D739-1735-3A9E-BE73-C43507CB4E6F}" = Microsoft Visual Studio 2010 Service Pack 1
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.6
"{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}" = Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}" = Windows Live Fotogalerie
"{6C1E7AA1-44E9-446D-AAB2-0DE6D9EFEAB1}" = Safari
"{6E4DAE31-7CF3-441A-B6E5-B014D63C80CD}" = Eee Instant Key
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B9955EE-6FC5-4983-A994-F710924BD8F1}" = ACSI Camp Site Guide Europe 2010
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{835686C5-8650-49EB-8CA0-4528B4035495}" = Windows Live Call
"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger
"{83AA2913-C123-4146-85BD-AD8F93971D39}" = BabylonObjectInstaller
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{88F08F98-12BC-4613-81A2-8F9B88CFC73E}" = Super Hybrid Engine
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync
"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}" = Azurewave Wireless LAN
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9180D83D-99D5-4E38-A221-B512E076ED0F}" = Projekte erfolgreich managen
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.0 - Deutsch
"{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}" = AAVUpdateManager
"{B3D1CFF9-C5DA-3590-894B-40821DDB67C5}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{B915FA4E-B670-43E9-8EA0-9F16BFFD8AE8}" = DirComp
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C05BC4CD-C001-37E7-939C-3392604DFBEF}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C668416A-9213-4058-B7F2-01A42D85559D}" = Microsoft SQL Server System CLR Types
"{C83CD843-260E-3BD0-86BC-4E613BFDDE0A}" = Microsoft Help Viewer 1.1 Language Pack - DEU
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCAC7E52-ECCE-3C4D-B1BE-BC2ACF1C1C0E}" = Microsoft Visual Basic 2010 Express - DEU
"{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}" = Steuer-Spar-Erklärung 2012
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{DF5F687F-8018-4542-9F98-7084E9022917}" = Windows Live Essentials
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E9089B6A-1FDE-47F3-8D29-175F5B7A0722}" = Microsoft SQL Server 2008 R2 Management Objects
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"ac'tivAid" = ac'tivAid v1.3.1
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Audiograbber" = Audiograbber 1.83 SE
"Audiograbber-Lame" = Audiograbber Lame-MP3-Plugin
"AutoHotkey" = AutoHotkey 1.0.47.06
"Avira AntiVir Desktop" = Avira Free Antivirus
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"BabylonToolbar" = Babylon toolbar on IE
"Canon MP630 series Benutzerregistrierung" = Canon MP630 series Benutzerregistrierung
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Eee Storage" = Eee Storage
"Elantech" = ETDWare PS/2-x86 7.0.4.3 WHQL
"ESET Online Scanner" = ESET Online Scanner v3
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{7B9955EE-6FC5-4983-A994-F710924BD8F1}" = ACSI Camp Site Guide Europe 2010
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.1" = Microsoft Help Viewer 1.1
"Microsoft Help Viewer 1.1 Language Pack - DEU" = Microsoft Help Viewer 1.1 Language Pack - DEU
"Microsoft Visual Basic 2010 Express - DEU" = Microsoft Visual Basic 2010 Express - DEU
"Microsoft Visual Studio 2010 Service Pack 1" = Microsoft Visual Studio 2010 Service Pack 1
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU" = Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU
"MP Navigator EX 2.0" = Canon MP Navigator EX 2.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OnlineFotoservice" = OnlineFotoservice
"PDFCreator Toolbar" = PDFCreator Toolbar
"Softonic_Deutsch Toolbar" = Softonic_Deutsch Toolbar
"USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam
"VLC media player" = VLC media player 1.1.11
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Youtube Downloader HD_is1" = Youtube Downloader HD v. 2.5
"YTdetect" = Yahoo! Detect
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 09.04.2012 13:37:58 | Computer Name = UNSERERSTER | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
 
Error - 20.04.2012 13:16:54 | Computer Name = UNSERERSTER | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 02.05.2012 15:06:43 | Computer Name = UNSERERSTER | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
 
Error - 07.05.2012 15:22:32 | Computer Name = UNSERERSTER | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
 - Tried to start a service that wasn't the latest version of CLR Optimization service.
 Will shutdown
 
Error - 08.05.2012 15:29:25 | Computer Name = UNSERERSTER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 08.05.2012 15:29:25 | Computer Name = UNSERERSTER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 11.05.2012 14:11:22 | Computer Name = UNSERERSTER | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
 - Tried to start a service that wasn't the latest version of CLR Optimization service.
 Will shutdown
 
Error - 12.05.2012 15:26:57 | Computer Name = UNSERERSTER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 12.05.2012 15:26:58 | Computer Name = UNSERERSTER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 22.05.2012 13:34:01 | Computer Name = UNSERERSTER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Die Daten sind unzulässig.  .
 
[ OSession Events ]
Error - 09.08.2010 15:51:35 | Computer Name = UNSERERSTER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 7503 seconds with 4980 seconds of active time.  This session ended with a
 crash.
 
Error - 10.08.2010 14:49:45 | Computer Name = UNSERERSTER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 6670 seconds with 3240 seconds of active time.  This session ended with a
 crash.
 
Error - 09.10.2010 06:57:33 | Computer Name = UNSERERSTER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 4382 seconds with 3720 seconds of active time.  This session ended with a
 crash.
 
Error - 03.03.2011 17:17:03 | Computer Name = UNSERERSTER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 416 seconds with 300 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 21.05.2012 15:48:22 | Computer Name = UNSERERSTER | Source = PlugPlayManager | ID = 12
Description = Das Gerät "802.11n Wireless LAN Card" (PCI\VEN_1814&DEV_0781&SUBSYS_27901814&REV_00\4&37028e5f&0&00E3)
 wurde ohne vorbereitende Maßnahmen vom System entfernt.
 
Error - 21.05.2012 23:42:15 | Computer Name = UNSERERSTER | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
 Bibliothek Single Flash Reader USB Device nicht laden.
 
Error - 21.05.2012 23:42:16 | Computer Name = UNSERERSTER | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
 Bibliothek Single Flash Reader USB Device nicht laden.
 
Error - 21.05.2012 23:44:34 | Computer Name = UNSERERSTER | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
 Bibliothek Single Flash Reader USB Device nicht laden.
 
Error - 21.05.2012 23:44:34 | Computer Name = UNSERERSTER | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
 Bibliothek Single Flash Reader USB Device nicht laden.
 
Error - 21.05.2012 23:48:12 | Computer Name = UNSERERSTER | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
 Bibliothek Single Flash Reader USB Device nicht laden.
 
Error - 21.05.2012 23:48:12 | Computer Name = UNSERERSTER | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
 Bibliothek Single Flash Reader USB Device nicht laden.
 
Error - 22.05.2012 18:07:19 | Computer Name = UNSERERSTER | Source = PlugPlayManager | ID = 12
Description = Das Gerät "802.11n Wireless LAN Card" (PCI\VEN_1814&DEV_0781&SUBSYS_27901814&REV_00\4&37028e5f&0&00E3)
 wurde ohne vorbereitende Maßnahmen vom System entfernt.
 
Error - 24.05.2012 14:41:41 | Computer Name = UNSERERSTER | Source = PlugPlayManager | ID = 12
Description = Das Gerät "802.11n Wireless LAN Card" (PCI\VEN_1814&DEV_0781&SUBSYS_27901814&REV_00\4&37028e5f&0&00E3)
 wurde ohne vorbereitende Maßnahmen vom System entfernt.
 
Error - 28.05.2012 13:37:26 | Computer Name = UNSERERSTER | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.2.100 für die Netzwerkkarte mit der Netzwerkadresse
 002243962B11 wurde durch  den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
 
 
< End of report >
--- --- ---


Ich hoffe es hilft weiter. Vielen Dank bis hierhin.

Grüße

cosinus 29.05.2012 08:28
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=109986&babsrc=HP_ss&mntrId=64d0a91b00000000000000248c9e04e8
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=109986&babsrc=SP_ss&mntrId=64d0a91b00000000000000248c9e04e8
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}: "URL" = http://search.pdfcreator-toolbar.org/search?p=Q&ts=ne&w={searchTerms}&csrc=search-field
IE - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1351351
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O2 - BHO: (PDFCreator Toolbar Helper) - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\Toolbar\WebBrowser: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O4 - HKLM..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-970361835-3776818119-144542300-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.03.02 10:12:14 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{80deda88-fb07-11de-bb63-002243e55ba0}\Shell\AutoRun\command - "" = E:\Get_Started_for_Win.exe
O33 - MountPoints2\{80deda89-fb07-11de-bb63-002243e55ba0}\Shell\AutoRun\command - "" = F:\Get_Started_for_Win.exe
:Files
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar
C:\Programme\BabylonToolbar
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Babylon
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Babylon
C:\user.js
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\PriceGong
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Bremser 29.05.2012 20:01
Hallo Arne

Erstmal vielen Dank für die Hilfe.
Es kommt aber wie es kommen musste. Aber der Reihe nach.

-OTL mit Script gefüttert
-Avira gestartet um es abzuschalten. Dabei die Fehlermeldung.
"GDI+ Window: avcenter.exe - Abbild fehlerhaft
Die Anwendung oder DLL c:\Window\system32\MSchG.DLL ist keine gültige
Windows-Datei. Überprüfen Sie dies mit der Installationsdiskette"
<OK> gedrückt. Gleiche Fehlermeldung erneut. Wieder <OK> gedrückt.
Avira Oberfläche erschien und Virenscanner ließ sich ausschalten.
-WLAN abgeschaltet und OTL gestartet. Sofort <Kling> gehört.
-"eingeschüchtert" durch "Killing Process: DO NOT INTERRUPT" erstmal nichts getan
-nachdem sich längere Zeit nichts auf der Festplatte hat, mal mittels Taskswitch geschaut wer das <kling> verursachte
- Malwarebytes komplett vergessen. Fehlermeldung "Malwarebytes Anti-MalwareFehlermelung: MBAMService terminated unexpectectly"

Resultat: nichts geht mehr und ich traue mich nicht den Rechner auszuschalten.

Ergänzung:
- nachdem der Rechner über Nacht lief, habe ich ihn heute morgen ausgeschaltet.:stirn:
- hochgefahren, OTL erneut mit dem Script gefüttert, (hoffentlich) alle Programme beendet.
- OTL gestartet, Killing Process noch im Gange

Grüße

cosinus 30.05.2012 10:12
Wiederhol den Fix im abgesicherten Modus bitte

Bremser 30.05.2012 19:18
Hallo Arne

- OTL im abgesicherten Modus gestartet und diesmal passiert auch erkennbar etwas.
- Folgendes OTL Log ist dabei (nach Neustart) entstanden.
Code:
All processes killed
========== OTL ==========
HKU\S-1-5-21-970361835-3776818119-144542300-1009\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\URLSearchHooks\\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}\ deleted successfully.
C:\Programme\Softonic_Deutsch\prxtbSof2.dll moved successfully.
HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\SearchScopes\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}\ not found.
File C:\Programme\Softonic_Deutsch\prxtbSof2.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}\ deleted successfully.
C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}\ not found.
File C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}\ not found.
File C:\Programme\Softonic_Deutsch\prxtbSof2.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ deleted successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll moved successfully.
Registry value HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}\ not found.
File C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8DBB6D8E-E4A6-4E3B-9753-AF78B226441C}\ not found.
File C:\Programme\Softonic_Deutsch\prxtbSof2.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WinampAgent deleted successfully.
C:\Programme\Winamp\winampa.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry key HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer not found.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-970361835-3776818119-144542300-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{80deda88-fb07-11de-bb63-002243e55ba0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80deda88-fb07-11de-bb63-002243e55ba0}\ not found.
File E:\Get_Started_for_Win.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{80deda89-fb07-11de-bb63-002243e55ba0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80deda89-fb07-11de-bb63-002243e55ba0}\ not found.
File F:\Get_Started_for_Win.exe not found.
========== FILES ==========
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar\Shared folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar\IE folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar\FF folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar\CR folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar\BabylonToolbar folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\BabylonToolbar folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17 folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar folder moved successfully.
C:\Programme\BabylonToolbar folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup\HtmlScreens folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Babylon\Setup folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Babylon folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Babylon folder moved successfully.
C:\user.js moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\PriceGong\Data folder moved successfully.
C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\PriceGong folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Admin
->Temp folder emptied: 208487544 bytes
->Temporary Internet Files folder emptied: 15226586 bytes
->Java cache emptied: 74612347 bytes
->Apple Safari cache emptied: 928768 bytes
->Flash cache emptied: 3579 bytes
 
User: Admin_Backup
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: Leonard
->Temp folder emptied: 707898 bytes
->Temporary Internet Files folder emptied: 1483828 bytes
->Java cache emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32969 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Stefanie
->Temp folder emptied: 68712439 bytes
->Temporary Internet Files folder emptied: 188761851 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 1895 bytes
 
User: Wolfgang
->Temp folder emptied: 126370902 bytes
->Temporary Internet Files folder emptied: 89213097 bytes
->Java cache emptied: 9472974 bytes
->Apple Safari cache emptied: 30367744 bytes
->Flash cache emptied: 493 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 322567062 bytes
RecycleBin emptied: 44577367 bytes
 
Total Files Cleaned = 1.127,00 mb
 
 
[EMPTYFLASH]
 
User: Admin
->Flash cache emptied: 0 bytes
 
User: Admin_Backup
 
User: All Users
 
User: Default User
 
User: Leonard
 
User: LocalService
 
User: NetworkService
 
User: Stefanie
->Flash cache emptied: 0 bytes
 
User: Wolfgang
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.43.2 log created on 05302012_195453

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
Vielen Dank bis hierhin !!!
Grüße

cosinus 30.05.2012 20:58
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Bremser 31.05.2012 19:20
Hallo Arne

Danke für deine Mühen !!

Ich habe TdssKiller wie beschrieben gestartet und poste dir das Log.

Code:
20:11:33.0984 3112        TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16
20:11:34.0031 3112        ============================================================
20:11:34.0031 3112        Current date / time: 2012/05/31 20:11:34.0031
20:11:34.0031 3112        SystemInfo:
20:11:34.0031 3112       
20:11:34.0031 3112        OS Version: 5.1.2600 ServicePack: 3.0
20:11:34.0031 3112        Product type: Workstation
20:11:34.0031 3112        ComputerName: UNSERERSTER
20:11:34.0031 3112        UserName: Admin
20:11:34.0031 3112        Windows directory: C:\WINDOWS
20:11:34.0031 3112        System windows directory: C:\WINDOWS
20:11:34.0031 3112        Processor architecture: Intel x86
20:11:34.0031 3112        Number of processors: 2
20:11:34.0031 3112        Page size: 0x1000
20:11:34.0031 3112        Boot type: Normal boot
20:11:34.0031 3112        ============================================================
20:11:35.0078 3112        Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x69A9, SectorsPerTrack: 0x36, TracksPerCylinder: 0xD6, Type 'K0', Flags 0x00000050
20:11:35.0078 3112        Drive \Device\Harddisk1\DR5 - Size: 0x7AA80000 (1.92 Gb), SectorSize: 0x200, Cylinders: 0xFA, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
20:11:35.0078 3112        ============================================================
20:11:35.0078 3112        \Device\Harddisk0\DR0:
20:11:35.0078 3112        MBR partitions:
20:11:35.0078 3112        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x36, BlocksNum 0x9020CE2
20:11:35.0078 3112        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x9020D18, BlocksNum 0x901DFF4
20:11:35.0078 3112        \Device\Harddisk1\DR5:
20:11:35.0093 3112        MBR partitions:
20:11:35.0093 3112        \Device\Harddisk1\DR5\Partition0: MBR, Type 0x6, StartLBA 0xF3, BlocksNum 0x3D530D
20:11:35.0093 3112        ============================================================
20:11:35.0125 3112        C: <-> \Device\Harddisk0\DR0\Partition0
20:11:35.0187 3112        D: <-> \Device\Harddisk0\DR0\Partition1
20:11:35.0187 3112        ============================================================
20:11:35.0187 3112        Initialize success
20:11:35.0187 3112        ============================================================
20:13:15.0156 1428        ============================================================
20:13:15.0156 1428        Scan started
20:13:15.0156 1428        Mode: Manual; SigCheck; TDLFS;
20:13:15.0156 1428        ============================================================
20:13:15.0937 1428        AAV UpdateService (7eeb488346fbfa3731276c3ee8a8fd9e) C:\Eigene_Programme\Steuertipps\Steuer-Spar-Erklaerung 2012\AAVUpdateManager\aavus.exe
20:13:16.0234 1428        AAV UpdateService - ok
20:13:16.0328 1428        Abiosdsk - ok
20:13:16.0343 1428        abp480n5 - ok
20:13:16.0390 1428        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:13:17.0890 1428        ACPI - ok
20:13:17.0921 1428        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
20:13:18.0140 1428        ACPIEC - ok
20:13:18.0140 1428        adpu160m - ok
20:13:18.0187 1428        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
20:13:18.0406 1428        aec - ok
20:13:18.0453 1428        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
20:13:18.0531 1428        AFD - ok
20:13:18.0531 1428        Aha154x - ok
20:13:18.0546 1428        aic78u2 - ok
20:13:18.0546 1428        aic78xx - ok
20:13:18.0578 1428        Alerter        (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
20:13:18.0781 1428        Alerter - ok
20:13:18.0812 1428        ALG            (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
20:13:18.0921 1428        ALG - ok
20:13:18.0921 1428        AliIde - ok
20:13:19.0109 1428        Ambfilt        (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys
20:13:19.0328 1428        Ambfilt - ok
20:13:19.0453 1428        amsint - ok
20:13:19.0593 1428        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Programme\Avira\AntiVir Desktop\sched.exe
20:13:19.0625 1428        AntiVirSchedulerService - ok
20:13:19.0671 1428        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Programme\Avira\AntiVir Desktop\avguard.exe
20:13:19.0703 1428        AntiVirService - ok
20:13:19.0796 1428        Apple Mobile Device (20f6f19fe9e753f2780dc2fa083ad597) C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
20:13:19.0828 1428        Apple Mobile Device - ok
20:13:19.0828 1428        AppMgmt - ok
20:13:19.0953 1428        AR5416          (7d53e5646ba23fd51296f7ef8979a000) C:\WINDOWS\system32\DRIVERS\athw.sys
20:13:20.0140 1428        AR5416 - ok
20:13:20.0156 1428        asc - ok
20:13:20.0171 1428        asc3350p - ok
20:13:20.0187 1428        asc3550 - ok
20:13:20.0343 1428        aspnet_state    (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
20:13:20.0453 1428        aspnet_state - ok
20:13:20.0500 1428        AsusACPI        (12415a4b61ded200fe9932b47a35fa42) C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys
20:13:20.0593 1428        AsusACPI - ok
20:13:20.0640 1428        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:13:20.0890 1428        AsyncMac - ok
20:13:20.0937 1428        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
20:13:21.0140 1428        atapi - ok
20:13:21.0140 1428        Atdisk - ok
20:13:21.0171 1428        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:13:21.0359 1428        Atmarpc - ok
20:13:21.0406 1428        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
20:13:21.0609 1428        AudioSrv - ok
20:13:21.0640 1428        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:13:21.0828 1428        audstub - ok
20:13:21.0859 1428        avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
20:13:21.0906 1428        avgntflt - ok
20:13:21.0953 1428        avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\WINDOWS\system32\DRIVERS\avipbb.sys
20:13:21.0968 1428        avipbb - ok
20:13:22.0000 1428        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
20:13:22.0015 1428        avkmgr - ok
20:13:22.0156 1428        BBSvc          (01a24b415926bb5f772dbe12459d97de) C:\Programme\Microsoft\BingBar\BBSvc.EXE
20:13:22.0203 1428        BBSvc - ok
20:13:22.0265 1428        BBUpdate        (785de7abda13309d6065305542829e76) C:\Programme\Microsoft\BingBar\SeaPort.EXE
20:13:22.0296 1428        BBUpdate - ok
20:13:22.0328 1428        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:13:22.0578 1428        Beep - ok
20:13:22.0625 1428        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
20:13:22.0875 1428        BITS - ok
20:13:22.0968 1428        Bonjour Service (f2060a34c8a75bc24a9222eb4f8c07bd) C:\Programme\Bonjour\mDNSResponder.exe
20:13:23.0000 1428        Bonjour Service - ok
20:13:23.0062 1428        Browser        (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
20:13:23.0265 1428        Browser - ok
20:13:23.0312 1428        btaudio        (4b43dfe1c1fbb305a1dc5504ef9bb34e) C:\WINDOWS\system32\drivers\btaudio.sys
20:13:23.0359 1428        btaudio - ok
20:13:23.0390 1428        BTDriver        (2f9f111d31aa3fbbe5781d829a4524e6) C:\WINDOWS\system32\DRIVERS\btport.sys
20:13:23.0421 1428        BTDriver - ok
20:13:23.0500 1428        BTKRNL          (70455baffc078b6152d1e52376296467) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
20:13:23.0578 1428        BTKRNL - ok
20:13:23.0671 1428        btwdins        (e43f7709f36444681978f9dc067a976b) C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
20:13:23.0718 1428        btwdins - ok
20:13:23.0750 1428        BTWDNDIS        (485020a1e1fc5c51a800ca69c618d881) C:\WINDOWS\system32\DRIVERS\btwdndis.sys
20:13:23.0765 1428        BTWDNDIS - ok
20:13:23.0781 1428        btwhid          (949eca9c56f657c06d3166d51f3226c7) C:\WINDOWS\system32\DRIVERS\btwhid.sys
20:13:23.0796 1428        btwhid - ok
20:13:23.0828 1428        BTWUSB          (2cfc2bd8785f82a42fcad83de1fa5a36) C:\WINDOWS\system32\Drivers\btwusb.sys
20:13:23.0843 1428        BTWUSB - ok
20:13:23.0890 1428        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:13:24.0093 1428        cbidf2k - ok
20:13:24.0140 1428        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
20:13:24.0343 1428        CCDECODE - ok
20:13:24.0359 1428        cd20xrnt - ok
20:13:24.0390 1428        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:13:24.0578 1428        Cdaudio - ok
20:13:24.0593 1428        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
20:13:24.0796 1428        Cdfs - ok
20:13:24.0828 1428        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:13:25.0031 1428        Cdrom - ok
20:13:25.0031 1428        Changer - ok
20:13:25.0046 1428        CiSvc          (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
20:13:25.0265 1428        CiSvc - ok
20:13:25.0281 1428        ClipSrv        (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
20:13:25.0484 1428        ClipSrv - ok
20:13:25.0578 1428        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:13:25.0687 1428        clr_optimization_v2.0.50727_32 - ok
20:13:25.0796 1428        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:13:26.0000 1428        clr_optimization_v4.0.30319_32 - ok
20:13:26.0062 1428        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
20:13:26.0328 1428        CmBatt - ok
20:13:26.0343 1428        CmdIde - ok
20:13:26.0359 1428        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
20:13:26.0546 1428        Compbatt - ok
20:13:26.0562 1428        COMSysApp - ok
20:13:26.0578 1428        Cpqarray - ok
20:13:26.0625 1428        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
20:13:26.0812 1428        CryptSvc - ok
20:13:26.0828 1428        dac2w2k - ok
20:13:26.0828 1428        dac960nt - ok
20:13:26.0890 1428        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
20:13:26.0968 1428        DcomLaunch - ok
20:13:27.0015 1428        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
20:13:27.0203 1428        Dhcp - ok
20:13:27.0234 1428        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
20:13:27.0421 1428        Disk - ok
20:13:27.0437 1428        dmadmin - ok
20:13:27.0515 1428        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
20:13:27.0750 1428        dmboot - ok
20:13:27.0796 1428        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
20:13:28.0000 1428        dmio - ok
20:13:28.0015 1428        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:13:28.0203 1428        dmload - ok
20:13:28.0234 1428        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
20:13:28.0421 1428        dmserver - ok
20:13:28.0453 1428        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
20:13:28.0656 1428        DMusic - ok
20:13:28.0687 1428        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
20:13:28.0781 1428        Dnscache - ok
20:13:28.0828 1428        Dot3svc        (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
20:13:29.0031 1428        Dot3svc - ok
20:13:29.0046 1428        dpti2o - ok
20:13:29.0093 1428        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
20:13:29.0265 1428        drmkaud - ok
20:13:29.0296 1428        EapHost        (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
20:13:29.0500 1428        EapHost - ok
20:13:29.0515 1428        ERSvc          (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
20:13:29.0703 1428        ERSvc - ok
20:13:29.0750 1428        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:13:29.0781 1428        Eventlog - ok
20:13:29.0828 1428        EventSystem    (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
20:13:29.0906 1428        EventSystem - ok
20:13:29.0937 1428        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
20:13:30.0125 1428        Fastfat - ok
20:13:30.0171 1428        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:13:30.0265 1428        FastUserSwitchingCompatibility - ok
20:13:30.0312 1428        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
20:13:30.0515 1428        Fdc - ok
20:13:30.0531 1428        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
20:13:30.0750 1428        Fips - ok
20:13:30.0781 1428        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
20:13:30.0968 1428        Flpydisk - ok
20:13:31.0015 1428        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
20:13:31.0218 1428        FltMgr - ok
20:13:31.0359 1428        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
20:13:31.0375 1428        FontCache3.0.0.0 - ok
20:13:31.0406 1428        fssfltr        (eda991753af03e5b06935be114ba9640) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
20:13:31.0437 1428        fssfltr - ok
20:13:31.0562 1428        fsssvc          (f6717211c1ec2cddaa81b97b0727c2e9) C:\Programme\Windows Live\Family Safety\fsssvc.exe
20:13:31.0625 1428        fsssvc - ok
20:13:31.0671 1428        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:13:31.0906 1428        Fs_Rec - ok
20:13:31.0953 1428        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:13:32.0140 1428        Ftdisk - ok
20:13:32.0187 1428        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
20:13:32.0203 1428        GEARAspiWDM - ok
20:13:32.0250 1428        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:13:32.0437 1428        Gpc - ok
20:13:32.0484 1428        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
20:13:32.0656 1428        HDAudBus - ok
20:13:32.0703 1428        helpsvc        (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
20:13:32.0890 1428        helpsvc - ok
20:13:32.0921 1428        HidServ        (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
20:13:33.0109 1428        HidServ - ok
20:13:33.0125 1428        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:13:33.0312 1428        HidUsb - ok
20:13:33.0343 1428        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
20:13:33.0531 1428        hkmsvc - ok
20:13:33.0546 1428        hpn - ok
20:13:33.0609 1428        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
20:13:33.0656 1428        HTTP - ok
20:13:33.0687 1428        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
20:13:33.0875 1428        HTTPFilter - ok
20:13:33.0875 1428        i2omgmt - ok
20:13:33.0890 1428        i2omp - ok
20:13:33.0937 1428        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:13:34.0125 1428        i8042prt - ok
20:13:34.0484 1428        ialm            (0f68e2ec713f132ffb19e45415b09679) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
20:13:34.0890 1428        ialm - ok
20:13:35.0046 1428        iaStor          (8ef427c54497c5f8a7a645990e4278c7) C:\WINDOWS\system32\drivers\iaStor.sys
20:13:35.0093 1428        iaStor - ok
20:13:35.0296 1428        idsvc          (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:13:35.0421 1428        idsvc - ok
20:13:35.0468 1428        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:13:35.0718 1428        Imapi - ok
20:13:35.0734 1428        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
20:13:35.0953 1428        ImapiService - ok
20:13:36.0000 1428        InCDfs          (580a81790cd0a48d85da322267da7ac4) C:\WINDOWS\system32\drivers\InCDFs.sys
20:13:36.0015 1428        InCDfs - ok
20:13:36.0062 1428        InCDPass        (aaa2789d2ce21b31be9406ba1ceb7285) C:\WINDOWS\system32\drivers\InCDPass.sys
20:13:36.0078 1428        InCDPass - ok
20:13:36.0093 1428        InCDrec        (4d022577e9072b5d22e0a383a7806bbb) C:\WINDOWS\system32\drivers\InCDrec.sys
20:13:36.0109 1428        InCDrec - ok
20:13:36.0125 1428        incdrm          (c258e57321a3c3737f4fa815fa69ee0b) C:\WINDOWS\system32\drivers\InCDRm.sys
20:13:36.0140 1428        incdrm - ok
20:13:36.0343 1428        InCDsrv        (9792b85e32e058cd6a43db274ba47d57) C:\Eigene_Programme\Nero 7\InCD\InCDsrv.exe
20:13:36.0437 1428        InCDsrv - ok
20:13:36.0562 1428        ini910u - ok
20:13:36.0921 1428        IntcAzAudAddService (816a4f17dffdeeb01896fe05991838e0) C:\WINDOWS\system32\drivers\RtkHDAud.sys
20:13:37.0187 1428        IntcAzAudAddService - ok
20:13:37.0265 1428        IntelIde - ok
20:13:37.0281 1428        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
20:13:37.0484 1428        intelppm - ok
20:13:37.0515 1428        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
20:13:37.0734 1428        Ip6Fw - ok
20:13:37.0750 1428        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:13:37.0921 1428        IpFilterDriver - ok
20:13:37.0937 1428        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:13:38.0125 1428        IpInIp - ok
20:13:38.0296 1428        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:13:38.0500 1428        IpNat - ok
20:13:38.0609 1428        iPod Service    (ca9d4b998bff311a539604ed87318fa0) C:\Programme\iPod\bin\iPodService.exe
20:13:38.0671 1428        iPod Service - ok
20:13:38.0718 1428        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:13:38.0968 1428        IPSec - ok
20:13:39.0000 1428        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:13:39.0156 1428        IRENUM - ok
20:13:39.0187 1428        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:13:39.0375 1428        isapnp - ok
20:13:39.0468 1428        JavaQuickStarterService (5e06a9d23727daf96faa796f1135fdcd) C:\Programme\Java\jre6\bin\jqs.exe
20:13:39.0484 1428        JavaQuickStarterService - ok
20:13:39.0515 1428        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:13:39.0734 1428        Kbdclass - ok
20:13:39.0796 1428        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
20:13:39.0984 1428        kmixer - ok
20:13:40.0031 1428        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
20:13:40.0171 1428        KSecDD - ok
20:13:40.0234 1428        Ktp            (85b6d85c044e3df77e92b5a7b265008f) C:\WINDOWS\system32\DRIVERS\ETD.sys
20:13:40.0312 1428        Ktp - ok
20:13:40.0343 1428        L1e            (fa46f5d09edf93e0c71fe6500fe3f4ae) C:\WINDOWS\system32\DRIVERS\l1e51x86.sys
20:13:40.0359 1428        L1e - ok
20:13:40.0421 1428        LanmanServer    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
20:13:40.0515 1428        LanmanServer - ok
20:13:40.0562 1428        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
20:13:40.0656 1428        lanmanworkstation - ok
20:13:40.0781 1428        Lavasoft Ad-Aware Service (335b35f436d6801a4910afbde5aa6a16) C:\Programme\Lavasoft\Ad-Aware\AAWService.exe
20:13:40.0890 1428        Lavasoft Ad-Aware Service - ok
20:13:40.0921 1428        Lbd            (419590ebe7855215bb157ea0cf0d0531) C:\WINDOWS\system32\DRIVERS\Lbd.sys
20:13:40.0968 1428        Lbd - ok
20:13:40.0968 1428        lbrtfdc - ok
20:13:41.0109 1428        LightScribeService (abf90fc5a127f481219b873c1b8dfc1c) C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
20:13:41.0125 1428        LightScribeService ( UnsignedFile.Multi.Generic ) - warning
20:13:41.0125 1428        LightScribeService - detected UnsignedFile.Multi.Generic (1)
20:13:41.0171 1428        LmHosts        (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
20:13:41.0421 1428        LmHosts - ok
20:13:41.0437 1428        MBAMProtector  (fb097bbc1a18f044bd17bd2fccf97865) C:\WINDOWS\system32\drivers\mbam.sys
20:13:41.0468 1428        MBAMProtector - ok
20:13:41.0546 1428        MBAMService    (ba400ed640bca1eae5c727ae17c10207) C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
20:13:41.0593 1428        MBAMService - ok
20:13:41.0625 1428        Messenger      (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
20:13:41.0828 1428        Messenger - ok
20:13:41.0859 1428        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:13:42.0031 1428        mnmdd - ok
20:13:42.0093 1428        mnmsrvc        (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
20:13:42.0281 1428        mnmsrvc - ok
20:13:42.0312 1428        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
20:13:42.0531 1428        Modem - ok
20:13:42.0625 1428        Monfilt        (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys
20:13:42.0765 1428        Monfilt - ok
20:13:42.0812 1428        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:13:43.0000 1428        Mouclass - ok
20:13:43.0078 1428        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:13:43.0281 1428        mouhid - ok
20:13:43.0296 1428        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
20:13:43.0500 1428        MountMgr - ok
20:13:43.0500 1428        mraid35x - ok
20:13:43.0546 1428        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:13:43.0734 1428        MRxDAV - ok
20:13:43.0796 1428        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:13:43.0906 1428        MRxSmb - ok
20:13:43.0937 1428        MSDTC          (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
20:13:44.0125 1428        MSDTC - ok
20:13:44.0171 1428        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
20:13:44.0406 1428        Msfs - ok
20:13:44.0406 1428        MSIServer - ok
20:13:44.0468 1428        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:13:44.0671 1428        MSKSSRV - ok
20:13:44.0687 1428        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:13:44.0859 1428        MSPCLOCK - ok
20:13:44.0906 1428        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
20:13:45.0109 1428        MSPQM - ok
20:13:45.0140 1428        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:13:45.0312 1428        mssmbios - ok
20:13:45.0343 1428        MSTEE          (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
20:13:45.0531 1428        MSTEE - ok
20:13:45.0578 1428        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
20:13:45.0625 1428        Mup - ok
20:13:45.0656 1428        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
20:13:45.0859 1428        NABTSFEC - ok
20:13:45.0921 1428        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
20:13:46.0140 1428        napagent - ok
20:13:46.0296 1428        NBService      (b498a14133bd09ad0817590ace4470ad) C:\Eigene_Programme\Nero 7\Nero BackItUp\NBService.exe
20:13:46.0375 1428        NBService - ok
20:13:46.0437 1428        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
20:13:46.0656 1428        NDIS - ok
20:13:46.0703 1428        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
20:13:46.0937 1428        NdisIP - ok
20:13:46.0968 1428        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:13:47.0015 1428        NdisTapi - ok
20:13:47.0062 1428        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:13:47.0250 1428        Ndisuio - ok
20:13:47.0296 1428        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:13:47.0484 1428        NdisWan - ok
20:13:47.0515 1428        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
20:13:47.0609 1428        NDProxy - ok
20:13:47.0640 1428        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
20:13:47.0828 1428        NetBIOS - ok
20:13:47.0875 1428        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
20:13:48.0078 1428        NetBT - ok
20:13:48.0125 1428        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:13:48.0312 1428        NetDDE - ok
20:13:48.0328 1428        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:13:48.0515 1428        NetDDEdsdm - ok
20:13:48.0625 1428        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:48.0796 1428        Netlogon - ok
20:13:48.0859 1428        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
20:13:49.0062 1428        Netman - ok
20:13:49.0171 1428        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
20:13:49.0250 1428        NetTcpPortSharing - ok
20:13:49.0312 1428        Nla            (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
20:13:49.0359 1428        Nla - ok
20:13:49.0484 1428        NMIndexingService (a328a46d87bb92ce4d8a4528e9d84787) C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
20:13:49.0500 1428        NMIndexingService - ok
20:13:49.0546 1428        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
20:13:49.0734 1428        Npfs - ok
20:13:49.0765 1428        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
20:13:50.0000 1428        Ntfs - ok
20:13:50.0031 1428        NtLmSsp        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:50.0218 1428        NtLmSsp - ok
20:13:50.0250 1428        NtmsSvc        (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
20:13:50.0484 1428        NtmsSvc - ok
20:13:50.0500 1428        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:13:50.0687 1428        Null - ok
20:13:50.0703 1428        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:13:50.0890 1428        NwlnkFlt - ok
20:13:50.0906 1428        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:13:51.0093 1428        NwlnkFwd - ok
20:13:51.0218 1428        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
20:13:51.0281 1428        odserv - ok
20:13:51.0328 1428        ose            (5a432a042dae460abe7199b758e8606c) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
20:13:51.0343 1428        ose - ok
20:13:51.0390 1428        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
20:13:51.0578 1428        Parport - ok
20:13:51.0625 1428        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
20:13:51.0843 1428        PartMgr - ok
20:13:51.0890 1428        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
20:13:52.0078 1428        ParVdm - ok
20:13:52.0125 1428        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
20:13:52.0312 1428        PCI - ok
20:13:52.0343 1428        PCIDump - ok
20:13:52.0343 1428        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
20:13:52.0531 1428        PCIIde - ok
20:13:52.0562 1428        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
20:13:52.0750 1428        Pcmcia - ok
20:13:52.0765 1428        PDCOMP - ok
20:13:52.0765 1428        PDFRAME - ok
20:13:52.0781 1428        PDRELI - ok
20:13:52.0781 1428        PDRFRAME - ok
20:13:52.0796 1428        perc2 - ok
20:13:52.0812 1428        perc2hib - ok
20:13:52.0875 1428        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:13:52.0906 1428        PlugPlay - ok
20:13:52.0953 1428        PolicyAgent    (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:53.0125 1428        PolicyAgent - ok
20:13:53.0156 1428        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:13:53.0343 1428        PptpMiniport - ok
20:13:53.0359 1428        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:53.0531 1428        ProtectedStorage - ok
20:13:53.0546 1428        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
20:13:53.0734 1428        PSched - ok
20:13:54.0000 1428        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:13:54.0203 1428        Ptilink - ok
20:13:54.0250 1428        PxHelp20        (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
20:13:54.0281 1428        PxHelp20 - ok
20:13:54.0281 1428        ql1080 - ok
20:13:54.0296 1428        Ql10wnt - ok
20:13:54.0312 1428        ql12160 - ok
20:13:54.0328 1428        ql1240 - ok
20:13:54.0343 1428        ql1280 - ok
20:13:54.0359 1428        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:13:54.0609 1428        RasAcd - ok
20:13:54.0625 1428        RasAuto        (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
20:13:54.0812 1428        RasAuto - ok
20:13:54.0828 1428        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:13:55.0015 1428        Rasl2tp - ok
20:13:55.0046 1428        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
20:13:55.0234 1428        RasMan - ok
20:13:55.0265 1428        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:13:55.0468 1428        RasPppoe - ok
20:13:55.0484 1428        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
20:13:55.0656 1428        Raspti - ok
20:13:55.0718 1428        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:13:55.0921 1428        Rdbss - ok
20:13:55.0953 1428        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:13:56.0156 1428        RDPCDD - ok
20:13:56.0218 1428        RDPWD          (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
20:13:56.0265 1428        RDPWD - ok
20:13:56.0328 1428        RDSessMgr      (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
20:13:56.0515 1428        RDSessMgr - ok
20:13:56.0562 1428        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
20:13:56.0765 1428        redbook - ok
20:13:56.0796 1428        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
20:13:57.0015 1428        RemoteAccess - ok
20:13:57.0062 1428        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
20:13:57.0265 1428        RpcLocator - ok
20:13:57.0328 1428        RpcSs          (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
20:13:57.0375 1428        RpcSs - ok
20:13:57.0421 1428        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
20:13:57.0593 1428        RSVP - ok
20:13:57.0671 1428        RT80x86        (f591f71883424f5b31e3348ea4454466) C:\WINDOWS\system32\DRIVERS\RT2860.sys
20:13:57.0796 1428        RT80x86 - ok
20:13:57.0843 1428        SamSs          (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:58.0031 1428        SamSs - ok
20:13:58.0078 1428        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
20:13:58.0328 1428        SCardSvr - ok
20:13:58.0359 1428        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
20:13:58.0546 1428        Schedule - ok
20:13:58.0593 1428        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:13:58.0671 1428        Secdrv - ok
20:13:58.0718 1428        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
20:13:58.0906 1428        seclogon - ok
20:13:58.0937 1428        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
20:13:59.0109 1428        SENS - ok
20:13:59.0140 1428        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
20:13:59.0328 1428        Serial - ok
20:13:59.0359 1428        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
20:13:59.0546 1428        Sfloppy - ok
20:13:59.0593 1428        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
20:13:59.0781 1428        SharedAccess - ok
20:13:59.0812 1428        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:13:59.0843 1428        ShellHWDetection - ok
20:13:59.0859 1428        Simbad - ok
20:13:59.0906 1428        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
20:14:00.0078 1428        SLIP - ok
20:14:00.0234 1428        SNP2UVC        (060f51141b20b8156804446a04ab8b2a) C:\WINDOWS\system32\DRIVERS\snp2uvc.sys
20:14:00.0437 1428        SNP2UVC - ok
20:14:00.0546 1428        Sparrow - ok
20:14:00.0593 1428        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
20:14:00.0843 1428        splitter - ok
20:14:00.0890 1428        Spooler        (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
20:14:00.0953 1428        Spooler - ok
20:14:01.0031 1428        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
20:14:01.0140 1428        sr - ok
20:14:01.0156 1428        srservice      (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
20:14:01.0250 1428        srservice - ok
20:14:01.0312 1428        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
20:14:01.0406 1428        Srv - ok
20:14:01.0437 1428        SSDPSRV        (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
20:14:01.0531 1428        SSDPSRV - ok
20:14:01.0609 1428        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
20:14:01.0625 1428        ssmdrv - ok
20:14:01.0687 1428        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
20:14:01.0890 1428        stisvc - ok
20:14:01.0937 1428        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
20:14:02.0156 1428        streamip - ok
20:14:02.0203 1428        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:14:02.0390 1428        swenum - ok
20:14:02.0437 1428        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
20:14:02.0609 1428        swmidi - ok
20:14:02.0625 1428        SwPrv - ok
20:14:02.0625 1428        symc810 - ok
20:14:02.0640 1428        symc8xx - ok
20:14:02.0640 1428        sym_hi - ok
20:14:02.0656 1428        sym_u3 - ok
20:14:02.0703 1428        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
20:14:02.0906 1428        sysaudio - ok
20:14:02.0953 1428        SysmonLog      (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
20:14:03.0140 1428        SysmonLog - ok
20:14:03.0203 1428        TapiSrv        (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
20:14:03.0390 1428        TapiSrv - ok
20:14:03.0437 1428        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:14:03.0484 1428        Tcpip - ok
20:14:03.0531 1428        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:14:03.0718 1428        TDPIPE - ok
20:14:03.0734 1428        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
20:14:03.0921 1428        TDTCP - ok
20:14:03.0968 1428        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
20:14:04.0156 1428        TermDD - ok
20:14:04.0234 1428        TermService    (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
20:14:04.0421 1428        TermService - ok
20:14:04.0468 1428        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:14:04.0500 1428        Themes - ok
20:14:04.0500 1428        TosIde - ok
20:14:04.0546 1428        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
20:14:04.0750 1428        TrkWks - ok
20:14:04.0796 1428        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
20:14:04.0968 1428        Udfs - ok
20:14:04.0984 1428        ultra - ok
20:14:05.0062 1428        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
20:14:05.0281 1428        Update - ok
20:14:05.0328 1428        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
20:14:05.0421 1428        upnphost - ok
20:14:05.0437 1428        UPS            (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
20:14:05.0625 1428        UPS - ok
20:14:05.0671 1428        USBAAPL        (d4fb6ecc60a428564ba8768b0e23c0fc) C:\WINDOWS\system32\Drivers\usbaapl.sys
20:14:05.0734 1428        USBAAPL - ok
20:14:05.0781 1428        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:14:05.0953 1428        usbccgp - ok
20:14:06.0015 1428        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:14:06.0203 1428        usbehci - ok
20:14:06.0234 1428        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:14:06.0406 1428        usbhub - ok
20:14:06.0453 1428        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
20:14:06.0640 1428        usbprint - ok
20:14:06.0671 1428        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
20:14:06.0859 1428        usbscan - ok
20:14:06.0875 1428        usbstor        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:14:07.0062 1428        usbstor - ok
20:14:07.0078 1428        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
20:14:07.0250 1428        usbuhci - ok
20:14:07.0296 1428        usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
20:14:07.0484 1428        usbvideo - ok
20:14:07.0515 1428        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
20:14:07.0703 1428        VgaSave - ok
20:14:07.0718 1428        ViaIde - ok
20:14:07.0765 1428        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
20:14:07.0937 1428        VolSnap - ok
20:14:08.0000 1428        VSS            (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
20:14:08.0125 1428        VSS - ok
20:14:08.0171 1428        W32Time        (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
20:14:08.0343 1428        W32Time - ok
20:14:08.0390 1428        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:14:08.0593 1428        Wanarp - ok
20:14:08.0593 1428        WDICA - ok
20:14:08.0625 1428        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
20:14:08.0796 1428        wdmaud - ok
20:14:08.0843 1428        WebClient      (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
20:14:09.0031 1428        WebClient - ok
20:14:09.0156 1428        winmgmt        (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
20:14:09.0343 1428        winmgmt - ok
20:14:09.0406 1428        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
20:14:09.0453 1428        WmdmPmSN - ok
20:14:09.0484 1428        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
20:14:09.0671 1428        WmiApSrv - ok
20:14:09.0828 1428        WMPNetworkSvc  (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
20:14:09.0937 1428        WMPNetworkSvc - ok
20:14:10.0015 1428        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
20:14:10.0046 1428        WpdUsb - ok
20:14:10.0265 1428        WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
20:14:10.0359 1428        WPFFontCache_v0400 - ok
20:14:10.0406 1428        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
20:14:10.0671 1428        wscsvc - ok
20:14:10.0718 1428        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
20:14:10.0890 1428        WSTCODEC - ok
20:14:10.0953 1428        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
20:14:11.0140 1428        wuauserv - ok
20:14:11.0171 1428        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
20:14:11.0265 1428        WudfPf - ok
20:14:11.0296 1428        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
20:14:11.0328 1428        WudfRd - ok
20:14:11.0343 1428        WudfSvc        (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
20:14:11.0390 1428        WudfSvc - ok
20:14:11.0453 1428        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
20:14:11.0671 1428        WZCSVC - ok
20:14:11.0703 1428        xmlprov        (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
20:14:11.0953 1428        xmlprov - ok
20:14:12.0000 1428        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
20:14:13.0171 1428        \Device\Harddisk0\DR0 - ok
20:14:13.0187 1428        MBR (0x1B8)    (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR5
20:14:13.0453 1428        \Device\Harddisk1\DR5 - ok
20:14:13.0453 1428        Boot (0x1200)  (cee99027cea77554252948d92431fe00) \Device\Harddisk0\DR0\Partition0
20:14:13.0468 1428        \Device\Harddisk0\DR0\Partition0 - ok
20:14:13.0500 1428        Boot (0x1200)  (48f7c22ed3ff089f54c572302c6ba6e3) \Device\Harddisk0\DR0\Partition1
20:14:13.0500 1428        \Device\Harddisk0\DR0\Partition1 - ok
20:14:13.0515 1428        Boot (0x1200)  (3d13054bcc387d3ad95f6ba4dc9b1ad2) \Device\Harddisk1\DR5\Partition0
20:14:13.0515 1428        \Device\Harddisk1\DR5\Partition0 - ok
20:14:13.0515 1428        ============================================================
20:14:13.0515 1428        Scan finished
20:14:13.0515 1428        ============================================================
20:14:13.0640 3140        Detected object count: 1
20:14:13.0640 3140        Actual detected object count: 1
20:14:32.0250 3140        LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
20:14:32.0250 3140        LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:11:33.0984 3112        TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16
20:11:34.0031 3112        ============================================================
20:11:34.0031 3112        Current date / time: 2012/05/31 20:11:34.0031
20:11:34.0031 3112        SystemInfo:
20:11:34.0031 3112       
20:11:34.0031 3112        OS Version: 5.1.2600 ServicePack: 3.0
20:11:34.0031 3112        Product type: Workstation
20:11:34.0031 3112        ComputerName: UNSERERSTER
20:11:34.0031 3112        UserName: Admin
20:11:34.0031 3112        Windows directory: C:\WINDOWS
20:11:34.0031 3112        System windows directory: C:\WINDOWS
20:11:34.0031 3112        Processor architecture: Intel x86
20:11:34.0031 3112        Number of processors: 2
20:11:34.0031 3112        Page size: 0x1000
20:11:34.0031 3112        Boot type: Normal boot
20:11:34.0031 3112        ============================================================
20:11:35.0078 3112        Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x69A9, SectorsPerTrack: 0x36, TracksPerCylinder: 0xD6, Type 'K0', Flags 0x00000050
20:11:35.0078 3112        Drive \Device\Harddisk1\DR5 - Size: 0x7AA80000 (1.92 Gb), SectorSize: 0x200, Cylinders: 0xFA, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
20:11:35.0078 3112        ============================================================
20:11:35.0078 3112        \Device\Harddisk0\DR0:
20:11:35.0078 3112        MBR partitions:
20:11:35.0078 3112        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x36, BlocksNum 0x9020CE2
20:11:35.0078 3112        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x9020D18, BlocksNum 0x901DFF4
20:11:35.0078 3112        \Device\Harddisk1\DR5:
20:11:35.0093 3112        MBR partitions:
20:11:35.0093 3112        \Device\Harddisk1\DR5\Partition0: MBR, Type 0x6, StartLBA 0xF3, BlocksNum 0x3D530D
20:11:35.0093 3112        ============================================================
20:11:35.0125 3112        C: <-> \Device\Harddisk0\DR0\Partition0
20:11:35.0187 3112        D: <-> \Device\Harddisk0\DR0\Partition1
20:11:35.0187 3112        ============================================================
20:11:35.0187 3112        Initialize success
20:11:35.0187 3112        ============================================================
20:13:15.0156 1428        ============================================================
20:13:15.0156 1428        Scan started
20:13:15.0156 1428        Mode: Manual; SigCheck; TDLFS;
20:13:15.0156 1428        ============================================================
20:13:15.0937 1428        AAV UpdateService (7eeb488346fbfa3731276c3ee8a8fd9e) C:\Eigene_Programme\Steuertipps\Steuer-Spar-Erklaerung 2012\AAVUpdateManager\aavus.exe
20:13:16.0234 1428        AAV UpdateService - ok
20:13:16.0328 1428        Abiosdsk - ok
20:13:16.0343 1428        abp480n5 - ok
20:13:16.0390 1428        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:13:17.0890 1428        ACPI - ok
20:13:17.0921 1428        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
20:13:18.0140 1428        ACPIEC - ok
20:13:18.0140 1428        adpu160m - ok
20:13:18.0187 1428        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
20:13:18.0406 1428        aec - ok
20:13:18.0453 1428        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
20:13:18.0531 1428        AFD - ok
20:13:18.0531 1428        Aha154x - ok
20:13:18.0546 1428        aic78u2 - ok
20:13:18.0546 1428        aic78xx - ok
20:13:18.0578 1428        Alerter        (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
20:13:18.0781 1428        Alerter - ok
20:13:18.0812 1428        ALG            (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
20:13:18.0921 1428        ALG - ok
20:13:18.0921 1428        AliIde - ok
20:13:19.0109 1428        Ambfilt        (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys
20:13:19.0328 1428        Ambfilt - ok
20:13:19.0453 1428        amsint - ok
20:13:19.0593 1428        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Programme\Avira\AntiVir Desktop\sched.exe
20:13:19.0625 1428        AntiVirSchedulerService - ok
20:13:19.0671 1428        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Programme\Avira\AntiVir Desktop\avguard.exe
20:13:19.0703 1428        AntiVirService - ok
20:13:19.0796 1428        Apple Mobile Device (20f6f19fe9e753f2780dc2fa083ad597) C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
20:13:19.0828 1428        Apple Mobile Device - ok
20:13:19.0828 1428        AppMgmt - ok
20:13:19.0953 1428        AR5416          (7d53e5646ba23fd51296f7ef8979a000) C:\WINDOWS\system32\DRIVERS\athw.sys
20:13:20.0140 1428        AR5416 - ok
20:13:20.0156 1428        asc - ok
20:13:20.0171 1428        asc3350p - ok
20:13:20.0187 1428        asc3550 - ok
20:13:20.0343 1428        aspnet_state    (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
20:13:20.0453 1428        aspnet_state - ok
20:13:20.0500 1428        AsusACPI        (12415a4b61ded200fe9932b47a35fa42) C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys
20:13:20.0593 1428        AsusACPI - ok
20:13:20.0640 1428        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:13:20.0890 1428        AsyncMac - ok
20:13:20.0937 1428        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
20:13:21.0140 1428        atapi - ok
20:13:21.0140 1428        Atdisk - ok
20:13:21.0171 1428        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:13:21.0359 1428        Atmarpc - ok
20:13:21.0406 1428        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
20:13:21.0609 1428        AudioSrv - ok
20:13:21.0640 1428        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:13:21.0828 1428        audstub - ok
20:13:21.0859 1428        avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
20:13:21.0906 1428        avgntflt - ok
20:13:21.0953 1428        avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\WINDOWS\system32\DRIVERS\avipbb.sys
20:13:21.0968 1428        avipbb - ok
20:13:22.0000 1428        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
20:13:22.0015 1428        avkmgr - ok
20:13:22.0156 1428        BBSvc          (01a24b415926bb5f772dbe12459d97de) C:\Programme\Microsoft\BingBar\BBSvc.EXE
20:13:22.0203 1428        BBSvc - ok
20:13:22.0265 1428        BBUpdate        (785de7abda13309d6065305542829e76) C:\Programme\Microsoft\BingBar\SeaPort.EXE
20:13:22.0296 1428        BBUpdate - ok
20:13:22.0328 1428        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:13:22.0578 1428        Beep - ok
20:13:22.0625 1428        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
20:13:22.0875 1428        BITS - ok
20:13:22.0968 1428        Bonjour Service (f2060a34c8a75bc24a9222eb4f8c07bd) C:\Programme\Bonjour\mDNSResponder.exe
20:13:23.0000 1428        Bonjour Service - ok
20:13:23.0062 1428        Browser        (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
20:13:23.0265 1428        Browser - ok
20:13:23.0312 1428        btaudio        (4b43dfe1c1fbb305a1dc5504ef9bb34e) C:\WINDOWS\system32\drivers\btaudio.sys
20:13:23.0359 1428        btaudio - ok
20:13:23.0390 1428        BTDriver        (2f9f111d31aa3fbbe5781d829a4524e6) C:\WINDOWS\system32\DRIVERS\btport.sys
20:13:23.0421 1428        BTDriver - ok
20:13:23.0500 1428        BTKRNL          (70455baffc078b6152d1e52376296467) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
20:13:23.0578 1428        BTKRNL - ok
20:13:23.0671 1428        btwdins        (e43f7709f36444681978f9dc067a976b) C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
20:13:23.0718 1428        btwdins - ok
20:13:23.0750 1428        BTWDNDIS        (485020a1e1fc5c51a800ca69c618d881) C:\WINDOWS\system32\DRIVERS\btwdndis.sys
20:13:23.0765 1428        BTWDNDIS - ok
20:13:23.0781 1428        btwhid          (949eca9c56f657c06d3166d51f3226c7) C:\WINDOWS\system32\DRIVERS\btwhid.sys
20:13:23.0796 1428        btwhid - ok
20:13:23.0828 1428        BTWUSB          (2cfc2bd8785f82a42fcad83de1fa5a36) C:\WINDOWS\system32\Drivers\btwusb.sys
20:13:23.0843 1428        BTWUSB - ok
20:13:23.0890 1428        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:13:24.0093 1428        cbidf2k - ok
20:13:24.0140 1428        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
20:13:24.0343 1428        CCDECODE - ok
20:13:24.0359 1428        cd20xrnt - ok
20:13:24.0390 1428        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:13:24.0578 1428        Cdaudio - ok
20:13:24.0593 1428        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
20:13:24.0796 1428        Cdfs - ok
20:13:24.0828 1428        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:13:25.0031 1428        Cdrom - ok
20:13:25.0031 1428        Changer - ok
20:13:25.0046 1428        CiSvc          (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
20:13:25.0265 1428        CiSvc - ok
20:13:25.0281 1428        ClipSrv        (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
20:13:25.0484 1428        ClipSrv - ok
20:13:25.0578 1428        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:13:25.0687 1428        clr_optimization_v2.0.50727_32 - ok
20:13:25.0796 1428        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:13:26.0000 1428        clr_optimization_v4.0.30319_32 - ok
20:13:26.0062 1428        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
20:13:26.0328 1428        CmBatt - ok
20:13:26.0343 1428        CmdIde - ok
20:13:26.0359 1428        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
20:13:26.0546 1428        Compbatt - ok
20:13:26.0562 1428        COMSysApp - ok
20:13:26.0578 1428        Cpqarray - ok
20:13:26.0625 1428        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
20:13:26.0812 1428        CryptSvc - ok
20:13:26.0828 1428        dac2w2k - ok
20:13:26.0828 1428        dac960nt - ok
20:13:26.0890 1428        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
20:13:26.0968 1428        DcomLaunch - ok
20:13:27.0015 1428        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
20:13:27.0203 1428        Dhcp - ok
20:13:27.0234 1428        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
20:13:27.0421 1428        Disk - ok
20:13:27.0437 1428        dmadmin - ok
20:13:27.0515 1428        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
20:13:27.0750 1428        dmboot - ok
20:13:27.0796 1428        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
20:13:28.0000 1428        dmio - ok
20:13:28.0015 1428        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:13:28.0203 1428        dmload - ok
20:13:28.0234 1428        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
20:13:28.0421 1428        dmserver - ok
20:13:28.0453 1428        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
20:13:28.0656 1428        DMusic - ok
20:13:28.0687 1428        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
20:13:28.0781 1428        Dnscache - ok
20:13:28.0828 1428        Dot3svc        (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
20:13:29.0031 1428        Dot3svc - ok
20:13:29.0046 1428        dpti2o - ok
20:13:29.0093 1428        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
20:13:29.0265 1428        drmkaud - ok
20:13:29.0296 1428        EapHost        (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
20:13:29.0500 1428        EapHost - ok
20:13:29.0515 1428        ERSvc          (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
20:13:29.0703 1428        ERSvc - ok
20:13:29.0750 1428        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:13:29.0781 1428        Eventlog - ok
20:13:29.0828 1428        EventSystem    (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
20:13:29.0906 1428        EventSystem - ok
20:13:29.0937 1428        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
20:13:30.0125 1428        Fastfat - ok
20:13:30.0171 1428        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:13:30.0265 1428        FastUserSwitchingCompatibility - ok
20:13:30.0312 1428        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
20:13:30.0515 1428        Fdc - ok
20:13:30.0531 1428        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
20:13:30.0750 1428        Fips - ok
20:13:30.0781 1428        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
20:13:30.0968 1428        Flpydisk - ok
20:13:31.0015 1428        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
20:13:31.0218 1428        FltMgr - ok
20:13:31.0359 1428        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
20:13:31.0375 1428        FontCache3.0.0.0 - ok
20:13:31.0406 1428        fssfltr        (eda991753af03e5b06935be114ba9640) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
20:13:31.0437 1428        fssfltr - ok
20:13:31.0562 1428        fsssvc          (f6717211c1ec2cddaa81b97b0727c2e9) C:\Programme\Windows Live\Family Safety\fsssvc.exe
20:13:31.0625 1428        fsssvc - ok
20:13:31.0671 1428        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:13:31.0906 1428        Fs_Rec - ok
20:13:31.0953 1428        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:13:32.0140 1428        Ftdisk - ok
20:13:32.0187 1428        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
20:13:32.0203 1428        GEARAspiWDM - ok
20:13:32.0250 1428        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:13:32.0437 1428        Gpc - ok
20:13:32.0484 1428        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
20:13:32.0656 1428        HDAudBus - ok
20:13:32.0703 1428        helpsvc        (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
20:13:32.0890 1428        helpsvc - ok
20:13:32.0921 1428        HidServ        (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
20:13:33.0109 1428        HidServ - ok
20:13:33.0125 1428        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:13:33.0312 1428        HidUsb - ok
20:13:33.0343 1428        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
20:13:33.0531 1428        hkmsvc - ok
20:13:33.0546 1428        hpn - ok
20:13:33.0609 1428        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
20:13:33.0656 1428        HTTP - ok
20:13:33.0687 1428        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
20:13:33.0875 1428        HTTPFilter - ok
20:13:33.0875 1428        i2omgmt - ok
20:13:33.0890 1428        i2omp - ok
20:13:33.0937 1428        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:13:34.0125 1428        i8042prt - ok
20:13:34.0484 1428        ialm            (0f68e2ec713f132ffb19e45415b09679) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
20:13:34.0890 1428        ialm - ok
20:13:35.0046 1428        iaStor          (8ef427c54497c5f8a7a645990e4278c7) C:\WINDOWS\system32\drivers\iaStor.sys
20:13:35.0093 1428        iaStor - ok
20:13:35.0296 1428        idsvc          (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:13:35.0421 1428        idsvc - ok
20:13:35.0468 1428        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:13:35.0718 1428        Imapi - ok
20:13:35.0734 1428        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
20:13:35.0953 1428        ImapiService - ok
20:13:36.0000 1428        InCDfs          (580a81790cd0a48d85da322267da7ac4) C:\WINDOWS\system32\drivers\InCDFs.sys
20:13:36.0015 1428        InCDfs - ok
20:13:36.0062 1428        InCDPass        (aaa2789d2ce21b31be9406ba1ceb7285) C:\WINDOWS\system32\drivers\InCDPass.sys
20:13:36.0078 1428        InCDPass - ok
20:13:36.0093 1428        InCDrec        (4d022577e9072b5d22e0a383a7806bbb) C:\WINDOWS\system32\drivers\InCDrec.sys
20:13:36.0109 1428        InCDrec - ok
20:13:36.0125 1428        incdrm          (c258e57321a3c3737f4fa815fa69ee0b) C:\WINDOWS\system32\drivers\InCDRm.sys
20:13:36.0140 1428        incdrm - ok
20:13:36.0343 1428        InCDsrv        (9792b85e32e058cd6a43db274ba47d57) C:\Eigene_Programme\Nero 7\InCD\InCDsrv.exe
20:13:36.0437 1428        InCDsrv - ok
20:13:36.0562 1428        ini910u - ok
20:13:36.0921 1428        IntcAzAudAddService (816a4f17dffdeeb01896fe05991838e0) C:\WINDOWS\system32\drivers\RtkHDAud.sys
20:13:37.0187 1428        IntcAzAudAddService - ok
20:13:37.0265 1428        IntelIde - ok
20:13:37.0281 1428        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
20:13:37.0484 1428        intelppm - ok
20:13:37.0515 1428        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
20:13:37.0734 1428        Ip6Fw - ok
20:13:37.0750 1428        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:13:37.0921 1428        IpFilterDriver - ok
20:13:37.0937 1428        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:13:38.0125 1428        IpInIp - ok
20:13:38.0296 1428        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:13:38.0500 1428        IpNat - ok
20:13:38.0609 1428        iPod Service    (ca9d4b998bff311a539604ed87318fa0) C:\Programme\iPod\bin\iPodService.exe
20:13:38.0671 1428        iPod Service - ok
20:13:38.0718 1428        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:13:38.0968 1428        IPSec - ok
20:13:39.0000 1428        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:13:39.0156 1428        IRENUM - ok
20:13:39.0187 1428        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:13:39.0375 1428        isapnp - ok
20:13:39.0468 1428        JavaQuickStarterService (5e06a9d23727daf96faa796f1135fdcd) C:\Programme\Java\jre6\bin\jqs.exe
20:13:39.0484 1428        JavaQuickStarterService - ok
20:13:39.0515 1428        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:13:39.0734 1428        Kbdclass - ok
20:13:39.0796 1428        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
20:13:39.0984 1428        kmixer - ok
20:13:40.0031 1428        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
20:13:40.0171 1428        KSecDD - ok
20:13:40.0234 1428        Ktp            (85b6d85c044e3df77e92b5a7b265008f) C:\WINDOWS\system32\DRIVERS\ETD.sys
20:13:40.0312 1428        Ktp - ok
20:13:40.0343 1428        L1e            (fa46f5d09edf93e0c71fe6500fe3f4ae) C:\WINDOWS\system32\DRIVERS\l1e51x86.sys
20:13:40.0359 1428        L1e - ok
20:13:40.0421 1428        LanmanServer    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
20:13:40.0515 1428        LanmanServer - ok
20:13:40.0562 1428        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
20:13:40.0656 1428        lanmanworkstation - ok
20:13:40.0781 1428        Lavasoft Ad-Aware Service (335b35f436d6801a4910afbde5aa6a16) C:\Programme\Lavasoft\Ad-Aware\AAWService.exe
20:13:40.0890 1428        Lavasoft Ad-Aware Service - ok
20:13:40.0921 1428        Lbd            (419590ebe7855215bb157ea0cf0d0531) C:\WINDOWS\system32\DRIVERS\Lbd.sys
20:13:40.0968 1428        Lbd - ok
20:13:40.0968 1428        lbrtfdc - ok
20:13:41.0109 1428        LightScribeService (abf90fc5a127f481219b873c1b8dfc1c) C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
20:13:41.0125 1428        LightScribeService ( UnsignedFile.Multi.Generic ) - warning
20:13:41.0125 1428        LightScribeService - detected UnsignedFile.Multi.Generic (1)
20:13:41.0171 1428        LmHosts        (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
20:13:41.0421 1428        LmHosts - ok
20:13:41.0437 1428        MBAMProtector  (fb097bbc1a18f044bd17bd2fccf97865) C:\WINDOWS\system32\drivers\mbam.sys
20:13:41.0468 1428        MBAMProtector - ok
20:13:41.0546 1428        MBAMService    (ba400ed640bca1eae5c727ae17c10207) C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
20:13:41.0593 1428        MBAMService - ok
20:13:41.0625 1428        Messenger      (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
20:13:41.0828 1428        Messenger - ok
20:13:41.0859 1428        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:13:42.0031 1428        mnmdd - ok
20:13:42.0093 1428        mnmsrvc        (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
20:13:42.0281 1428        mnmsrvc - ok
20:13:42.0312 1428        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
20:13:42.0531 1428        Modem - ok
20:13:42.0625 1428        Monfilt        (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys
20:13:42.0765 1428        Monfilt - ok
20:13:42.0812 1428        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:13:43.0000 1428        Mouclass - ok
20:13:43.0078 1428        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:13:43.0281 1428        mouhid - ok
20:13:43.0296 1428        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
20:13:43.0500 1428        MountMgr - ok
20:13:43.0500 1428        mraid35x - ok
20:13:43.0546 1428        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:13:43.0734 1428        MRxDAV - ok
20:13:43.0796 1428        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:13:43.0906 1428        MRxSmb - ok
20:13:43.0937 1428        MSDTC          (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
20:13:44.0125 1428        MSDTC - ok
20:13:44.0171 1428        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
20:13:44.0406 1428        Msfs - ok
20:13:44.0406 1428        MSIServer - ok
20:13:44.0468 1428        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:13:44.0671 1428        MSKSSRV - ok
20:13:44.0687 1428        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:13:44.0859 1428        MSPCLOCK - ok
20:13:44.0906 1428        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
20:13:45.0109 1428        MSPQM - ok
20:13:45.0140 1428        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:13:45.0312 1428        mssmbios - ok
20:13:45.0343 1428        MSTEE          (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
20:13:45.0531 1428        MSTEE - ok
20:13:45.0578 1428        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
20:13:45.0625 1428        Mup - ok
20:13:45.0656 1428        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
20:13:45.0859 1428        NABTSFEC - ok
20:13:45.0921 1428        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
20:13:46.0140 1428        napagent - ok
20:13:46.0296 1428        NBService      (b498a14133bd09ad0817590ace4470ad) C:\Eigene_Programme\Nero 7\Nero BackItUp\NBService.exe
20:13:46.0375 1428        NBService - ok
20:13:46.0437 1428        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
20:13:46.0656 1428        NDIS - ok
20:13:46.0703 1428        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
20:13:46.0937 1428        NdisIP - ok
20:13:46.0968 1428        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:13:47.0015 1428        NdisTapi - ok
20:13:47.0062 1428        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:13:47.0250 1428        Ndisuio - ok
20:13:47.0296 1428        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:13:47.0484 1428        NdisWan - ok
20:13:47.0515 1428        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
20:13:47.0609 1428        NDProxy - ok
20:13:47.0640 1428        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
20:13:47.0828 1428        NetBIOS - ok
20:13:47.0875 1428        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
20:13:48.0078 1428        NetBT - ok
20:13:48.0125 1428        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:13:48.0312 1428        NetDDE - ok
20:13:48.0328 1428        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
20:13:48.0515 1428        NetDDEdsdm - ok
20:13:48.0625 1428        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:48.0796 1428        Netlogon - ok
20:13:48.0859 1428        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
20:13:49.0062 1428        Netman - ok
20:13:49.0171 1428        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
20:13:49.0250 1428        NetTcpPortSharing - ok
20:13:49.0312 1428        Nla            (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
20:13:49.0359 1428        Nla - ok
20:13:49.0484 1428        NMIndexingService (a328a46d87bb92ce4d8a4528e9d84787) C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
20:13:49.0500 1428        NMIndexingService - ok
20:13:49.0546 1428        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
20:13:49.0734 1428        Npfs - ok
20:13:49.0765 1428        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
20:13:50.0000 1428        Ntfs - ok
20:13:50.0031 1428        NtLmSsp        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:50.0218 1428        NtLmSsp - ok
20:13:50.0250 1428        NtmsSvc        (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
20:13:50.0484 1428        NtmsSvc - ok
20:13:50.0500 1428        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:13:50.0687 1428        Null - ok
20:13:50.0703 1428        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:13:50.0890 1428        NwlnkFlt - ok
20:13:50.0906 1428        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:13:51.0093 1428        NwlnkFwd - ok
20:13:51.0218 1428        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
20:13:51.0281 1428        odserv - ok
20:13:51.0328 1428        ose            (5a432a042dae460abe7199b758e8606c) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
20:13:51.0343 1428        ose - ok
20:13:51.0390 1428        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
20:13:51.0578 1428        Parport - ok
20:13:51.0625 1428        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
20:13:51.0843 1428        PartMgr - ok
20:13:51.0890 1428        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
20:13:52.0078 1428        ParVdm - ok
20:13:52.0125 1428        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
20:13:52.0312 1428        PCI - ok
20:13:52.0343 1428        PCIDump - ok
20:13:52.0343 1428        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
20:13:52.0531 1428        PCIIde - ok
20:13:52.0562 1428        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
20:13:52.0750 1428        Pcmcia - ok
20:13:52.0765 1428        PDCOMP - ok
20:13:52.0765 1428        PDFRAME - ok
20:13:52.0781 1428        PDRELI - ok
20:13:52.0781 1428        PDRFRAME - ok
20:13:52.0796 1428        perc2 - ok
20:13:52.0812 1428        perc2hib - ok
20:13:52.0875 1428        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
20:13:52.0906 1428        PlugPlay - ok
20:13:52.0953 1428        PolicyAgent    (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:53.0125 1428        PolicyAgent - ok
20:13:53.0156 1428        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:13:53.0343 1428        PptpMiniport - ok
20:13:53.0359 1428        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:53.0531 1428        ProtectedStorage - ok
20:13:53.0546 1428        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
20:13:53.0734 1428        PSched - ok
20:13:54.0000 1428        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:13:54.0203 1428        Ptilink - ok
20:13:54.0250 1428        PxHelp20        (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
20:13:54.0281 1428        PxHelp20 - ok
20:13:54.0281 1428        ql1080 - ok
20:13:54.0296 1428        Ql10wnt - ok
20:13:54.0312 1428        ql12160 - ok
20:13:54.0328 1428        ql1240 - ok
20:13:54.0343 1428        ql1280 - ok
20:13:54.0359 1428        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:13:54.0609 1428        RasAcd - ok
20:13:54.0625 1428        RasAuto        (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
20:13:54.0812 1428        RasAuto - ok
20:13:54.0828 1428        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:13:55.0015 1428        Rasl2tp - ok
20:13:55.0046 1428        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
20:13:55.0234 1428        RasMan - ok
20:13:55.0265 1428        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:13:55.0468 1428        RasPppoe - ok
20:13:55.0484 1428        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
20:13:55.0656 1428        Raspti - ok
20:13:55.0718 1428        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:13:55.0921 1428        Rdbss - ok
20:13:55.0953 1428        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:13:56.0156 1428        RDPCDD - ok
20:13:56.0218 1428        RDPWD          (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
20:13:56.0265 1428        RDPWD - ok
20:13:56.0328 1428        RDSessMgr      (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
20:13:56.0515 1428        RDSessMgr - ok
20:13:56.0562 1428        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
20:13:56.0765 1428        redbook - ok
20:13:56.0796 1428        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
20:13:57.0015 1428        RemoteAccess - ok
20:13:57.0062 1428        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
20:13:57.0265 1428        RpcLocator - ok
20:13:57.0328 1428        RpcSs          (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
20:13:57.0375 1428        RpcSs - ok
20:13:57.0421 1428        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
20:13:57.0593 1428        RSVP - ok
20:13:57.0671 1428        RT80x86        (f591f71883424f5b31e3348ea4454466) C:\WINDOWS\system32\DRIVERS\RT2860.sys
20:13:57.0796 1428        RT80x86 - ok
20:13:57.0843 1428        SamSs          (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
20:13:58.0031 1428        SamSs - ok
20:13:58.0078 1428        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
20:13:58.0328 1428        SCardSvr - ok
20:13:58.0359 1428        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
20:13:58.0546 1428        Schedule - ok
20:13:58.0593 1428        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:13:58.0671 1428        Secdrv - ok
20:13:58.0718 1428        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
20:13:58.0906 1428        seclogon - ok
20:13:58.0937 1428        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
20:13:59.0109 1428        SENS - ok
20:13:59.0140 1428        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
20:13:59.0328 1428        Serial - ok
20:13:59.0359 1428        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
20:13:59.0546 1428        Sfloppy - ok
20:13:59.0593 1428        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
20:13:59.0781 1428        SharedAccess - ok
20:13:59.0812 1428        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:13:59.0843 1428        ShellHWDetection - ok
20:13:59.0859 1428        Simbad - ok
20:13:59.0906 1428        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
20:14:00.0078 1428        SLIP - ok
20:14:00.0234 1428        SNP2UVC        (060f51141b20b8156804446a04ab8b2a) C:\WINDOWS\system32\DRIVERS\snp2uvc.sys
20:14:00.0437 1428        SNP2UVC - ok
20:14:00.0546 1428        Sparrow - ok
20:14:00.0593 1428        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
20:14:00.0843 1428        splitter - ok
20:14:00.0890 1428        Spooler        (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
20:14:00.0953 1428        Spooler - ok
20:14:01.0031 1428        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
20:14:01.0140 1428        sr - ok
20:14:01.0156 1428        srservice      (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
20:14:01.0250 1428        srservice - ok
20:14:01.0312 1428        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
20:14:01.0406 1428        Srv - ok
20:14:01.0437 1428        SSDPSRV        (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
20:14:01.0531 1428        SSDPSRV - ok
20:14:01.0609 1428        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
20:14:01.0625 1428        ssmdrv - ok
20:14:01.0687 1428        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
20:14:01.0890 1428        stisvc - ok
20:14:01.0937 1428        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
20:14:02.0156 1428        streamip - ok
20:14:02.0203 1428        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:14:02.0390 1428        swenum - ok
20:14:02.0437 1428        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
20:14:02.0609 1428        swmidi - ok
20:14:02.0625 1428        SwPrv - ok
20:14:02.0625 1428        symc810 - ok
20:14:02.0640 1428        symc8xx - ok
20:14:02.0640 1428        sym_hi - ok
20:14:02.0656 1428        sym_u3 - ok
20:14:02.0703 1428        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
20:14:02.0906 1428        sysaudio - ok
20:14:02.0953 1428        SysmonLog      (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
20:14:03.0140 1428        SysmonLog - ok
20:14:03.0203 1428        TapiSrv        (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
20:14:03.0390 1428        TapiSrv - ok
20:14:03.0437 1428        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:14:03.0484 1428        Tcpip - ok
20:14:03.0531 1428        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:14:03.0718 1428        TDPIPE - ok
20:14:03.0734 1428        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
20:14:03.0921 1428        TDTCP - ok
20:14:03.0968 1428        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
20:14:04.0156 1428        TermDD - ok
20:14:04.0234 1428        TermService    (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
20:14:04.0421 1428        TermService - ok
20:14:04.0468 1428        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
20:14:04.0500 1428        Themes - ok
20:14:04.0500 1428        TosIde - ok
20:14:04.0546 1428        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
20:14:04.0750 1428        TrkWks - ok
20:14:04.0796 1428        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
20:14:04.0968 1428        Udfs - ok
20:14:04.0984 1428        ultra - ok
20:14:05.0062 1428        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
20:14:05.0281 1428        Update - ok
20:14:05.0328 1428        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
20:14:05.0421 1428        upnphost - ok
20:14:05.0437 1428        UPS            (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
20:14:05.0625 1428        UPS - ok
20:14:05.0671 1428        USBAAPL        (d4fb6ecc60a428564ba8768b0e23c0fc) C:\WINDOWS\system32\Drivers\usbaapl.sys
20:14:05.0734 1428        USBAAPL - ok
20:14:05.0781 1428        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:14:05.0953 1428        usbccgp - ok
20:14:06.0015 1428        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:14:06.0203 1428        usbehci - ok
20:14:06.0234 1428        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:14:06.0406 1428        usbhub - ok
20:14:06.0453 1428        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
20:14:06.0640 1428        usbprint - ok
20:14:06.0671 1428        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
20:14:06.0859 1428        usbscan - ok
20:14:06.0875 1428        usbstor        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:14:07.0062 1428        usbstor - ok
20:14:07.0078 1428        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
20:14:07.0250 1428        usbuhci - ok
20:14:07.0296 1428        usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
20:14:07.0484 1428        usbvideo - ok
20:14:07.0515 1428        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
20:14:07.0703 1428        VgaSave - ok
20:14:07.0718 1428        ViaIde - ok
20:14:07.0765 1428        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
20:14:07.0937 1428        VolSnap - ok
20:14:08.0000 1428        VSS            (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
20:14:08.0125 1428        VSS - ok
20:14:08.0171 1428        W32Time        (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
20:14:08.0343 1428        W32Time - ok
20:14:08.0390 1428        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:14:08.0593 1428        Wanarp - ok
20:14:08.0593 1428        WDICA - ok
20:14:08.0625 1428        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
20:14:08.0796 1428        wdmaud - ok
20:14:08.0843 1428        WebClient      (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
20:14:09.0031 1428        WebClient - ok
20:14:09.0156 1428        winmgmt        (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
20:14:09.0343 1428        winmgmt - ok
20:14:09.0406 1428        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
20:14:09.0453 1428        WmdmPmSN - ok
20:14:09.0484 1428        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
20:14:09.0671 1428        WmiApSrv - ok
20:14:09.0828 1428        WMPNetworkSvc  (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
20:14:09.0937 1428        WMPNetworkSvc - ok
20:14:10.0015 1428        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
20:14:10.0046 1428        WpdUsb - ok
20:14:10.0265 1428        WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
20:14:10.0359 1428        WPFFontCache_v0400 - ok
20:14:10.0406 1428        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
20:14:10.0671 1428        wscsvc - ok
20:14:10.0718 1428        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
20:14:10.0890 1428        WSTCODEC - ok
20:14:10.0953 1428        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
20:14:11.0140 1428        wuauserv - ok
20:14:11.0171 1428        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
20:14:11.0265 1428        WudfPf - ok
20:14:11.0296 1428        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
20:14:11.0328 1428        WudfRd - ok
20:14:11.0343 1428        WudfSvc        (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
20:14:11.0390 1428        WudfSvc - ok
20:14:11.0453 1428        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
20:14:11.0671 1428        WZCSVC - ok
20:14:11.0703 1428        xmlprov        (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
20:14:11.0953 1428        xmlprov - ok
20:14:12.0000 1428        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
20:14:13.0171 1428        \Device\Harddisk0\DR0 - ok
20:14:13.0187 1428        MBR (0x1B8)    (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR5
20:14:13.0453 1428        \Device\Harddisk1\DR5 - ok
20:14:13.0453 1428        Boot (0x1200)  (cee99027cea77554252948d92431fe00) \Device\Harddisk0\DR0\Partition0
20:14:13.0468 1428        \Device\Harddisk0\DR0\Partition0 - ok
20:14:13.0500 1428        Boot (0x1200)  (48f7c22ed3ff089f54c572302c6ba6e3) \Device\Harddisk0\DR0\Partition1
20:14:13.0500 1428        \Device\Harddisk0\DR0\Partition1 - ok
20:14:13.0515 1428        Boot (0x1200)  (3d13054bcc387d3ad95f6ba4dc9b1ad2) \Device\Harddisk1\DR5\Partition0
20:14:13.0515 1428        \Device\Harddisk1\DR5\Partition0 - ok
20:14:13.0515 1428        ============================================================
20:14:13.0515 1428        Scan finished
20:14:13.0515 1428        ============================================================
20:14:13.0640 3140        Detected object count: 1
20:14:13.0640 3140        Actual detected object count: 1
20:14:32.0250 3140        LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
20:14:32.0250 3140        LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip
Viele Grüße

cosinus 31.05.2012 20:04
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Bremser 31.05.2012 20:54
Hallo Arne

So, nun COMBOFIX ausgeführt.
Anbei das Log


Combofix Logfile:
Code:
ComboFix 12-05-31.02 - Admin 31.05.2012  21:27:57.1.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.2039.1220 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Admin\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\1.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\a.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\b.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\c.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\d.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\e.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\f.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\g.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\h.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\i.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\J.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\k.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\l.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\m.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\mru.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\n.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\o.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\p.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\q.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\r.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\s.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\t.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\u.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\v.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\w.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\x.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\y.xml
c:\dokumente und einstellungen\Wolfgang\Anwendungsdaten\PriceGong\Data\z.xml
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-04-28 bis 2012-05-31  ))))))))))))))))))))))))))))))
.
.
2012-05-29 18:42 . 2012-05-30 18:07    --------    d-----w-    C:\_OTL
2012-05-22 17:34 . 2012-05-22 17:34    --------    d-----w-    c:\programme\ESET
2012-05-21 18:12 . 2012-05-21 18:12    --------    d-----w-    c:\dokumente und einstellungen\Admin\Anwendungsdaten\Malwarebytes
2012-05-21 18:12 . 2012-05-21 18:12    --------    d-----w-    c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-05-21 18:12 . 2012-05-21 18:12    --------    d-----w-    c:\programme\Malwarebytes' Anti-Malware
2012-05-21 18:12 . 2012-04-04 13:56    22344    ----a-w-    c:\windows\system32\drivers\mbam.sys
2012-05-21 05:17 . 2012-05-21 05:17    --------    d-----w-    c:\programme\Uncompressor
2012-05-20 17:03 . 2012-05-20 17:03    --------    d--h--w-    c:\windows\PIF
2012-05-18 20:58 . 2012-05-18 20:58    --------    d-sh--w-    c:\dokumente und einstellungen\Stefanie\PrivacIE
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-08 19:27 . 2011-10-23 19:26    83392    ----a-w-    c:\windows\system32\drivers\avgntflt.sys
2012-05-08 19:27 . 2011-10-23 19:26    137928    ----a-w-    c:\windows\system32\drivers\avipbb.sys
2012-04-11 13:51 . 2008-04-14 07:30    2029056    ----a-w-    c:\windows\system32\ntkrnlpa.exe
2012-04-11 13:51 . 2010-03-02 07:58    1862400    ----a-w-    c:\windows\system32\win32k.sys
2012-04-11 13:51 . 2008-04-14 07:29    2150912    ----a-w-    c:\windows\system32\ntoskrnl.exe
2008-05-07 08:34 . 2009-03-02 08:49    15523560    ----a-w-    c:\programme\U1 Setup.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayIconExtension1]
@="{fe25455d-b4c2-4e32-97d2-92632ec1c224}"
[HKEY_CLASSES_ROOT\CLSID\{fe25455d-b4c2-4e32-97d2-92632ec1c224}]
2009-11-06 23:07    297808    ----a-w-    c:\windows\system32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayIconExtension2]
@="{1fae2d88-a78e-4f03-909f-be818a3c1ce6}"
[HKEY_CLASSES_ROOT\CLSID\{1fae2d88-a78e-4f03-909f-be818a3c1ce6}]
2009-11-06 23:07    297808    ----a-w-    c:\windows\system32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"ETDWare"="c:\programme\Elantech\ETDCtrl.exe" [2009-01-23 416768]
"AsusTray"="c:\programme\EeePC\ACPI\AsTray.exe" [2008-12-04 114688]
"AsusACPIServer"="c:\programme\EeePC\ACPI\AsAcpiSvr.exe" [2008-12-17 622592]
"AsusEPCMonitor"="c:\programme\EeePC\ACPI\AsEPCMon.exe" [2008-05-21 94208]
"NeroFilterCheck"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SecurDisc"="c:\eigene_programme\Nero 7\InCD\NBHGui.exe" [2007-06-25 1629480]
"InCD"="c:\eigene_programme\Nero 7\InCD\InCD.exe" [2007-06-25 1057064]
"Ad-Watch"="c:\programme\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-25 518488]
"CanonSolutionMenu"="c:\programme\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]
"CanonMyPrinter"="c:\programme\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]
"QuickTime Task"="c:\eigene_programme\Quicktime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\eigene_programme\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-10-29 249064]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-13 17508864]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\Wolfgang\Startmenü\Programme\Autostart\
k8h00.exe.lnk - c:\windows\system32\rundll32.exe [2010-3-2 33792]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\programme\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\dokumente und einstellungen\Admin\Startmenü\Programme\Autostart\
ac'tivAid.lnk - c:\eigene_programme\ActivAid\ac'tivAid.ahk [2008-6-5 495612]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\programme\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
Printkey2000.lnk - c:\eigene_programme\PrintKey2000\Printkey2000.exe [2009-5-22 794112]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programme\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Programme\\Avira\\AntiVir Desktop\\avcenter.exe"=
"c:\\Eigene_Programme\\Rsync\\rsync.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Eigene_Programme\\iTunes\\iTunes.exe"=
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [25.06.2009 20:29 64160]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [23.10.2011 21:26 36000]
R2 AAV UpdateService;AAV UpdateService;c:\eigene_programme\Steuertipps\Steuer-Spar-Erklaerung 2012\AAVUpdateManager\aavus.exe [24.10.2008 17:35 128296]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [23.10.2011 21:26 86224]
R2 BBUpdate;BBUpdate;c:\programme\Microsoft\BingBar\SeaPort.EXE [13.10.2011 18:21 249648]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\programme\Lavasoft\Ad-Aware\AAWService.exe [09.03.2009 21:06 1003344]
R2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [21.05.2012 20:12 654408]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [21.05.2012 20:12 22344]
R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [02.03.2009 10:44 704384]
S2 BBSvc;Bing Bar Update Service;c:\programme\Microsoft\BingBar\BBSvc.EXE [21.10.2011 16:23 196176]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 13:16 130384]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [02.03.2009 10:42 1684736]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 13:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 08:14    451872    ----a-w-    c:\programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2012-05-28 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 18:28]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Senden an &Bluetooth-Gerät... - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Senden an Bluetooth - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
AddRemove-BabylonToolbar - c:\programme\BabylonToolbar\BabylonToolbar\1.5.3.17\uninstall.exe
AddRemove-Winamp - c:\programme\Winamp\UninstWA.exe
AddRemove-Youtube Downloader HD_is1 - c:\eigene_programme\Youtube_downloader_HD\Youtube Downloader HD\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-05-31 21:37
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-05-31  21:40:05
ComboFix-quarantined-files.txt  2012-05-31 19:40
.
Vor Suchlauf: 7 Verzeichnis(se), 30.051.483.648 Bytes frei
Nach Suchlauf: 9 Verzeichnis(se), 32.209.793.024 Bytes frei
.
WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 0A74A938002FEDAD38FDABF9F23E09DA
--- --- ---



Viele Grüße und vielen Dank


Alle Zeitangaben in WEZ +1. Es ist jetzt 13:06 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131