Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   GVU-Trojaner (Start des abgesicherten Modus nicht möglich) (https://www.trojaner-board.de/130648-gvu-trojaner-start-abgesicherten-modus-moeglich.html)

K2G 05.02.2013 11:14
GVU-Trojaner (Start des abgesicherten Modus nicht möglich)
 
Hallo,

der Thread-Titel sollte eigentlich alles erklären. Habe hier ein Notebook, das beim Hochfahren direkt durch die GVU-Warnung gesperrt wird.

In den abgesicherten Modus komme ich gar nicht mehr rein.


Einen Systemscan mit OTL habe ich bereits gemacht. Hier das erzeugte Log:

Code:
OTL logfile created on: 2/5/2013 9:20:47 AM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
479.00 Mb Total Physical Memory | 250.00 Mb Available Physical Memory | 52.00% Memory free
383.00 Mb Paging File | 275.00 Mb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37.25 Gb Total Space | 17.45 Gb Free Space | 46.85% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet003
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled] --  -- (HidServ)
SRV - [2011/04/16 19:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Auto] -- C:\Programme\Norton AntiVirus\Engine\18.7.1.3\ccSvcHst.exe -- (NAV)
SRV - [2005/04/03 17:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003/06/19 16:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | On_Demand] --  -- (EraserUtilRebootDrv)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2013/01/16 14:52:51 | 001,603,824 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20130128.004\NAVEX15.SYS -- (NAVEX15)
DRV - [2013/01/16 14:52:45 | 000,093,296 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20130128.004\NAVENG.SYS -- (NAVENG)
DRV - [2012/10/23 18:34:24 | 000,995,488 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20130111.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2012/08/31 19:27:25 | 000,373,728 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20130122.001\IDSxpx86.sys -- (IDSxpx86)
DRV - [2012/08/09 13:49:25 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011/05/11 13:50:53 | 000,126,584 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2011/04/20 20:37:49 | 000,369,784 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\WINDOWS\System32\Drivers\NAV\1207010.003\SYMTDI.SYS -- (SYMTDI)
DRV - [2011/03/30 22:00:09 | 000,516,216 | ---- | M] (Symantec Corporation) [File_System | On_Demand] -- C:\WINDOWS\System32\Drivers\NAV\1207010.003\SRTSP.SYS -- (SRTSP)
DRV - [2011/03/30 22:00:09 | 000,050,168 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\NAV\1207010.003\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2011/03/14 21:31:23 | 000,744,568 | ---- | M] (Symantec Corporation) [File_System | Boot] -- C:\WINDOWS\system32\drivers\NAV\1207010.003\symefa.sys -- (SymEFA)
DRV - [2011/01/27 01:47:10 | 000,340,088 | ---- | M] (Symantec Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\NAV\1207010.003\symds.sys -- (SymDS)
DRV - [2011/01/27 00:07:05 | 000,136,312 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\NAV\1207010.003\Ironx86.SYS -- (SymIRON)
DRV - [2008/04/18 09:12:23 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2004/08/30 11:36:24 | 000,637,713 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004/08/09 22:27:18 | 000,070,144 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2004/08/03 16:29:52 | 000,166,912 | ---- | M] (S3 Graphics, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\s3gnbm.sys -- (S3SavageNB)
DRV - [2004/08/03 15:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)
DRV - [2004/07/20 13:16:00 | 000,393,280 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\PRISMA00.sys -- (PRISM_A00)
DRV - [2004/02/24 05:08:52 | 000,400,384 | ---- | M] (Sensaura) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)
DRV - [2004/02/20 23:00:44 | 001,265,388 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\bertram_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\bertram_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\bertram_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\bertram_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\bertram_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\bertram_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.abbasite.com/start/"
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 445
FF - prefs.js..network.proxy.type: 1
 
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.660: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.660: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.660: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: 
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPlgn\ [2012/02/11 08:31:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/08/19 13:45:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 1.5\Extensions\\Components: C:\Programme\Mozilla Firefox\Components [2011/08/19 13:44:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 1.5\Extensions\\Plugins: C:\Programme\Mozilla Firefox\Plugins [2011/08/19 13:46:38 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 1.5\Extensions\\Components: C:\Programme\Mozilla Firefox\Components [2011/08/19 13:44:52 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 1.5\Extensions\\Plugins: C:\Programme\Mozilla Firefox\Plugins [2011/08/19 13:46:38 | 000,000,000 | ---D | M]
 
[2008/08/17 03:18:33 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\mozilla\Firefox\Profiles\jfk1bdzk.default\extensions
[2011/08/14 04:51:22 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010/04/18 02:26:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/11/18 14:47:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/08/14 04:51:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2008/08/17 03:12:47 | 000,000,000 | ---D | M] (Mozilla Firefox distributed by RealNetworks) -- C:\Programme\Mozilla Firefox\extensions\realplayer@partners.mozilla.com
File not found (No name found) -- C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD\FIREFOX\EXT
[2009/02/28 05:55:50 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2008/08/17 03:12:35 | 000,060,526 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\jar50.dll
[2008/08/17 03:12:37 | 000,049,256 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\jsd3250.dll
[2008/08/17 03:12:35 | 000,166,000 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\xpinstal.dll
[2011/05/03 21:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2008/08/17 03:12:44 | 000,000,680 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazon-de.png
[2008/08/17 03:12:45 | 000,000,804 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazon-de.src
[2008/08/17 03:12:44 | 000,000,210 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.gif
[2008/08/17 03:12:45 | 000,001,075 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.src
[2008/08/17 03:12:45 | 000,001,076 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\google-de.gif
[2008/08/17 03:12:44 | 000,000,879 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\google-de.src
[2008/08/17 03:12:45 | 000,000,232 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.png
[2008/08/17 03:12:44 | 000,001,157 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.src
[2008/08/17 03:12:45 | 000,000,088 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.gif
[2008/08/17 03:12:44 | 000,001,147 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.src
 
O1 HOSTS File: ([2006/01/30 14:51:18 | 000,000,847 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton AntiVirus\Engine\18.7.1.3\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - Software - No CLSID value found.
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKU\bertram_ON_C\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\bertram_ON_C\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\bertram_ON_C\..\Toolbar\WebBrowser: (no name) - {8D85C8A8-284B-46E5-AD8F-6EB5A4FAC059} - No CLSID value found.
O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\bertram\Startmenü\Programme\Autostart\Internet Explorer.lnk =  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\bertram_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre6\bin\npjpi160_26.dll (Sun Microsystems, Inc.)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} hxxp://www.symantec.com/techsupp/activedata/nprdtinf.cab (AxProdInfoCtl Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1101731106228 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.100.41 192.168.100.42
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - ( ) - (Registry value not found)
O20 - HKU\bertram_ON_C Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKU\bertram_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\skype.dat) - C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\skype.dat ()
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/20 16:05:28 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/31 05:45:30 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/02/01 06:46:47 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/02/01 06:46:27 | 000,000,422 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{3859A61C-74AC-4F24-B01E-13A9637A9787}.job
[2013/02/01 06:46:23 | 000,000,004 | ---- | M] () -- C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\skype.ini
[2013/02/01 06:45:03 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/02/01 06:44:40 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/02/01 06:44:38 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1607368633-1323500987-4146661464-1007.job
[2013/02/01 06:44:20 | 502,845,440 | -HS- | M] () -- C:\hiberfil.sys
[2013/01/31 04:09:50 | 000,001,092 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/29 11:47:28 | 000,000,000 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2013/01/27 04:11:20 | 000,039,936 | ---- | M] () -- C:\Dokumente und Einstellungen\bertram\Eigene Dateien\Unterhaltskosten RS3 ab 08.2011.xlr
[2013/01/25 15:56:53 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1607368633-1323500987-4146661464-1007.job
[2013/01/25 11:15:00 | 000,000,400 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job
[2013/01/25 10:19:00 | 000,393,086 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2013/01/25 10:19:00 | 000,382,026 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/01/25 10:19:00 | 000,053,770 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/01/25 10:18:59 | 000,064,848 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2013/01/09 17:11:48 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/01/28 15:43:41 | 000,000,004 | ---- | C] () -- C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\skype.ini
[2012/06/11 13:43:01 | 000,000,288 | ---- | C] () -- C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\.backup.dm
[2012/02/16 14:17:00 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2010/10/27 13:36:50 | 000,001,940 | ---- | C] () -- C:\Dokumente und Einstellungen\bertram\Lokale Einstellungen\Anwendungsdaten\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/10/27 13:30:53 | 000,001,940 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2009/02/13 10:03:21 | 000,000,127 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2008/08/17 03:18:38 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2008/08/17 03:12:35 | 000,003,373 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2007/08/17 06:29:05 | 000,003,584 | ---- | C] () -- C:\Dokumente und Einstellungen\bertram\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/02/11 05:44:14 | 000,936,704 | ---- | C] () -- C:\WINDOWS\1301_766.exe
[2006/02/07 13:38:26 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2005/11/06 14:16:07 | 000,000,668 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2005/02/27 14:20:50 | 000,003,196 | ---- | C] () -- C:\WINDOWS\tm.ini
[2005/02/27 08:53:28 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2005/02/27 08:49:38 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS61.DLL
[2005/01/14 12:26:53 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2004/11/30 01:06:35 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2004/11/30 00:56:19 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2004/11/30 00:56:19 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2004/11/30 00:56:19 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2004/11/30 00:56:19 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2004/11/30 00:56:19 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2004/11/30 00:56:19 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2004/11/29 07:31:06 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\bertram\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2004/11/27 03:28:47 | 000,012,288 | ---- | C] () -- C:\WINDOWS\impborl.dll
[2004/09/10 22:51:40 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/09/10 22:40:50 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[2004/09/10 22:39:33 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2004/09/10 16:49:49 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/09/10 16:49:43 | 000,393,086 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004/09/10 16:49:43 | 000,382,026 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/09/10 16:49:43 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/09/10 16:49:43 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004/09/10 16:49:43 | 000,064,848 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004/09/10 16:49:43 | 000,053,770 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/09/10 16:49:43 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004/09/10 16:49:43 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/09/10 16:49:42 | 000,004,711 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/09/10 16:49:42 | 000,001,052 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/09/10 16:49:40 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/09/10 16:49:38 | 000,058,368 | ---- | C] () -- C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\skype.dat
[2004/09/10 16:49:37 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/09/10 16:49:24 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/09/10 16:49:24 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/09/10 16:49:10 | 000,146,808 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/09/10 16:49:07 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/09/10 16:49:05 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/09/10 16:49:01 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/09/10 16:43:56 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/09/10 16:43:56 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/09/10 16:43:56 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/09/10 16:43:54 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
 
========== LOP Check ==========
 
[2012/04/01 06:03:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\elsterformular
[2004/11/30 00:57:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\InterVideo
[2010/10/17 05:44:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\Leadertech
[2004/11/27 09:55:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\Template
[2010/11/26 14:33:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\Tific
[2008/04/30 08:08:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\TuneUp Software
[2011/03/28 13:56:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ElsterFormular
[2009/10/28 14:48:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PCSettings
[2004/11/29 13:03:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Prism
[2013/01/25 11:15:00 | 000,000,400 | ---- | M] () -- C:\WINDOWS\Tasks\1-Klick-Wartung.job
[2013/02/01 06:46:27 | 000,000,422 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{3859A61C-74AC-4F24-B01E-13A9637A9787}.job
 
========== Purity Check ==========
 
 
< End of report >
Wenn mir dafür jemand einen Fix geben könnte, wäre ich äußerst dankbar. :heilig:

MfG
K2G

markusg 05.02.2013 12:31
otl fix

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:
:OTL
O20 - HKU\bertram_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\skype.dat) - C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\skype.dat
()
[2013/02/01 06:46:23 | 000,000,004 | ---- | M] () -- C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\skype.ini
:files
:Commands
[emptytemp]
  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread

K2G 05.02.2013 14:17
Hallo markusg,

vielen Dank für deine schnelle und effiziente Hilfe. Das Notebook fährt nun wieder fehlerfrei hoch.

Hier der Inhalt der Textdatei, die beim Reparieren erstellt worden ist:

Code:
========== OTL ==========
Registry key HKEY_USERS\bertram_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon not found.
C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\skype.dat moved successfully.
C:\Dokumente und Einstellungen\bertram\Anwendungsdaten\skype.ini moved successfully.
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: bertram
 
User: Besitzer
 
User: Default User
 
User: LocalService
 
User: NetworkService
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 39138 bytes
%systemroot%\System32 .tmp files removed: 8285063 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5585347 bytes
 
Total Files Cleaned = 13.00 mb
 
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 02052013_131403

markusg 05.02.2013 14:31
hi
download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten
c: öffnen, tdsskiller-datum-version.txt öffnen, Inhalt posten

K2G 06.02.2013 09:30
Hallo,

hier der Inhalt der Logdatei vom TDSSKiller:

Code:
09:23:06.0765 3356  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
09:23:08.0767 3356  ============================================================
09:23:08.0767 3356  Current date / time: 2013/02/06 09:23:08.0767
09:23:08.0767 3356  SystemInfo:
09:23:08.0767 3356 
09:23:08.0898 3356  OS Version: 5.1.2600 ServicePack: 3.0
09:23:08.0898 3356  Product type: Workstation
09:23:08.0898 3356  ComputerName: SCHEFFLER
09:23:09.0028 3356  UserName: bertram
09:23:09.0028 3356  Windows directory: C:\WINDOWS
09:23:09.0028 3356  System windows directory: C:\WINDOWS
09:23:09.0028 3356  Processor architecture: Intel x86
09:23:09.0028 3356  Number of processors: 1
09:23:09.0028 3356  Page size: 0x1000
09:23:09.0028 3356  Boot type: Normal boot
09:23:09.0028 3356  ============================================================
09:23:20.0765 3356  Drive \Device\Harddisk0\DR0 - Size: 0x950A60000 (37.26 Gb), SectorSize: 0x200, Cylinders: 0x1300, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
09:23:20.0915 3356  Drive \Device\Harddisk1\DR2 - Size: 0x1D8000000 (7.38 Gb), SectorSize: 0x200, Cylinders: 0x3C2, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
09:23:20.0915 3356  ============================================================
09:23:20.0915 3356  \Device\Harddisk0\DR0:
09:23:21.0025 3356  MBR partitions:
09:23:21.0025 3356  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4A81400
09:23:21.0025 3356  \Device\Harddisk1\DR2:
09:23:21.0025 3356  MBR partitions:
09:23:21.0025 3356  \Device\Harddisk1\DR2\Partition1: MBR, Type 0xB, StartLBA 0x3F, BlocksNum 0xEBD142
09:23:21.0025 3356  ============================================================
09:23:21.0346 3356  C: <-> \Device\Harddisk0\DR0\Partition1
09:23:21.0346 3356  ============================================================
09:23:21.0346 3356  Initialize success
09:23:21.0346 3356  ============================================================
09:23:47.0673 3716  ============================================================
09:23:47.0673 3716  Scan started
09:23:47.0673 3716  Mode: Manual; SigCheck; TDLFS;
09:23:47.0673 3716  ============================================================
09:23:48.0134 3716  ================ Scan system memory ========================
09:23:48.0134 3716  System memory - ok
09:23:48.0144 3716  ================ Scan services =============================
09:23:49.0897 3716  Abiosdsk - ok
09:23:49.0937 3716  [ 6ABB91494FE6C59089B9336452AB2EA3 ] abp480n5        C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
09:23:51.0339 3716  abp480n5 - ok
09:23:51.0439 3716  [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI            C:\WINDOWS\system32\DRIVERS\ACPI.sys
09:23:52.0210 3716  ACPI - ok
09:23:52.0240 3716  [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC          C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
09:23:52.0741 3716  ACPIEC - ok
09:23:52.0781 3716  [ 9A11864873DA202C996558B2106B0BBC ] adpu160m        C:\WINDOWS\system32\DRIVERS\adpu160m.sys
09:23:53.0442 3716  adpu160m - ok
09:23:53.0592 3716  [ 8BED39E3C35D6A489438B8141717A557 ] aec            C:\WINDOWS\system32\drivers\aec.sys
09:23:54.0023 3716  aec - ok
09:23:54.0123 3716  [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD            C:\WINDOWS\System32\drivers\afd.sys
09:23:54.0964 3716  AFD - ok
09:23:55.0475 3716  [ 052343CD49C8DA20C48958CFE73C7D44 ] AgereSoftModem  C:\WINDOWS\system32\DRIVERS\AGRSM.sys
09:23:56.0847 3716  AgereSoftModem - ok
09:23:56.0877 3716  [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440          C:\WINDOWS\system32\DRIVERS\agp440.sys
09:23:57.0307 3716  agp440 - ok
09:23:57.0337 3716  [ 03A7E0922ACFE1B07D5DB2EEB0773063 ] agpCPQ          C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
09:23:58.0219 3716  agpCPQ - ok
09:23:58.0269 3716  [ C23EA9B5F46C7F7910DB3EAB648FF013 ] Aha154x        C:\WINDOWS\system32\DRIVERS\aha154x.sys
09:23:58.0609 3716  Aha154x - ok
09:23:58.0659 3716  [ 19DD0FB48B0C18892F70E2E7D61A1529 ] aic78u2        C:\WINDOWS\system32\DRIVERS\aic78u2.sys
09:23:59.0220 3716  aic78u2 - ok
09:23:59.0280 3716  [ B7FE594A7468AA0132DEB03FB8E34326 ] aic78xx        C:\WINDOWS\system32\DRIVERS\aic78xx.sys
09:23:59.0991 3716  aic78xx - ok
09:24:00.0171 3716  [ BA88534A3CEB6161E7432438B9EA4F54 ] ALCXSENS        C:\WINDOWS\system32\drivers\ALCXSENS.SYS
09:24:01.0613 3716  ALCXSENS - ok
09:24:01.0904 3716  [ DBE9A9ED605710CC5672E574920AC043 ] ALCXWDM        C:\WINDOWS\system32\drivers\ALCXWDM.SYS
09:24:02.0495 3716  ALCXWDM - ok
09:24:02.0545 3716  [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter        C:\WINDOWS\system32\alrsvc.dll
09:24:03.0035 3716  Alerter - ok
09:24:03.0096 3716  [ 190CD73D4984F94D823F9444980513E5 ] ALG            C:\WINDOWS\System32\alg.exe
09:24:03.0526 3716  ALG - ok
09:24:03.0566 3716  [ 1140AB9938809700B46BB88E46D72A96 ] AliIde          C:\WINDOWS\system32\DRIVERS\aliide.sys
09:24:04.0027 3716  AliIde - ok
09:24:04.0057 3716  [ CB08AED0DE2DD889A8A820CD8082D83C ] alim1541        C:\WINDOWS\system32\DRIVERS\alim1541.sys
09:24:04.0818 3716  alim1541 - ok
09:24:04.0878 3716  [ 95B4FB835E28AA1336CEEB07FD5B9398 ] amdagp          C:\WINDOWS\system32\DRIVERS\amdagp.sys
09:24:05.0429 3716  amdagp - ok
09:24:05.0469 3716  [ 3A0DAFAC778236559C14C7203FB550EB ] AmdK7          C:\WINDOWS\system32\DRIVERS\amdk7.sys
09:24:05.0980 3716  AmdK7 - ok
09:24:06.0020 3716  [ 79F5ADD8D24BD6893F2903A3E2F3FAD6 ] amsint          C:\WINDOWS\system32\DRIVERS\amsint.sys
09:24:06.0380 3716  amsint - ok
09:24:06.0510 3716  [ 62D318E9A0C8FC9B780008E724283707 ] asc            C:\WINDOWS\system32\DRIVERS\asc.sys
09:24:07.0242 3716  asc - ok
09:24:07.0312 3716  [ 69EB0CC7714B32896CCBFD5EDCBEA447 ] asc3350p        C:\WINDOWS\system32\DRIVERS\asc3350p.sys
09:24:07.0682 3716  asc3350p - ok
09:24:07.0712 3716  [ 5D8DE112AA0254B907861E9E9C31D597 ] asc3550        C:\WINDOWS\system32\DRIVERS\asc3550.sys
09:24:08.0223 3716  asc3550 - ok
09:24:08.0383 3716  [ E1A1206A4FB19B675E947B29CCD25FBA ] aspnet_state    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
09:24:08.0523 3716  aspnet_state ( UnsignedFile.Multi.Generic ) - warning
09:24:08.0523 3716  aspnet_state - detected UnsignedFile.Multi.Generic (1)
09:24:08.0624 3716  [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac        C:\WINDOWS\system32\DRIVERS\asyncmac.sys
09:24:09.0144 3716  AsyncMac - ok
09:24:09.0194 3716  [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi          C:\WINDOWS\system32\DRIVERS\atapi.sys
09:24:09.0905 3716  atapi - ok
09:24:09.0915 3716  Atdisk - ok
09:24:09.0975 3716  [ 9916C1225104BA14794209CFA8012159 ] Atmarpc        C:\WINDOWS\system32\DRIVERS\atmarpc.sys
09:24:10.0436 3716  Atmarpc - ok
09:24:10.0506 3716  [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv        C:\WINDOWS\System32\audiosrv.dll
09:24:10.0937 3716  AudioSrv - ok
09:24:10.0957 3716  [ D9F724AA26C010A217C97606B160ED68 ] audstub        C:\WINDOWS\system32\DRIVERS\audstub.sys
09:24:11.0538 3716  audstub - ok
09:24:11.0638 3716  [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep            C:\WINDOWS\system32\drivers\Beep.sys
09:24:12.0369 3716  Beep - ok
09:24:12.0970 3716  [ 9DFFCB249663AA3C2ECB67202280054E ] BHDrvx86        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20130111.001\BHDrvx86.sys
09:24:13.0631 3716  BHDrvx86 - ok
09:24:13.0841 3716  [ D6F603772A789BB3228F310D650B8BD1 ] BITS            C:\WINDOWS\system32\qmgr.dll
09:24:15.0223 3716  BITS - ok
09:24:15.0283 3716  [ B71549F23736ADF83A571061C47777FD ] Browser        C:\WINDOWS\System32\browser.dll
09:24:15.0624 3716  Browser - ok
09:24:15.0744 3716  [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf          C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
09:24:16.0315 3716  cbidf - ok
09:24:16.0355 3716  [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k        C:\WINDOWS\system32\drivers\cbidf2k.sys
09:24:16.0855 3716  cbidf2k - ok
09:24:16.0865 3716  [ F3EC03299634490E97BBCE94CD2954C7 ] cd20xrnt        C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
09:24:17.0146 3716  cd20xrnt - ok
09:24:17.0196 3716  [ C1B486A7658353D33A10CC15211A873B ] Cdaudio        C:\WINDOWS\system32\drivers\Cdaudio.sys
09:24:17.0737 3716  Cdaudio - ok
09:24:17.0777 3716  [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs            C:\WINDOWS\system32\drivers\Cdfs.sys
09:24:18.0358 3716  Cdfs - ok
09:24:18.0488 3716  [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom          C:\WINDOWS\system32\DRIVERS\cdrom.sys
09:24:18.0928 3716  Cdrom - ok
09:24:18.0948 3716  Changer - ok
09:24:18.0998 3716  [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc          C:\WINDOWS\system32\cisvc.exe
09:24:19.0539 3716  CiSvc - ok
09:24:19.0609 3716  [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv        C:\WINDOWS\system32\clipsrv.exe
09:24:20.0090 3716  ClipSrv - ok
09:24:20.0150 3716  [ 0F6C187D38D98F8DF904589A5F94D411 ] CmBatt          C:\WINDOWS\system32\DRIVERS\CmBatt.sys
09:24:20.0631 3716  CmBatt - ok
09:24:20.0781 3716  [ C687F81290303D90099B027A6474F99F ] CmdIde          C:\WINDOWS\system32\DRIVERS\cmdide.sys
09:24:21.0262 3716  CmdIde - ok
09:24:21.0432 3716  [ 6E4C9F21F0FAE8940661144F41B13203 ] Compbatt        C:\WINDOWS\system32\DRIVERS\compbatt.sys
09:24:22.0123 3716  Compbatt - ok
09:24:22.0133 3716  COMSysApp - ok
09:24:22.0243 3716  [ 3EE529119EED34CD212A215E8C40D4B6 ] Cpqarray        C:\WINDOWS\system32\DRIVERS\cpqarray.sys
09:24:22.0694 3716  Cpqarray - ok
09:24:22.0754 3716  [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc        C:\WINDOWS\System32\cryptsvc.dll
09:24:23.0184 3716  CryptSvc - ok
09:24:23.0275 3716  [ E550E7418984B65A78299D248F0A7F36 ] dac2w2k        C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
09:24:23.0815 3716  dac2w2k - ok
09:24:23.0865 3716  [ 683789CAA3864EB46125AE86FF677D34 ] dac960nt        C:\WINDOWS\system32\DRIVERS\dac960nt.sys
09:24:24.0456 3716  dac960nt - ok
09:24:24.0627 3716  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch      C:\WINDOWS\system32\rpcss.dll
09:24:25.0077 3716  DcomLaunch - ok
09:24:25.0127 3716  [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp            C:\WINDOWS\System32\dhcpcsvc.dll
09:24:25.0788 3716  Dhcp - ok
09:24:25.0858 3716  [ 044452051F3E02E7963599FC8F4F3E25 ] Disk            C:\WINDOWS\system32\DRIVERS\disk.sys
09:24:26.0549 3716  Disk - ok
09:24:26.0579 3716  dmadmin - ok
09:24:26.0659 3716  [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot          C:\WINDOWS\system32\drivers\dmboot.sys
09:24:27.0350 3716  dmboot - ok
09:24:27.0431 3716  [ 53720AB12B48719D00E327DA470A619A ] dmio            C:\WINDOWS\system32\drivers\dmio.sys
09:24:28.0092 3716  dmio - ok
09:24:28.0162 3716  [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload          C:\WINDOWS\system32\drivers\dmload.sys
09:24:28.0552 3716  dmload - ok
09:24:28.0652 3716  [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver        C:\WINDOWS\System32\dmserver.dll
09:24:29.0133 3716  dmserver - ok
09:24:29.0173 3716  [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic          C:\WINDOWS\system32\drivers\DMusic.sys
09:24:29.0694 3716  DMusic - ok
09:24:29.0834 3716  [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache        C:\WINDOWS\System32\dnsrslvr.dll
09:24:30.0495 3716  Dnscache - ok
09:24:30.0655 3716  [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc        C:\WINDOWS\System32\dot3svc.dll
09:24:31.0286 3716  Dot3svc - ok
09:24:31.0326 3716  [ 40F3B93B4E5B0126F2F5C0A7A5E22660 ] dpti2o          C:\WINDOWS\system32\DRIVERS\dpti2o.sys
09:24:31.0757 3716  dpti2o - ok
09:24:31.0857 3716  [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud        C:\WINDOWS\system32\drivers\drmkaud.sys
09:24:32.0358 3716  drmkaud - ok
09:24:32.0418 3716  [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost        C:\WINDOWS\System32\eapsvc.dll
09:24:32.0838 3716  EapHost - ok
09:24:33.0099 3716  [ 85B8B4032A895A746D46A288A9B30DED ] eeCtrl          C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
09:24:34.0040 3716  eeCtrl - ok
09:24:34.0120 3716  [ B5A8A04A6E5B4E86B95B1553AA918F5F ] EraserUtilRebootDrv C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
09:24:34.0210 3716  EraserUtilRebootDrv - ok
09:24:34.0270 3716  [ 877C18558D70587AA7823A1A308AC96B ] ERSvc          C:\WINDOWS\System32\ersvc.dll
09:24:34.0701 3716  ERSvc - ok
09:24:34.0791 3716  [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog        C:\WINDOWS\system32\services.exe
09:24:34.0901 3716  Eventlog - ok
09:24:35.0182 3716  [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem    C:\WINDOWS\system32\es.dll
09:24:36.0604 3716  EventSystem - ok
09:24:36.0964 3716  [ 38D332A6D56AF32635675F132548343E ] Fastfat        C:\WINDOWS\system32\drivers\Fastfat.sys
09:24:38.0066 3716  Fastfat - ok
09:24:38.0927 3716  [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
09:24:39.0588 3716  FastUserSwitchingCompatibility - ok
09:24:39.0888 3716  [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc            C:\WINDOWS\system32\drivers\Fdc.sys
09:24:40.0589 3716  Fdc - ok
09:24:40.0740 3716  [ E9648254056BCE81A85380C0C3647DC4 ] FETNDIS        C:\WINDOWS\system32\DRIVERS\fetnd5.sys
09:24:41.0030 3716  FETNDIS - ok
09:24:41.0150 3716  [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips            C:\WINDOWS\system32\drivers\Fips.sys
09:24:41.0571 3716  Fips - ok
09:24:41.0651 3716  [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk        C:\WINDOWS\system32\drivers\Flpydisk.sys
09:24:42.0192 3716  Flpydisk - ok
09:24:42.0322 3716  [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr          C:\WINDOWS\system32\drivers\fltmgr.sys
09:24:42.0863 3716  FltMgr - ok
09:24:42.0943 3716  [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec          C:\WINDOWS\system32\drivers\Fs_Rec.sys
09:24:43.0434 3716  Fs_Rec - ok
09:24:43.0484 3716  [ 8F1955CE42E1484714B542F341647778 ] Ftdisk          C:\WINDOWS\system32\DRIVERS\ftdisk.sys
09:24:43.0954 3716  Ftdisk - ok
09:24:44.0044 3716  [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc            C:\WINDOWS\system32\DRIVERS\msgpc.sys
09:24:44.0595 3716  Gpc - ok
09:24:44.0996 3716  [ F02A533F517EB38333CB12A9E8963773 ] gupdate        C:\Programme\Google\Update\GoogleUpdate.exe
09:24:45.0296 3716  gupdate - ok
09:24:45.0497 3716  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Programme\Google\Update\GoogleUpdate.exe
09:24:45.0587 3716  gupdatem - ok
09:24:45.0817 3716  [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc        C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
09:24:46.0278 3716  helpsvc - ok
09:24:46.0288 3716  HidServ - ok
09:24:46.0408 3716  [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb          C:\WINDOWS\system32\DRIVERS\hidusb.sys
09:24:46.0708 3716  HidUsb - ok
09:24:46.0808 3716  [ ED29F14101523A6E0E808107405D452C ] hkmsvc          C:\WINDOWS\System32\kmsvc.dll
09:24:47.0199 3716  hkmsvc - ok
09:24:47.0389 3716  [ B028377DEA0546A5FCFBA928A8AEFAE0 ] hpn            C:\WINDOWS\system32\DRIVERS\hpn.sys
09:24:47.0910 3716  hpn - ok
09:24:48.0080 3716  [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP            C:\WINDOWS\system32\Drivers\HTTP.sys
09:24:48.0581 3716  HTTP - ok
09:24:48.0631 3716  [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter      C:\WINDOWS\System32\w3ssl.dll
09:24:49.0032 3716  HTTPFilter - ok
09:24:49.0132 3716  [ 9368670BD426EBEA5E8B18A62416EC28 ] i2omgmt        C:\WINDOWS\system32\drivers\i2omgmt.sys
09:24:49.0592 3716  i2omgmt - ok
09:24:49.0663 3716  [ F10863BF1CCC290BABD1A09188AE49E0 ] i2omp          C:\WINDOWS\system32\DRIVERS\i2omp.sys
09:24:50.0083 3716  i2omp - ok
09:24:50.0143 3716  [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt        C:\WINDOWS\system32\DRIVERS\i8042prt.sys
09:24:50.0514 3716  i8042prt - ok
09:24:50.0834 3716  [ 16F8DE7A7F9023AAC04DEC6A8A264441 ] ialm            C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
09:24:51.0565 3716  ialm - ok
09:24:51.0746 3716  [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT        C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
09:24:52.0016 3716  IDriverT ( UnsignedFile.Multi.Generic ) - warning
09:24:52.0016 3716  IDriverT - detected UnsignedFile.Multi.Generic (1)
09:24:52.0427 3716  [ C19BF2A07BE972A110220DF6B1E89D14 ] IDSxpx86        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20130122.001\IDSxpx86.sys
09:24:52.0707 3716  IDSxpx86 - ok
09:24:52.0917 3716  [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi          C:\WINDOWS\system32\DRIVERS\imapi.sys
09:24:53.0298 3716  Imapi - ok
09:24:53.0488 3716  [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService    C:\WINDOWS\system32\imapi.exe
09:24:53.0939 3716  ImapiService - ok
09:24:54.0029 3716  [ 4A40E045FAEE58631FD8D91AFC620719 ] ini910u        C:\WINDOWS\system32\DRIVERS\ini910u.sys
09:24:54.0269 3716  ini910u - ok
09:24:54.0419 3716  [ 69C4E3C9E67A1F103B94E14FDD5F3213 ] IntelIde        C:\WINDOWS\system32\DRIVERS\intelide.sys
09:24:54.0940 3716  IntelIde - ok
09:24:55.0010 3716  [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm        C:\WINDOWS\system32\DRIVERS\intelppm.sys
09:24:55.0341 3716  intelppm - ok
09:24:55.0461 3716  [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw          C:\WINDOWS\system32\drivers\ip6fw.sys
09:24:55.0811 3716  Ip6Fw - ok
09:24:55.0871 3716  [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver  C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
09:24:56.0232 3716  IpFilterDriver - ok
09:24:56.0322 3716  [ B87AB476DCF76E72010632B5550955F5 ] IpInIp          C:\WINDOWS\system32\DRIVERS\ipinip.sys
09:24:56.0683 3716  IpInIp - ok
09:24:56.0793 3716  [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat          C:\WINDOWS\system32\DRIVERS\ipnat.sys
09:24:57.0394 3716  IpNat - ok
09:24:57.0464 3716  [ 23C74D75E36E7158768DD63D92789A91 ] IPSec          C:\WINDOWS\system32\DRIVERS\ipsec.sys
09:24:57.0894 3716  IPSec - ok
09:24:57.0944 3716  [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM          C:\WINDOWS\system32\DRIVERS\irenum.sys
09:24:58.0385 3716  IRENUM - ok
09:24:58.0485 3716  [ 6DFB88F64135C525433E87648BDA30DE ] isapnp          C:\WINDOWS\system32\DRIVERS\isapnp.sys
09:24:58.0846 3716  isapnp - ok
09:24:59.0246 3716  [ 9DBA73C2F1E76EC4CB837E67C5743596 ] JavaQuickStarterService C:\Programme\Java\jre6\bin\jqs.exe
09:24:59.0457 3716  JavaQuickStarterService - ok
09:24:59.0487 3716  [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass        C:\WINDOWS\system32\DRIVERS\kbdclass.sys
09:24:59.0837 3716  Kbdclass - ok
09:24:59.0897 3716  [ 692BCF44383D056AED41B045A323D378 ] kmixer          C:\WINDOWS\system32\drivers\kmixer.sys
09:25:00.0268 3716  kmixer - ok
09:25:00.0318 3716  [ B467646C54CC746128904E1654C750C1 ] KSecDD          C:\WINDOWS\system32\drivers\KSecDD.sys
09:25:00.0548 3716  KSecDD - ok
09:25:00.0628 3716  [ 2BBDCB79900990F0716DFCB714E72DE7 ] lanmanserver    C:\WINDOWS\System32\srvsvc.dll
09:25:00.0829 3716  lanmanserver - ok
09:25:01.0009 3716  [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
09:25:01.0389 3716  lanmanworkstation - ok
09:25:01.0399 3716  lbrtfdc - ok
09:25:01.0520 3716  [ 636714B7D43C8D0C80449123FD266920 ] LmHosts        C:\WINDOWS\System32\lmhsvc.dll
09:25:01.0930 3716  LmHosts - ok
09:25:02.0451 3716  [ 11F714F85530A2BD134074DC30E99FCA ] MDM            C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
09:25:02.0811 3716  MDM - ok
09:25:02.0902 3716  [ B7550A7107281D170CE85524B1488C98 ] Messenger      C:\WINDOWS\System32\msgsvc.dll
09:25:03.0282 3716  Messenger - ok
09:25:03.0402 3716  [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd          C:\WINDOWS\system32\drivers\mnmdd.sys
09:25:03.0773 3716  mnmdd - ok
09:25:03.0853 3716  [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc        C:\WINDOWS\system32\mnmsrvc.exe
09:25:04.0264 3716  mnmsrvc - ok
09:25:04.0324 3716  [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem          C:\WINDOWS\system32\drivers\Modem.sys
09:25:04.0674 3716  Modem - ok
09:25:04.0724 3716  [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass        C:\WINDOWS\system32\DRIVERS\mouclass.sys
09:25:05.0125 3716  Mouclass - ok
09:25:05.0225 3716  [ 66A6F73C74E1791464160A7065CE711A ] mouhid          C:\WINDOWS\system32\DRIVERS\mouhid.sys
09:25:05.0676 3716  mouhid - ok
09:25:05.0726 3716  [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr        C:\WINDOWS\system32\drivers\MountMgr.sys
09:25:06.0116 3716  MountMgr - ok
09:25:06.0186 3716  [ 3F4BB95E5A44F3BE34824E8E7CAF0737 ] mraid35x        C:\WINDOWS\system32\DRIVERS\mraid35x.sys
09:25:06.0417 3716  mraid35x - ok
09:25:06.0487 3716  [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV          C:\WINDOWS\system32\DRIVERS\mrxdav.sys
09:25:07.0058 3716  MRxDAV - ok
09:25:07.0238 3716  [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb          C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
09:25:08.0810 3716  MRxSmb - ok
09:25:08.0850 3716  [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC          C:\WINDOWS\system32\msdtc.exe
09:25:09.0181 3716  MSDTC - ok
09:25:09.0231 3716  [ C941EA2454BA8350021D774DAF0F1027 ] Msfs            C:\WINDOWS\system32\drivers\Msfs.sys
09:25:09.0711 3716  Msfs - ok
09:25:09.0721 3716  MSIServer - ok
09:25:09.0852 3716  [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV        C:\WINDOWS\system32\drivers\MSKSSRV.sys
09:25:10.0142 3716  MSKSSRV - ok
09:25:10.0232 3716  [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK        C:\WINDOWS\system32\drivers\MSPCLOCK.sys
09:25:10.0553 3716  MSPCLOCK - ok
09:25:10.0573 3716  [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM          C:\WINDOWS\system32\drivers\MSPQM.sys
09:25:11.0003 3716  MSPQM - ok
09:25:11.0113 3716  [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios        C:\WINDOWS\system32\DRIVERS\mssmbios.sys
09:25:11.0644 3716  mssmbios - ok
09:25:11.0864 3716  [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup            C:\WINDOWS\system32\drivers\Mup.sys
09:25:12.0325 3716  Mup - ok
09:25:12.0515 3716  [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent        C:\WINDOWS\System32\qagentrt.dll
09:25:13.0016 3716  napagent - ok
09:25:13.0867 3716  [ E78A365CC3E0FBFC018A33DCE01909F8 ] NAV            C:\Programme\Norton AntiVirus\Engine\18.7.1.3\ccSvcHst.exe
09:25:14.0058 3716  NAV - ok
09:25:14.0729 3716  [ 7D7A3BC6640C1A0D1442816B30856928 ] NAVENG          C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20130128.004\NAVENG.SYS
09:25:15.0089 3716  NAVENG - ok
09:25:16.0351 3716  [ 28494C43D62AA7584BDCA2FADFBC4D11 ] NAVEX15        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20130128.004\NAVEX15.SYS
09:25:17.0022 3716  NAVEX15 - ok
09:25:17.0202 3716  [ 1DF7F42665C94B825322FAE71721130D ] NDIS            C:\WINDOWS\system32\drivers\NDIS.sys
09:25:17.0923 3716  NDIS - ok
09:25:18.0053 3716  [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi        C:\WINDOWS\system32\DRIVERS\ndistapi.sys
09:25:18.0634 3716  NdisTapi - ok
09:25:18.0754 3716  [ F927A4434C5028758A842943EF1A3849 ] Ndisuio        C:\WINDOWS\system32\DRIVERS\ndisuio.sys
09:25:19.0325 3716  Ndisuio - ok
09:25:19.0405 3716  [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan        C:\WINDOWS\system32\DRIVERS\ndiswan.sys
09:25:19.0936 3716  NdisWan - ok
09:25:20.0026 3716  [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy        C:\WINDOWS\system32\drivers\NDProxy.sys
09:25:20.0257 3716  NDProxy - ok
09:25:20.0307 3716  [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS        C:\WINDOWS\system32\DRIVERS\netbios.sys
09:25:20.0817 3716  NetBIOS - ok
09:25:20.0897 3716  [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT          C:\WINDOWS\system32\DRIVERS\netbt.sys
09:25:21.0388 3716  NetBT - ok
09:25:21.0488 3716  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE          C:\WINDOWS\system32\netdde.exe
09:25:21.0749 3716  NetDDE - ok
09:25:21.0799 3716  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm      C:\WINDOWS\system32\netdde.exe
09:25:22.0099 3716  NetDDEdsdm - ok
09:25:22.0159 3716  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon        C:\WINDOWS\system32\lsass.exe
09:25:22.0550 3716  Netlogon - ok
09:25:22.0770 3716  [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman          C:\WINDOWS\System32\netman.dll
09:25:23.0051 3716  Netman - ok
09:25:23.0211 3716  [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla            C:\WINDOWS\System32\mswsock.dll
09:25:23.0691 3716  Nla - ok
09:25:23.0752 3716  [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs            C:\WINDOWS\system32\drivers\Npfs.sys
09:25:24.0012 3716  Npfs - ok
09:25:24.0463 3716  [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs            C:\WINDOWS\system32\drivers\Ntfs.sys
09:25:25.0344 3716  Ntfs - ok
09:25:25.0384 3716  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp        C:\WINDOWS\system32\lsass.exe
09:25:25.0714 3716  NtLmSsp - ok
09:25:26.0005 3716  [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc        C:\WINDOWS\system32\ntmssvc.dll
09:25:26.0686 3716  NtmsSvc - ok
09:25:26.0776 3716  [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null            C:\WINDOWS\system32\drivers\Null.sys
09:25:27.0146 3716  Null - ok
09:25:27.0227 3716  [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt        C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
09:25:27.0747 3716  NwlnkFlt - ok
09:25:27.0757 3716  [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd        C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
09:25:28.0188 3716  NwlnkFwd - ok
09:25:28.0308 3716  [ F84785660305B9B903FB3BCA8BA29837 ] Parport        C:\WINDOWS\system32\drivers\Parport.sys
09:25:28.0689 3716  Parport - ok
09:25:28.0759 3716  [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr        C:\WINDOWS\system32\drivers\PartMgr.sys
09:25:28.0969 3716  PartMgr - ok
09:25:29.0139 3716  [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm          C:\WINDOWS\system32\drivers\ParVdm.sys
09:25:29.0600 3716  ParVdm - ok
09:25:29.0680 3716  [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI            C:\WINDOWS\system32\DRIVERS\pci.sys
09:25:29.0950 3716  PCI - ok
09:25:29.0970 3716  PCIDump - ok
09:25:30.0021 3716  [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde          C:\WINDOWS\system32\DRIVERS\pciide.sys
09:25:30.0401 3716  PCIIde - ok
09:25:30.0471 3716  [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia          C:\WINDOWS\system32\DRIVERS\pcmcia.sys
09:25:30.0952 3716  Pcmcia - ok
09:25:30.0962 3716  PDCOMP - ok
09:25:31.0002 3716  PDFRAME - ok
09:25:31.0012 3716  PDRELI - ok
09:25:31.0032 3716  PDRFRAME - ok
09:25:31.0152 3716  [ 6C14B9C19BA84F73D3A86DBA11133101 ] perc2          C:\WINDOWS\system32\DRIVERS\perc2.sys
09:25:31.0463 3716  perc2 - ok
09:25:31.0483 3716  [ F50F7C27F131AFE7BEBA13E14A3B9416 ] perc2hib        C:\WINDOWS\system32\DRIVERS\perc2hib.sys
09:25:31.0833 3716  perc2hib - ok
09:25:31.0903 3716  [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay        C:\WINDOWS\system32\services.exe
09:25:32.0074 3716  PlugPlay - ok
09:25:32.0144 3716  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent    C:\WINDOWS\system32\lsass.exe
09:25:32.0374 3716  PolicyAgent - ok
09:25:32.0514 3716  [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport    C:\WINDOWS\system32\DRIVERS\raspptp.sys
09:25:33.0025 3716  PptpMiniport - ok
09:25:33.0205 3716  [ F684013987E8F13FD1E952DBC32BEBFA ] PRISM_A00      C:\WINDOWS\system32\DRIVERS\PRISMA00.sys
09:25:34.0016 3716  PRISM_A00 - ok
09:25:34.0046 3716  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
09:25:34.0437 3716  ProtectedStorage - ok
09:25:34.0527 3716  [ 09298EC810B07E5D582CB3A3F9255424 ] PSched          C:\WINDOWS\system32\DRIVERS\psched.sys
09:25:34.0888 3716  PSched - ok
09:25:34.0938 3716  [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink        C:\WINDOWS\system32\DRIVERS\ptilink.sys
09:25:35.0338 3716  Ptilink - ok
09:25:35.0378 3716  [ 0A63FB54039EB5662433CABA3B26DBA7 ] ql1080          C:\WINDOWS\system32\DRIVERS\ql1080.sys
09:25:35.0779 3716  ql1080 - ok
09:25:35.0829 3716  [ 6503449E1D43A0FF0201AD5CB1B8C706 ] Ql10wnt        C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
09:25:36.0099 3716  Ql10wnt - ok
09:25:36.0139 3716  [ 156ED0EF20C15114CA097A34A30D8A01 ] ql12160        C:\WINDOWS\system32\DRIVERS\ql12160.sys
09:25:36.0540 3716  ql12160 - ok
09:25:36.0570 3716  [ 70F016BEBDE6D29E864C1230A07CC5E6 ] ql1240          C:\WINDOWS\system32\DRIVERS\ql1240.sys
09:25:36.0890 3716  ql1240 - ok
09:25:36.0900 3716  [ 907F0AEEA6BC451011611E732BD31FCF ] ql1280          C:\WINDOWS\system32\DRIVERS\ql1280.sys
09:25:37.0341 3716  ql1280 - ok
09:25:37.0391 3716  [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd          C:\WINDOWS\system32\DRIVERS\rasacd.sys
09:25:37.0792 3716  RasAcd - ok
09:25:37.0842 3716  [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto        C:\WINDOWS\System32\rasauto.dll
09:25:38.0152 3716  RasAuto - ok
09:25:38.0272 3716  [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp        C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
09:25:38.0733 3716  Rasl2tp - ok
09:25:38.0913 3716  [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan          C:\WINDOWS\System32\rasmans.dll
09:25:39.0454 3716  RasMan - ok
09:25:39.0504 3716  [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe        C:\WINDOWS\system32\DRIVERS\raspppoe.sys
09:25:39.0865 3716  RasPppoe - ok
09:25:39.0915 3716  [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti          C:\WINDOWS\system32\DRIVERS\raspti.sys
09:25:40.0185 3716  Raspti - ok
09:25:40.0345 3716  [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss          C:\WINDOWS\system32\DRIVERS\rdbss.sys
09:25:40.0916 3716  Rdbss - ok
09:25:40.0956 3716  [ 4912D5B403614CE99C28420F75353332 ] RDPCDD          C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
09:25:41.0177 3716  RDPCDD - ok
09:25:41.0327 3716  [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr          C:\WINDOWS\system32\DRIVERS\rdpdr.sys
09:25:41.0747 3716  rdpdr - ok
09:25:41.0918 3716  [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD          C:\WINDOWS\system32\drivers\RDPWD.sys
09:25:42.0318 3716  RDPWD - ok
09:25:42.0468 3716  [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr      C:\WINDOWS\system32\sessmgr.exe
09:25:42.0739 3716  RDSessMgr - ok
09:25:42.0799 3716  [ ED761D453856F795A7FE056E42C36365 ] redbook        C:\WINDOWS\system32\DRIVERS\redbook.sys
09:25:43.0159 3716  redbook - ok
09:25:43.0240 3716  [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess    C:\WINDOWS\System32\mprdim.dll
09:25:43.0700 3716  RemoteAccess - ok
09:25:43.0800 3716  [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator      C:\WINDOWS\system32\locator.exe
09:25:44.0141 3716  RpcLocator - ok
09:25:44.0291 3716  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs          C:\WINDOWS\system32\rpcss.dll
09:25:44.0682 3716  RpcSs - ok
09:25:44.0782 3716  [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP            C:\WINDOWS\system32\rsvp.exe
09:25:45.0162 3716  RSVP - ok
09:25:45.0272 3716  [ ACCAEF9F58AE156772BE67DF148C5B3A ] RTL8023xp      C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
09:25:45.0713 3716  RTL8023xp - ok
09:25:45.0853 3716  [ D507C1400284176573224903819FFDA3 ] rtl8139        C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
09:25:46.0164 3716  rtl8139 - ok
09:25:46.0234 3716  [ 0DBCC071A268E0340A2BA6BDD98BACE4 ] S3SavageNB      C:\WINDOWS\system32\DRIVERS\s3gnbm.sys
09:25:46.0975 3716  S3SavageNB - ok
09:25:47.0015 3716  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs          C:\WINDOWS\system32\lsass.exe
09:25:47.0345 3716  SamSs - ok
09:25:47.0446 3716  [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr        C:\WINDOWS\System32\SCardSvr.exe
09:25:47.0806 3716  SCardSvr - ok
09:25:47.0916 3716  [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule        C:\WINDOWS\system32\schedsvc.dll
09:25:48.0367 3716  Schedule - ok
09:25:48.0437 3716  [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv          C:\WINDOWS\system32\DRIVERS\secdrv.sys
09:25:48.0707 3716  Secdrv - ok
09:25:48.0808 3716  [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon        C:\WINDOWS\System32\seclogon.dll
09:25:49.0308 3716  seclogon - ok
09:25:49.0368 3716  [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS            C:\WINDOWS\system32\sens.dll
09:25:49.0699 3716  SENS - ok
09:25:49.0789 3716  [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial          C:\WINDOWS\system32\drivers\Serial.sys
09:25:50.0230 3716  Serial - ok
09:25:50.0290 3716  [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy        C:\WINDOWS\system32\DRIVERS\sfloppy.sys
09:25:50.0570 3716  Sfloppy - ok
09:25:50.0720 3716  [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess    C:\WINDOWS\System32\ipnathlp.dll
09:25:51.0421 3716  SharedAccess - ok
09:25:51.0481 3716  [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
09:25:51.0602 3716  ShellHWDetection - ok
09:25:51.0612 3716  Simbad - ok
09:25:51.0762 3716  [ 6B33D0EBD30DB32E27D1D78FE946A754 ] sisagp          C:\WINDOWS\system32\DRIVERS\sisagp.sys
09:25:52.0383 3716  sisagp - ok
09:25:52.0623 3716  [ 83C0F71F86D3BDAF915685F3D568B20E ] Sparrow        C:\WINDOWS\system32\DRIVERS\sparrow.sys
09:25:53.0054 3716  Sparrow - ok
09:25:53.0184 3716  [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter        C:\WINDOWS\system32\drivers\splitter.sys
09:25:53.0865 3716  splitter - ok
09:25:53.0915 3716  [ 60784F891563FB1B767F70117FC2428F ] Spooler        C:\WINDOWS\system32\spoolsv.exe
09:25:54.0125 3716  Spooler - ok
09:25:54.0225 3716  [ 50FA898F8C032796D3B1B9951BB5A90F ] sr              C:\WINDOWS\system32\DRIVERS\sr.sys
09:25:54.0616 3716  sr - ok
09:25:54.0796 3716  [ FE77A85495065F3AD59C5C65B6C54182 ] srservice      C:\WINDOWS\system32\srsvc.dll
09:25:55.0367 3716  srservice - ok
09:25:56.0088 3716  [ 83726CF02ECED69138948083E06B6EAC ] SRTSP          C:\WINDOWS\System32\Drivers\NAV\1207010.003\SRTSP.SYS
09:25:56.0959 3716  SRTSP - ok
09:25:57.0170 3716  [ 4E7EAB2E5615D39CF1F1DF9C71E5E225 ] SRTSPX          C:\WINDOWS\system32\drivers\NAV\1207010.003\SRTSPX.SYS
09:25:57.0530 3716  SRTSPX - ok
09:25:57.0790 3716  [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv            C:\WINDOWS\system32\DRIVERS\srv.sys
09:25:58.0341 3716  Srv - ok
09:25:58.0421 3716  [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV        C:\WINDOWS\System32\ssdpsrv.dll
09:25:58.0632 3716  SSDPSRV - ok
09:25:58.0712 3716  [ 71D609C5DFF067906D930BDE031C4CFE ] ssmdrv          C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
09:25:58.0892 3716  ssmdrv ( UnsignedFile.Multi.Generic ) - warning
09:25:58.0892 3716  ssmdrv - detected UnsignedFile.Multi.Generic (1)
09:25:59.0132 3716  [ BC2C5985611C5356B24AEB370953DED9 ] stisvc          C:\WINDOWS\system32\wiaservc.dll
09:25:59.0773 3716  stisvc - ok
09:25:59.0873 3716  [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum          C:\WINDOWS\system32\DRIVERS\swenum.sys
09:26:00.0294 3716  swenum - ok
09:26:00.0394 3716  [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi          C:\WINDOWS\system32\drivers\swmidi.sys
09:26:02.0037 3716  swmidi - ok
09:26:02.0047 3716  SwPrv - ok
09:26:02.0127 3716  [ 1FF3217614018630D0A6758630FC698C ] symc810        C:\WINDOWS\system32\DRIVERS\symc810.sys
09:26:02.0417 3716  symc810 - ok
09:26:02.0527 3716  [ 070E001D95CF725186EF8B20335F933C ] symc8xx        C:\WINDOWS\system32\DRIVERS\symc8xx.sys
09:26:02.0868 3716  symc8xx - ok
09:26:02.0988 3716  [ 9BBEB8C6258E72D62E7560E6667AAD39 ] SymDS          C:\WINDOWS\system32\drivers\NAV\1207010.003\SYMDS.SYS
09:26:03.0479 3716  SymDS - ok
09:26:03.0629 3716  [ D5C02629C02A820A7E71BCA3D44294A3 ] SymEFA          C:\WINDOWS\system32\drivers\NAV\1207010.003\SYMEFA.SYS
09:26:04.0390 3716  SymEFA - ok
09:26:04.0460 3716  [ AB33C3B196197CA467CBDDA717860DBA ] SymEvent        C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
09:26:04.0801 3716  SymEvent - ok
09:26:04.0881 3716  [ A73399804D5D4A8B20BA60FCF70C9F1F ] SymIRON        C:\WINDOWS\system32\drivers\NAV\1207010.003\Ironx86.SYS
09:26:05.0001 3716  SymIRON - ok
09:26:05.0111 3716  [ 336CACE58F0359D5CBB1AE6B8A2FB205 ] SYMTDI          C:\WINDOWS\System32\Drivers\NAV\1207010.003\SYMTDI.SYS
09:26:05.0241 3716  SYMTDI - ok
09:26:05.0281 3716  [ 80AC1C4ABBE2DF3B738BF15517A51F2C ] sym_hi          C:\WINDOWS\system32\DRIVERS\sym_hi.sys
09:26:05.0522 3716  sym_hi - ok
09:26:05.0562 3716  [ BF4FAB949A382A8E105F46EBB4937058 ] sym_u3          C:\WINDOWS\system32\DRIVERS\sym_u3.sys
09:26:05.0862 3716  sym_u3 - ok
09:26:05.0942 3716  [ E210581E41D936F1C10FB7B3D67F5A1A ] SynTP          C:\WINDOWS\system32\DRIVERS\SynTP.sys
09:26:06.0173 3716  SynTP - ok
09:26:06.0233 3716  [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio        C:\WINDOWS\system32\drivers\sysaudio.sys
09:26:06.0623 3716  sysaudio - ok
09:26:06.0713 3716  [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog      C:\WINDOWS\system32\smlogsvc.exe
09:26:06.0934 3716  SysmonLog - ok
09:26:07.0014 3716  [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv        C:\WINDOWS\System32\tapisrv.dll
09:26:07.0655 3716  TapiSrv - ok
09:26:07.0885 3716  [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip          C:\WINDOWS\system32\DRIVERS\tcpip.sys
09:26:08.0266 3716  Tcpip - ok
09:26:08.0316 3716  [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE          C:\WINDOWS\system32\drivers\TDPIPE.sys
09:26:08.0626 3716  TDPIPE - ok
09:26:08.0696 3716  [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP          C:\WINDOWS\system32\drivers\TDTCP.sys
09:26:09.0037 3716  TDTCP - ok
09:26:09.0097 3716  [ 88155247177638048422893737429D9E ] TermDD          C:\WINDOWS\system32\DRIVERS\termdd.sys
09:26:09.0347 3716  TermDD - ok
09:26:09.0587 3716  [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService    C:\WINDOWS\System32\termsrv.dll
09:26:10.0148 3716  TermService - ok
09:26:10.0208 3716  [ 2DB7D303C36DDD055215052F118E8E75 ] Themes          C:\WINDOWS\System32\shsvcs.dll
09:26:10.0409 3716  Themes - ok
09:26:10.0509 3716  [ D213A9247DC347F305A2D4CC9B951487 ] TosIde          C:\WINDOWS\system32\DRIVERS\toside.sys
09:26:10.0889 3716  TosIde - ok
09:26:10.0969 3716  [ 626504572B175867F30F3215C04B3E2F ] TrkWks          C:\WINDOWS\system32\trkwks.dll
09:26:11.0430 3716  TrkWks - ok
09:26:11.0520 3716  [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs            C:\WINDOWS\system32\drivers\Udfs.sys
09:26:11.0811 3716  Udfs - ok
09:26:11.0901 3716  [ 1B698A51CD528D8DA4FFAED66DFC51B9 ] ultra          C:\WINDOWS\system32\DRIVERS\ultra.sys
09:26:12.0111 3716  ultra - ok
09:26:12.0301 3716  [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update          C:\WINDOWS\system32\DRIVERS\update.sys
09:26:12.0742 3716  Update - ok
09:26:12.0882 3716  [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost        C:\WINDOWS\System32\upnphost.dll
09:26:13.0353 3716  upnphost - ok
09:26:13.0413 3716  [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS            C:\WINDOWS\System32\ups.exe
09:26:13.0894 3716  UPS - ok
09:26:13.0934 3716  [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci        C:\WINDOWS\system32\DRIVERS\usbehci.sys
09:26:14.0174 3716  usbehci - ok
09:26:14.0224 3716  [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub          C:\WINDOWS\system32\DRIVERS\usbhub.sys
09:26:14.0785 3716  usbhub - ok
09:26:14.0845 3716  [ A717C8721046828520C9EDF31288FC00 ] usbprint        C:\WINDOWS\system32\DRIVERS\usbprint.sys
09:26:15.0196 3716  usbprint - ok
09:26:15.0226 3716  [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor        C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
09:26:15.0576 3716  usbstor - ok
09:26:15.0626 3716  [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci        C:\WINDOWS\system32\DRIVERS\usbuhci.sys
09:26:16.0037 3716  usbuhci - ok
09:26:16.0167 3716  [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave        C:\WINDOWS\System32\drivers\vga.sys
09:26:16.0658 3716  VgaSave - ok
09:26:17.0088 3716  [ 754292CE5848B3738281B4F3607EAEF4 ] viaagp          C:\WINDOWS\system32\DRIVERS\viaagp.sys
09:26:17.0399 3716  viaagp - ok
09:26:17.0449 3716  [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde          C:\WINDOWS\system32\DRIVERS\viaide.sys
09:26:17.0929 3716  ViaIde - ok
09:26:18.0000 3716  [ A5A712F4E880874A477AF790B5186E1D ] VolSnap        C:\WINDOWS\system32\drivers\VolSnap.sys
09:26:18.0370 3716  VolSnap - ok
09:26:18.0450 3716  [ 68F106273BE29E7B7EF8266977268E78 ] VSS            C:\WINDOWS\System32\vssvc.exe
09:26:18.0891 3716  VSS - ok
09:26:18.0981 3716  [ 7B353059E665F8B7AD2BBEAEF597CF45 ] W32Time        C:\WINDOWS\system32\w32time.dll
09:26:19.0442 3716  W32Time - ok
09:26:19.0512 3716  [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp          C:\WINDOWS\system32\DRIVERS\wanarp.sys
09:26:19.0872 3716  Wanarp - ok
09:26:19.0902 3716  WDICA - ok
09:26:19.0942 3716  [ 6768ACF64B18196494413695F0C3A00F ] wdmaud          C:\WINDOWS\system32\drivers\wdmaud.sys
09:26:20.0343 3716  wdmaud - ok
09:26:20.0403 3716  [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient      C:\WINDOWS\System32\webclnt.dll
09:26:20.0703 3716  WebClient - ok
09:26:21.0134 3716  [ 6F3F3973D97714CC5F906A19FE883729 ] winmgmt        C:\WINDOWS\system32\wbem\WMIsvc.dll
09:26:21.0525 3716  winmgmt - ok
09:26:21.0605 3716  [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN        C:\WINDOWS\system32\MsPMSNSv.dll
09:26:22.0015 3716  WmdmPmSN - ok
09:26:22.0095 3716  [ 93908111BA57A6E60EC2FA2DE202105C ] WmiApSrv        C:\WINDOWS\system32\wbem\wmiapsrv.exe
09:26:22.0396 3716  WmiApSrv - ok
09:26:22.0927 3716  [ BF05650BB7DF5E9EBDD25974E22403BB ] WMPNetworkSvc  C:\Programme\Windows Media Player\WMPNetwk.exe
09:26:23.0988 3716  WMPNetworkSvc - ok
09:26:24.0158 3716  [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc          C:\WINDOWS\system32\wscsvc.dll
09:26:24.0659 3716  wscsvc - ok
09:26:24.0729 3716  [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv        C:\WINDOWS\system32\wuauserv.dll
09:26:25.0080 3716  wuauserv - ok
09:26:25.0210 3716  [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf          C:\WINDOWS\system32\DRIVERS\WudfPf.sys
09:26:25.0600 3716  WudfPf - ok
09:26:25.0631 3716  [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc        C:\WINDOWS\System32\WUDFSvc.dll
09:26:25.0821 3716  WudfSvc - ok
09:26:26.0101 3716  [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC          C:\WINDOWS\System32\wzcsvc.dll
09:26:26.0712 3716  WZCSVC - ok
09:26:26.0792 3716  [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov        C:\WINDOWS\System32\xmlprov.dll
09:26:27.0063 3716  xmlprov - ok
09:26:27.0083 3716  ================ Scan global ===============================
09:26:27.0183 3716  [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll
09:26:27.0403 3716  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
09:26:27.0744 3716  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
09:26:27.0804 3716  [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe
09:26:27.0814 3716  [Global] - ok
09:26:27.0824 3716  ================ Scan MBR ==================================
09:26:27.0834 3716  [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
09:26:33.0141 3716  \Device\Harddisk0\DR0 - ok
09:26:33.0161 3716  [ 5E9AEF0915A3B50BF575ED81BFB0085F ] \Device\Harddisk1\DR2
09:26:33.0592 3716  \Device\Harddisk1\DR2 ( Rootkit.Win32.BackBoot.gen ) - warning
09:26:33.0592 3716  \Device\Harddisk1\DR2 - detected Rootkit.Win32.BackBoot.gen (1)
09:26:33.0702 3716  \Device\Harddisk1\DR2 ( TDSS File System ) - warning
09:26:33.0702 3716  \Device\Harddisk1\DR2 - detected TDSS File System (1)
09:26:33.0712 3716  ================ Scan VBR ==================================
09:26:33.0722 3716  [ D3C3E9943DA39A6B0295334B56EF2C99 ] \Device\Harddisk0\DR0\Partition1
09:26:33.0732 3716  \Device\Harddisk0\DR0\Partition1 - ok
09:26:33.0732 3716  [ 00BB0B9E22AC45461168A9927CAA13EF ] \Device\Harddisk1\DR2\Partition1
09:26:33.0742 3716  \Device\Harddisk1\DR2\Partition1 - ok
09:26:33.0752 3716  ============================================================
09:26:33.0752 3716  Scan finished
09:26:33.0752 3716  ============================================================
09:26:33.0882 3240  Detected object count: 5
09:26:33.0882 3240  Actual detected object count: 5
09:27:50.0332 3240  aspnet_state ( UnsignedFile.Multi.Generic ) - skipped by user
09:27:50.0332 3240  aspnet_state ( UnsignedFile.Multi.Generic ) - User select action: Skip
09:27:50.0352 3240  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
09:27:50.0352 3240  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
09:27:50.0352 3240  ssmdrv ( UnsignedFile.Multi.Generic ) - skipped by user
09:27:50.0352 3240  ssmdrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
09:27:50.0352 3240  \Device\Harddisk1\DR2 ( Rootkit.Win32.BackBoot.gen ) - skipped by user
09:27:50.0352 3240  \Device\Harddisk1\DR2 ( Rootkit.Win32.BackBoot.gen ) - User select action: Skip
09:27:50.0372 3240  \Device\Harddisk1\DR2 ( TDSS File System ) - skipped by user
09:27:50.0372 3240  \Device\Harddisk1\DR2 ( TDSS File System ) - User select action: Skip
09:27:55.0570 3332  Deinitialize success

markusg 06.02.2013 11:55
Hi
starte den TDSS killer, wie oben beschrieben.
Scanne noch mal, dann wähle delete für:
Device\Harddisk1\DR2 ( Rootkit.Win32.BackBoot.gen ) - skipped by user
TDSS File System
starte dann neu, scanne erneut poste das Log.

K2G 06.02.2013 12:23
Hi,

ich habe bei beiden Bedrohungen nur die Optionen "Skip", "Copy to quarantine" und "Restore".

Wie kann ich sie löschen? "Delete" steht nicht zur Auswahl.

markusg 06.02.2013 12:33
hi dann wähle Restore.

K2G 06.02.2013 12:54
Danke.

Bei "Device\Harddisk1\DR2 ( Rootkit.Win32.BackBoot.gen )" habe ich "Restore" gewählt.
Bei "TDSS File System" konnte ich "delete" wählen.

Hier das Log nach anschließendem Neustart und erneutem Scan:

Code:
12:47:25.0907 3576  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
12:47:25.0967 3576  ============================================================
12:47:25.0967 3576  Current date / time: 2013/02/06 12:47:25.0967
12:47:25.0967 3576  SystemInfo:
12:47:25.0967 3576 
12:47:25.0967 3576  OS Version: 5.1.2600 ServicePack: 3.0
12:47:25.0967 3576  Product type: Workstation
12:47:25.0967 3576  ComputerName: SCHEFFLER
12:47:25.0967 3576  UserName: bertram
12:47:25.0967 3576  Windows directory: C:\WINDOWS
12:47:25.0967 3576  System windows directory: C:\WINDOWS
12:47:25.0967 3576  Processor architecture: Intel x86
12:47:25.0967 3576  Number of processors: 1
12:47:25.0967 3576  Page size: 0x1000
12:47:25.0967 3576  Boot type: Normal boot
12:47:25.0967 3576  ============================================================
12:47:41.0370 3576  Drive \Device\Harddisk0\DR0 - Size: 0x950A60000 (37.26 Gb), SectorSize: 0x200, Cylinders: 0x1300, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
12:47:41.0440 3576  Drive \Device\Harddisk1\DR2 - Size: 0xED800000 (3.71 Gb), SectorSize: 0x200, Cylinders: 0x1E4, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
12:47:41.0440 3576  ============================================================
12:47:41.0440 3576  \Device\Harddisk0\DR0:
12:47:41.0540 3576  MBR partitions:
12:47:41.0540 3576  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4A81400
12:47:41.0540 3576  \Device\Harddisk1\DR2:
12:47:41.0540 3576  MBR partitions:
12:47:41.0540 3576  \Device\Harddisk1\DR2\Partition1: MBR, Type 0xB, StartLBA 0x3F, BlocksNum 0x76A4E4
12:47:41.0540 3576  ============================================================
12:47:42.0461 3576  C: <-> \Device\Harddisk0\DR0\Partition1
12:47:42.0461 3576  ============================================================
12:47:42.0461 3576  Initialize success
12:47:42.0461 3576  ============================================================
12:47:56.0031 3640  ============================================================
12:47:56.0031 3640  Scan started
12:47:56.0031 3640  Mode: Manual; SigCheck; TDLFS;
12:47:56.0031 3640  ============================================================
12:48:08.0328 3640  ================ Scan system memory ========================
12:48:08.0338 3640  System memory - ok
12:48:08.0338 3640  ================ Scan services =============================
12:48:11.0323 3640  Abiosdsk - ok
12:48:11.0393 3640  [ 6ABB91494FE6C59089B9336452AB2EA3 ] abp480n5        C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
12:48:30.0741 3640  abp480n5 - ok
12:48:31.0442 3640  [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI            C:\WINDOWS\system32\DRIVERS\ACPI.sys
12:48:32.0283 3640  ACPI - ok
12:48:32.0343 3640  [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC          C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
12:48:32.0884 3640  ACPIEC - ok
12:48:32.0914 3640  [ 9A11864873DA202C996558B2106B0BBC ] adpu160m        C:\WINDOWS\system32\DRIVERS\adpu160m.sys
12:48:33.0545 3640  adpu160m - ok
12:48:33.0625 3640  [ 8BED39E3C35D6A489438B8141717A557 ] aec            C:\WINDOWS\system32\drivers\aec.sys
12:48:34.0165 3640  aec - ok
12:48:34.0406 3640  [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD            C:\WINDOWS\System32\drivers\afd.sys
12:48:34.0917 3640  AFD - ok
12:48:35.0307 3640  [ 052343CD49C8DA20C48958CFE73C7D44 ] AgereSoftModem  C:\WINDOWS\system32\DRIVERS\AGRSM.sys
12:48:36.0279 3640  AgereSoftModem - ok
12:48:36.0399 3640  [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440          C:\WINDOWS\system32\DRIVERS\agp440.sys
12:48:36.0899 3640  agp440 - ok
12:48:37.0971 3640  [ 03A7E0922ACFE1B07D5DB2EEB0773063 ] agpCPQ          C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
12:48:38.0502 3640  agpCPQ - ok
12:48:44.0290 3640  [ C23EA9B5F46C7F7910DB3EAB648FF013 ] Aha154x        C:\WINDOWS\system32\DRIVERS\aha154x.sys
12:48:44.0530 3640  Aha154x - ok
12:48:44.0981 3640  [ 19DD0FB48B0C18892F70E2E7D61A1529 ] aic78u2        C:\WINDOWS\system32\DRIVERS\aic78u2.sys
12:48:45.0542 3640  aic78u2 - ok
12:48:45.0592 3640  [ B7FE594A7468AA0132DEB03FB8E34326 ] aic78xx        C:\WINDOWS\system32\DRIVERS\aic78xx.sys
12:48:46.0023 3640  aic78xx - ok
12:48:47.0044 3640  [ BA88534A3CEB6161E7432438B9EA4F54 ] ALCXSENS        C:\WINDOWS\system32\drivers\ALCXSENS.SYS
12:48:48.0226 3640  ALCXSENS - ok
12:48:49.0858 3640  [ DBE9A9ED605710CC5672E574920AC043 ] ALCXWDM        C:\WINDOWS\system32\drivers\ALCXWDM.SYS
12:48:50.0319 3640  ALCXWDM - ok
12:48:50.0389 3640  [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter        C:\WINDOWS\system32\alrsvc.dll
12:48:50.0729 3640  Alerter - ok
12:48:50.0769 3640  [ 190CD73D4984F94D823F9444980513E5 ] ALG            C:\WINDOWS\System32\alg.exe
12:48:50.0990 3640  ALG - ok
12:48:51.0020 3640  [ 1140AB9938809700B46BB88E46D72A96 ] AliIde          C:\WINDOWS\system32\DRIVERS\aliide.sys
12:48:53.0463 3640  AliIde - ok
12:48:53.0523 3640  [ CB08AED0DE2DD889A8A820CD8082D83C ] alim1541        C:\WINDOWS\system32\DRIVERS\alim1541.sys
12:48:53.0974 3640  alim1541 - ok
12:48:54.0024 3640  [ 95B4FB835E28AA1336CEEB07FD5B9398 ] amdagp          C:\WINDOWS\system32\DRIVERS\amdagp.sys
12:48:54.0345 3640  amdagp - ok
12:48:54.0395 3640  [ 3A0DAFAC778236559C14C7203FB550EB ] AmdK7          C:\WINDOWS\system32\DRIVERS\amdk7.sys
12:48:54.0925 3640  AmdK7 - ok
12:48:55.0036 3640  [ 79F5ADD8D24BD6893F2903A3E2F3FAD6 ] amsint          C:\WINDOWS\system32\DRIVERS\amsint.sys
12:48:55.0286 3640  amsint - ok
12:48:55.0436 3640  [ 62D318E9A0C8FC9B780008E724283707 ] asc            C:\WINDOWS\system32\DRIVERS\asc.sys
12:48:55.0857 3640  asc - ok
12:48:55.0897 3640  [ 69EB0CC7714B32896CCBFD5EDCBEA447 ] asc3350p        C:\WINDOWS\system32\DRIVERS\asc3350p.sys
12:48:56.0047 3640  asc3350p - ok
12:48:56.0077 3640  [ 5D8DE112AA0254B907861E9E9C31D597 ] asc3550        C:\WINDOWS\system32\DRIVERS\asc3550.sys
12:48:56.0478 3640  asc3550 - ok
12:48:56.0868 3640  [ E1A1206A4FB19B675E947B29CCD25FBA ] aspnet_state    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
12:48:57.0329 3640  aspnet_state ( UnsignedFile.Multi.Generic ) - warning
12:48:57.0329 3640  aspnet_state - detected UnsignedFile.Multi.Generic (1)
12:48:57.0389 3640  [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac        C:\WINDOWS\system32\DRIVERS\asyncmac.sys
12:48:57.0870 3640  AsyncMac - ok
12:48:57.0920 3640  [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi          C:\WINDOWS\system32\DRIVERS\atapi.sys
12:48:58.0340 3640  atapi - ok
12:48:58.0360 3640  Atdisk - ok
12:48:58.0731 3640  [ 9916C1225104BA14794209CFA8012159 ] Atmarpc        C:\WINDOWS\system32\DRIVERS\atmarpc.sys
12:48:59.0232 3640  Atmarpc - ok
12:48:59.0422 3640  [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv        C:\WINDOWS\System32\audiosrv.dll
12:48:59.0752 3640  AudioSrv - ok
12:48:59.0872 3640  [ D9F724AA26C010A217C97606B160ED68 ] audstub        C:\WINDOWS\system32\DRIVERS\audstub.sys
12:49:00.0173 3640  audstub - ok
12:49:00.0283 3640  [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep            C:\WINDOWS\system32\drivers\Beep.sys
12:49:00.0614 3640  Beep - ok
12:49:01.0645 3640  [ 9DFFCB249663AA3C2ECB67202280054E ] BHDrvx86        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20130111.001\BHDrvx86.sys
12:49:02.0797 3640  BHDrvx86 - ok
12:49:03.0428 3640  [ D6F603772A789BB3228F310D650B8BD1 ] BITS            C:\WINDOWS\system32\qmgr.dll
12:49:05.0450 3640  BITS - ok
12:49:05.0861 3640  [ B71549F23736ADF83A571061C47777FD ] Browser        C:\WINDOWS\System32\browser.dll
12:49:06.0212 3640  Browser - ok
12:49:06.0272 3640  [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf          C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
12:49:06.0542 3640  cbidf - ok
12:49:06.0572 3640  [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k        C:\WINDOWS\system32\drivers\cbidf2k.sys
12:49:06.0792 3640  cbidf2k - ok
12:49:06.0822 3640  [ F3EC03299634490E97BBCE94CD2954C7 ] cd20xrnt        C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
12:49:06.0963 3640  cd20xrnt - ok
12:49:07.0043 3640  [ C1B486A7658353D33A10CC15211A873B ] Cdaudio        C:\WINDOWS\system32\drivers\Cdaudio.sys
12:49:07.0293 3640  Cdaudio - ok
12:49:07.0363 3640  [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs            C:\WINDOWS\system32\drivers\Cdfs.sys
12:49:07.0744 3640  Cdfs - ok
12:49:07.0834 3640  [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom          C:\WINDOWS\system32\DRIVERS\cdrom.sys
12:49:08.0295 3640  Cdrom - ok
12:49:08.0325 3640  Changer - ok
12:49:08.0525 3640  [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc          C:\WINDOWS\system32\cisvc.exe
12:49:08.0935 3640  CiSvc - ok
12:49:09.0296 3640  [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv        C:\WINDOWS\system32\clipsrv.exe
12:49:09.0737 3640  ClipSrv - ok
12:49:09.0917 3640  [ 0F6C187D38D98F8DF904589A5F94D411 ] CmBatt          C:\WINDOWS\system32\DRIVERS\CmBatt.sys
12:49:10.0247 3640  CmBatt - ok
12:49:10.0368 3640  [ C687F81290303D90099B027A6474F99F ] CmdIde          C:\WINDOWS\system32\DRIVERS\cmdide.sys
12:49:10.0768 3640  CmdIde - ok
12:49:11.0189 3640  [ 6E4C9F21F0FAE8940661144F41B13203 ] Compbatt        C:\WINDOWS\system32\DRIVERS\compbatt.sys
12:49:11.0659 3640  Compbatt - ok
12:49:11.0679 3640  COMSysApp - ok
12:49:11.0990 3640  [ 3EE529119EED34CD212A215E8C40D4B6 ] Cpqarray        C:\WINDOWS\system32\DRIVERS\cpqarray.sys
12:49:12.0431 3640  Cpqarray - ok
12:49:12.0671 3640  [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc        C:\WINDOWS\System32\cryptsvc.dll
12:49:13.0101 3640  CryptSvc - ok
12:49:13.0302 3640  [ E550E7418984B65A78299D248F0A7F36 ] dac2w2k        C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
12:49:13.0742 3640  dac2w2k - ok
12:49:13.0843 3640  [ 683789CAA3864EB46125AE86FF677D34 ] dac960nt        C:\WINDOWS\system32\DRIVERS\dac960nt.sys
12:49:14.0273 3640  dac960nt - ok
12:49:14.0524 3640  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch      C:\WINDOWS\system32\rpcss.dll
12:49:15.0515 3640  DcomLaunch - ok
12:49:15.0655 3640  [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp            C:\WINDOWS\System32\dhcpcsvc.dll
12:49:15.0986 3640  Dhcp - ok
12:49:16.0056 3640  [ 044452051F3E02E7963599FC8F4F3E25 ] Disk            C:\WINDOWS\system32\DRIVERS\disk.sys
12:49:16.0416 3640  Disk - ok
12:49:16.0426 3640  dmadmin - ok
12:49:16.0877 3640  [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot          C:\WINDOWS\system32\drivers\dmboot.sys
12:49:18.0609 3640  dmboot - ok
12:49:19.0000 3640  [ 53720AB12B48719D00E327DA470A619A ] dmio            C:\WINDOWS\system32\drivers\dmio.sys
12:49:19.0551 3640  dmio - ok
12:49:19.0671 3640  [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload          C:\WINDOWS\system32\drivers\dmload.sys
12:49:20.0102 3640  dmload - ok
12:49:20.0222 3640  [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver        C:\WINDOWS\System32\dmserver.dll
12:49:20.0632 3640  dmserver - ok
12:49:20.0672 3640  [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic          C:\WINDOWS\system32\drivers\DMusic.sys
12:49:20.0993 3640  DMusic - ok
12:49:21.0083 3640  [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache        C:\WINDOWS\System32\dnsrslvr.dll
12:49:21.0714 3640  Dnscache - ok
12:49:22.0014 3640  [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc        C:\WINDOWS\System32\dot3svc.dll
12:49:22.0755 3640  Dot3svc - ok
12:49:22.0856 3640  [ 40F3B93B4E5B0126F2F5C0A7A5E22660 ] dpti2o          C:\WINDOWS\system32\DRIVERS\dpti2o.sys
12:49:23.0156 3640  dpti2o - ok
12:49:23.0276 3640  [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud        C:\WINDOWS\system32\drivers\drmkaud.sys
12:49:23.0547 3640  drmkaud - ok
12:49:23.0647 3640  [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost        C:\WINDOWS\System32\eapsvc.dll
12:49:23.0907 3640  EapHost - ok
12:49:24.0177 3640  [ 85B8B4032A895A746D46A288A9B30DED ] eeCtrl          C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
12:49:24.0508 3640  eeCtrl - ok
12:49:24.0588 3640  [ B5A8A04A6E5B4E86B95B1553AA918F5F ] EraserUtilRebootDrv C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
12:49:24.0758 3640  EraserUtilRebootDrv - ok
12:49:24.0818 3640  [ 877C18558D70587AA7823A1A308AC96B ] ERSvc          C:\WINDOWS\System32\ersvc.dll
12:49:25.0129 3640  ERSvc - ok
12:49:25.0439 3640  [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog        C:\WINDOWS\system32\services.exe
12:49:25.0619 3640  Eventlog - ok
12:49:25.0750 3640  [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem    C:\WINDOWS\system32\es.dll
12:49:26.0100 3640  EventSystem - ok
12:49:26.0371 3640  [ 38D332A6D56AF32635675F132548343E ] Fastfat        C:\WINDOWS\system32\drivers\Fastfat.sys
12:49:26.0911 3640  Fastfat - ok
12:49:27.0042 3640  [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
12:49:27.0462 3640  FastUserSwitchingCompatibility - ok
12:49:27.0582 3640  [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc            C:\WINDOWS\system32\drivers\Fdc.sys
12:49:27.0953 3640  Fdc - ok
12:49:28.0053 3640  [ E9648254056BCE81A85380C0C3647DC4 ] FETNDIS        C:\WINDOWS\system32\DRIVERS\fetnd5.sys
12:49:28.0564 3640  FETNDIS - ok
12:49:28.0764 3640  [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips            C:\WINDOWS\system32\drivers\Fips.sys
12:49:29.0145 3640  Fips - ok
12:49:29.0285 3640  [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk        C:\WINDOWS\system32\drivers\Flpydisk.sys
12:49:29.0645 3640  Flpydisk - ok
12:49:29.0906 3640  [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr          C:\WINDOWS\system32\drivers\fltmgr.sys
12:49:30.0507 3640  FltMgr - ok
12:49:30.0627 3640  [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec          C:\WINDOWS\system32\drivers\Fs_Rec.sys
12:49:30.0927 3640  Fs_Rec - ok
12:49:31.0208 3640  [ 8F1955CE42E1484714B542F341647778 ] Ftdisk          C:\WINDOWS\system32\DRIVERS\ftdisk.sys
12:49:31.0648 3640  Ftdisk - ok
12:49:31.0909 3640  [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc            C:\WINDOWS\system32\DRIVERS\msgpc.sys
12:49:32.0369 3640  Gpc - ok
12:49:32.0970 3640  [ F02A533F517EB38333CB12A9E8963773 ] gupdate        C:\Programme\Google\Update\GoogleUpdate.exe
12:49:33.0301 3640  gupdate - ok
12:49:33.0561 3640  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Programme\Google\Update\GoogleUpdate.exe
12:49:33.0581 3640  gupdatem - ok
12:49:34.0142 3640  [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc        C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
12:49:34.0512 3640  helpsvc - ok
12:49:34.0522 3640  HidServ - ok
12:49:34.0693 3640  [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb          C:\WINDOWS\system32\DRIVERS\hidusb.sys
12:49:35.0343 3640  HidUsb - ok
12:49:35.0464 3640  [ ED29F14101523A6E0E808107405D452C ] hkmsvc          C:\WINDOWS\System32\kmsvc.dll
12:49:35.0984 3640  hkmsvc - ok
12:49:36.0125 3640  [ B028377DEA0546A5FCFBA928A8AEFAE0 ] hpn            C:\WINDOWS\system32\DRIVERS\hpn.sys
12:49:36.0605 3640  hpn - ok
12:49:37.0036 3640  [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP            C:\WINDOWS\system32\Drivers\HTTP.sys
12:49:37.0587 3640  HTTP - ok
12:49:37.0767 3640  [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter      C:\WINDOWS\System32\w3ssl.dll
12:49:38.0218 3640  HTTPFilter - ok
12:49:38.0368 3640  [ 9368670BD426EBEA5E8B18A62416EC28 ] i2omgmt        C:\WINDOWS\system32\drivers\i2omgmt.sys
12:49:38.0808 3640  i2omgmt - ok
12:49:38.0919 3640  [ F10863BF1CCC290BABD1A09188AE49E0 ] i2omp          C:\WINDOWS\system32\DRIVERS\i2omp.sys
12:49:39.0349 3640  i2omp - ok
12:49:39.0560 3640  [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt        C:\WINDOWS\system32\DRIVERS\i8042prt.sys
12:49:39.0900 3640  i8042prt - ok
12:49:40.0581 3640  [ 16F8DE7A7F9023AAC04DEC6A8A264441 ] ialm            C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
12:49:41.0442 3640  ialm - ok
12:49:41.0823 3640  [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT        C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
12:49:42.0313 3640  IDriverT ( UnsignedFile.Multi.Generic ) - warning
12:49:42.0313 3640  IDriverT - detected UnsignedFile.Multi.Generic (1)
12:49:43.0035 3640  [ C19BF2A07BE972A110220DF6B1E89D14 ] IDSxpx86        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20130122.001\IDSxpx86.sys
12:49:43.0485 3640  IDSxpx86 - ok
12:49:43.0595 3640  [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi          C:\WINDOWS\system32\DRIVERS\imapi.sys
12:49:43.0866 3640  Imapi - ok
12:49:44.0116 3640  [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService    C:\WINDOWS\system32\imapi.exe
12:49:44.0597 3640  ImapiService - ok
12:49:44.0677 3640  [ 4A40E045FAEE58631FD8D91AFC620719 ] ini910u        C:\WINDOWS\system32\DRIVERS\ini910u.sys
12:49:44.0987 3640  ini910u - ok
12:49:45.0067 3640  [ 69C4E3C9E67A1F103B94E14FDD5F3213 ] IntelIde        C:\WINDOWS\system32\DRIVERS\intelide.sys
12:49:45.0388 3640  IntelIde - ok
12:49:45.0488 3640  [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm        C:\WINDOWS\system32\DRIVERS\intelppm.sys
12:49:45.0819 3640  intelppm - ok
12:49:45.0889 3640  [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw          C:\WINDOWS\system32\drivers\ip6fw.sys
12:49:46.0219 3640  Ip6Fw - ok
12:49:46.0279 3640  [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver  C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
12:49:46.0750 3640  IpFilterDriver - ok
12:49:46.0870 3640  [ B87AB476DCF76E72010632B5550955F5 ] IpInIp          C:\WINDOWS\system32\DRIVERS\ipinip.sys
12:49:47.0241 3640  IpInIp - ok
12:49:47.0491 3640  [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat          C:\WINDOWS\system32\DRIVERS\ipnat.sys
12:49:47.0811 3640  IpNat - ok
12:49:47.0892 3640  [ 23C74D75E36E7158768DD63D92789A91 ] IPSec          C:\WINDOWS\system32\DRIVERS\ipsec.sys
12:49:48.0232 3640  IPSec - ok
12:49:48.0412 3640  [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM          C:\WINDOWS\system32\DRIVERS\irenum.sys
12:49:48.0673 3640  IRENUM - ok
12:49:48.0763 3640  [ 6DFB88F64135C525433E87648BDA30DE ] isapnp          C:\WINDOWS\system32\DRIVERS\isapnp.sys
12:49:49.0033 3640  isapnp - ok
12:49:49.0384 3640  [ 9DBA73C2F1E76EC4CB837E67C5743596 ] JavaQuickStarterService C:\Programme\Java\jre6\bin\jqs.exe
12:49:49.0594 3640  JavaQuickStarterService - ok
12:49:49.0634 3640  [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass        C:\WINDOWS\system32\DRIVERS\kbdclass.sys
12:49:50.0005 3640  Kbdclass - ok
12:49:50.0095 3640  [ 692BCF44383D056AED41B045A323D378 ] kmixer          C:\WINDOWS\system32\drivers\kmixer.sys
12:49:50.0465 3640  kmixer - ok
12:49:50.0555 3640  [ B467646C54CC746128904E1654C750C1 ] KSecDD          C:\WINDOWS\system32\drivers\KSecDD.sys
12:49:51.0457 3640  KSecDD - ok
12:49:51.0567 3640  [ 2BBDCB79900990F0716DFCB714E72DE7 ] lanmanserver    C:\WINDOWS\System32\srvsvc.dll
12:49:51.0957 3640  lanmanserver - ok
12:49:52.0138 3640  [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
12:49:52.0368 3640  lanmanworkstation - ok
12:49:52.0378 3640  lbrtfdc - ok
12:49:52.0498 3640  [ 636714B7D43C8D0C80449123FD266920 ] LmHosts        C:\WINDOWS\System32\lmhsvc.dll
12:49:52.0789 3640  LmHosts - ok
12:49:53.0039 3640  [ 11F714F85530A2BD134074DC30E99FCA ] MDM            C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
12:49:53.0179 3640  MDM - ok
12:49:53.0269 3640  [ B7550A7107281D170CE85524B1488C98 ] Messenger      C:\WINDOWS\System32\msgsvc.dll
12:49:53.0610 3640  Messenger - ok
12:49:53.0710 3640  [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd          C:\WINDOWS\system32\drivers\mnmdd.sys
12:49:53.0990 3640  mnmdd - ok
12:49:54.0050 3640  [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc        C:\WINDOWS\system32\mnmsrvc.exe
12:49:54.0361 3640  mnmsrvc - ok
12:49:54.0461 3640  [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem          C:\WINDOWS\system32\drivers\Modem.sys
12:49:54.0701 3640  Modem - ok
12:49:54.0731 3640  [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass        C:\WINDOWS\system32\DRIVERS\mouclass.sys
12:49:54.0992 3640  Mouclass - ok
12:49:55.0072 3640  [ 66A6F73C74E1791464160A7065CE711A ] mouhid          C:\WINDOWS\system32\DRIVERS\mouhid.sys
12:49:55.0322 3640  mouhid - ok
12:49:55.0402 3640  [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr        C:\WINDOWS\system32\drivers\MountMgr.sys
12:49:55.0823 3640  MountMgr - ok
12:49:55.0863 3640  [ 3F4BB95E5A44F3BE34824E8E7CAF0737 ] mraid35x        C:\WINDOWS\system32\DRIVERS\mraid35x.sys
12:49:56.0173 3640  mraid35x - ok
12:49:56.0484 3640  [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV          C:\WINDOWS\system32\DRIVERS\mrxdav.sys
12:49:56.0814 3640  MRxDAV - ok
12:49:57.0095 3640  [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb          C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
12:49:57.0525 3640  MRxSmb - ok
12:49:57.0626 3640  [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC          C:\WINDOWS\system32\msdtc.exe
12:49:57.0886 3640  MSDTC - ok
12:49:57.0916 3640  [ C941EA2454BA8350021D774DAF0F1027 ] Msfs            C:\WINDOWS\system32\drivers\Msfs.sys
12:49:58.0176 3640  Msfs - ok
12:49:58.0186 3640  MSIServer - ok
12:49:58.0226 3640  [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV        C:\WINDOWS\system32\drivers\MSKSSRV.sys
12:49:58.0457 3640  MSKSSRV - ok
12:49:58.0547 3640  [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK        C:\WINDOWS\system32\drivers\MSPCLOCK.sys
12:49:58.0947 3640  MSPCLOCK - ok
12:49:58.0987 3640  [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM          C:\WINDOWS\system32\drivers\MSPQM.sys
12:49:59.0248 3640  MSPQM - ok
12:49:59.0668 3640  [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios        C:\WINDOWS\system32\DRIVERS\mssmbios.sys
12:49:59.0949 3640  mssmbios - ok
12:49:59.0999 3640  [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup            C:\WINDOWS\system32\drivers\Mup.sys
12:50:00.0289 3640  Mup - ok
12:50:01.0491 3640  [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent        C:\WINDOWS\System32\qagentrt.dll
12:50:01.0932 3640  napagent - ok
12:50:03.0474 3640  [ E78A365CC3E0FBFC018A33DCE01909F8 ] NAV            C:\Programme\Norton AntiVirus\Engine\18.7.1.3\ccSvcHst.exe
12:50:03.0494 3640  NAV - ok
12:50:03.0734 3640  [ 7D7A3BC6640C1A0D1442816B30856928 ] NAVENG          C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20130128.004\NAVENG.SYS
12:50:03.0824 3640  NAVENG - ok
12:50:04.0105 3640  [ 28494C43D62AA7584BDCA2FADFBC4D11 ] NAVEX15        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20130128.004\NAVEX15.SYS
12:50:05.0126 3640  NAVEX15 - ok
12:50:05.0577 3640  [ 1DF7F42665C94B825322FAE71721130D ] NDIS            C:\WINDOWS\system32\drivers\NDIS.sys
12:50:06.0038 3640  NDIS - ok
12:50:06.0318 3640  [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi        C:\WINDOWS\system32\DRIVERS\ndistapi.sys
12:50:06.0618 3640  NdisTapi - ok
12:50:06.0669 3640  [ F927A4434C5028758A842943EF1A3849 ] Ndisuio        C:\WINDOWS\system32\DRIVERS\ndisuio.sys
12:50:06.0979 3640  Ndisuio - ok
12:50:07.0049 3640  [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan        C:\WINDOWS\system32\DRIVERS\ndiswan.sys
12:50:07.0329 3640  NdisWan - ok
12:50:07.0390 3640  [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy        C:\WINDOWS\system32\drivers\NDProxy.sys
12:50:07.0580 3640  NDProxy - ok
12:50:07.0630 3640  [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS        C:\WINDOWS\system32\DRIVERS\netbios.sys
12:50:07.0870 3640  NetBIOS - ok
12:50:07.0910 3640  [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT          C:\WINDOWS\system32\DRIVERS\netbt.sys
12:50:08.0151 3640  NetBT - ok
12:50:08.0241 3640  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE          C:\WINDOWS\system32\netdde.exe
12:50:08.0541 3640  NetDDE - ok
12:50:08.0571 3640  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm      C:\WINDOWS\system32\netdde.exe
12:50:08.0802 3640  NetDDEdsdm - ok
12:50:08.0842 3640  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon        C:\WINDOWS\system32\lsass.exe
12:50:09.0062 3640  Netlogon - ok
12:50:09.0152 3640  [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman          C:\WINDOWS\System32\netman.dll
12:50:09.0533 3640  Netman - ok
12:50:09.0653 3640  [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla            C:\WINDOWS\System32\mswsock.dll
12:50:09.0813 3640  Nla - ok
12:50:09.0893 3640  [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs            C:\WINDOWS\system32\drivers\Npfs.sys
12:50:10.0204 3640  Npfs - ok
12:50:10.0454 3640  [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs            C:\WINDOWS\system32\drivers\Ntfs.sys
12:50:11.0005 3640  Ntfs - ok
12:50:11.0035 3640  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp        C:\WINDOWS\system32\lsass.exe
12:50:11.0315 3640  NtLmSsp - ok
12:50:12.0317 3640  [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc        C:\WINDOWS\system32\ntmssvc.dll
12:50:12.0667 3640  NtmsSvc - ok
12:50:12.0727 3640  [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null            C:\WINDOWS\system32\drivers\Null.sys
12:50:12.0958 3640  Null - ok
12:50:13.0008 3640  [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt        C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
12:50:13.0278 3640  NwlnkFlt - ok
12:50:13.0358 3640  [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd        C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
12:50:13.0709 3640  NwlnkFwd - ok
12:50:14.0229 3640  [ F84785660305B9B903FB3BCA8BA29837 ] Parport        C:\WINDOWS\system32\drivers\Parport.sys
12:50:14.0650 3640  Parport - ok
12:50:14.0810 3640  [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr        C:\WINDOWS\system32\drivers\PartMgr.sys
12:50:15.0181 3640  PartMgr - ok
12:50:15.0611 3640  [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm          C:\WINDOWS\system32\drivers\ParVdm.sys
12:50:15.0952 3640  ParVdm - ok
12:50:16.0032 3640  [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI            C:\WINDOWS\system32\DRIVERS\pci.sys
12:50:16.0292 3640  PCI - ok
12:50:16.0302 3640  PCIDump - ok
12:50:16.0392 3640  [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde          C:\WINDOWS\system32\DRIVERS\pciide.sys
12:50:16.0653 3640  PCIIde - ok
12:50:16.0703 3640  [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia          C:\WINDOWS\system32\DRIVERS\pcmcia.sys
12:50:16.0993 3640  Pcmcia - ok
12:50:17.0003 3640  PDCOMP - ok
12:50:17.0023 3640  PDFRAME - ok
12:50:17.0033 3640  PDRELI - ok
12:50:17.0053 3640  PDRFRAME - ok
12:50:17.0134 3640  [ 6C14B9C19BA84F73D3A86DBA11133101 ] perc2          C:\WINDOWS\system32\DRIVERS\perc2.sys
12:50:17.0354 3640  perc2 - ok
12:50:17.0394 3640  [ F50F7C27F131AFE7BEBA13E14A3B9416 ] perc2hib        C:\WINDOWS\system32\DRIVERS\perc2hib.sys
12:50:17.0594 3640  perc2hib - ok
12:50:17.0674 3640  [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay        C:\WINDOWS\system32\services.exe
12:50:17.0734 3640  PlugPlay - ok
12:50:17.0774 3640  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent    C:\WINDOWS\system32\lsass.exe
12:50:17.0955 3640  PolicyAgent - ok
12:50:18.0015 3640  [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport    C:\WINDOWS\system32\DRIVERS\raspptp.sys
12:50:18.0275 3640  PptpMiniport - ok
12:50:18.0425 3640  [ F684013987E8F13FD1E952DBC32BEBFA ] PRISM_A00      C:\WINDOWS\system32\DRIVERS\PRISMA00.sys
12:50:18.0666 3640  PRISM_A00 - ok
12:50:18.0706 3640  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
12:50:18.0896 3640  ProtectedStorage - ok
12:50:18.0946 3640  [ 09298EC810B07E5D582CB3A3F9255424 ] PSched          C:\WINDOWS\system32\DRIVERS\psched.sys
12:50:19.0247 3640  PSched - ok
12:50:19.0327 3640  [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink        C:\WINDOWS\system32\DRIVERS\ptilink.sys
12:50:19.0607 3640  Ptilink - ok
12:50:19.0647 3640  [ 0A63FB54039EB5662433CABA3B26DBA7 ] ql1080          C:\WINDOWS\system32\DRIVERS\ql1080.sys
12:50:19.0938 3640  ql1080 - ok
12:50:19.0988 3640  [ 6503449E1D43A0FF0201AD5CB1B8C706 ] Ql10wnt        C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
12:50:20.0198 3640  Ql10wnt - ok
12:50:20.0238 3640  [ 156ED0EF20C15114CA097A34A30D8A01 ] ql12160        C:\WINDOWS\system32\DRIVERS\ql12160.sys
12:50:20.0488 3640  ql12160 - ok
12:50:20.0528 3640  [ 70F016BEBDE6D29E864C1230A07CC5E6 ] ql1240          C:\WINDOWS\system32\DRIVERS\ql1240.sys
12:50:20.0789 3640  ql1240 - ok
12:50:20.0829 3640  [ 907F0AEEA6BC451011611E732BD31FCF ] ql1280          C:\WINDOWS\system32\DRIVERS\ql1280.sys
12:50:21.0059 3640  ql1280 - ok
12:50:21.0099 3640  [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd          C:\WINDOWS\system32\DRIVERS\rasacd.sys
12:50:21.0340 3640  RasAcd - ok
12:50:21.0400 3640  [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto        C:\WINDOWS\System32\rasauto.dll
12:50:21.0680 3640  RasAuto - ok
12:50:21.0730 3640  [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp        C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
12:50:22.0021 3640  Rasl2tp - ok
12:50:22.0101 3640  [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan          C:\WINDOWS\System32\rasmans.dll
12:50:22.0361 3640  RasMan - ok
12:50:22.0421 3640  [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe        C:\WINDOWS\system32\DRIVERS\raspppoe.sys
12:50:22.0712 3640  RasPppoe - ok
12:50:22.0792 3640  [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti          C:\WINDOWS\system32\DRIVERS\raspti.sys
12:50:23.0032 3640  Raspti - ok
12:50:23.0142 3640  [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss          C:\WINDOWS\system32\DRIVERS\rdbss.sys
12:50:23.0493 3640  Rdbss - ok
12:50:23.0523 3640  [ 4912D5B403614CE99C28420F75353332 ] RDPCDD          C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
12:50:23.0743 3640  RDPCDD - ok
12:50:23.0873 3640  [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr          C:\WINDOWS\system32\DRIVERS\rdpdr.sys
12:50:24.0204 3640  rdpdr - ok
12:50:24.0294 3640  [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD          C:\WINDOWS\system32\drivers\RDPWD.sys
12:50:24.0584 3640  RDPWD - ok
12:50:24.0654 3640  [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr      C:\WINDOWS\system32\sessmgr.exe
12:50:25.0015 3640  RDSessMgr - ok
12:50:25.0095 3640  [ ED761D453856F795A7FE056E42C36365 ] redbook        C:\WINDOWS\system32\DRIVERS\redbook.sys
12:50:25.0325 3640  redbook - ok
12:50:25.0395 3640  [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess    C:\WINDOWS\System32\mprdim.dll
12:50:25.0676 3640  RemoteAccess - ok
12:50:25.0766 3640  [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator      C:\WINDOWS\system32\locator.exe
12:50:26.0016 3640  RpcLocator - ok
12:50:26.0086 3640  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs          C:\WINDOWS\system32\rpcss.dll
12:50:26.0437 3640  RpcSs - ok
12:50:26.0677 3640  [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP            C:\WINDOWS\system32\rsvp.exe
12:50:27.0318 3640  RSVP - ok
12:50:28.0049 3640  [ ACCAEF9F58AE156772BE67DF148C5B3A ] RTL8023xp      C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
12:50:28.0410 3640  RTL8023xp - ok
12:50:28.0910 3640  [ D507C1400284176573224903819FFDA3 ] rtl8139        C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
12:50:29.0281 3640  rtl8139 - ok
12:50:29.0511 3640  [ 0DBCC071A268E0340A2BA6BDD98BACE4 ] S3SavageNB      C:\WINDOWS\system32\DRIVERS\s3gnbm.sys
12:50:29.0962 3640  S3SavageNB - ok
12:50:30.0192 3640  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs          C:\WINDOWS\system32\lsass.exe
12:50:30.0423 3640  SamSs - ok
12:50:30.0523 3640  [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr        C:\WINDOWS\System32\SCardSvr.exe
12:50:30.0873 3640  SCardSvr - ok
12:50:31.0114 3640  [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule        C:\WINDOWS\system32\schedsvc.dll
12:50:31.0464 3640  Schedule - ok
12:50:31.0614 3640  [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv          C:\WINDOWS\system32\DRIVERS\secdrv.sys
12:50:31.0975 3640  Secdrv - ok
12:50:32.0075 3640  [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon        C:\WINDOWS\System32\seclogon.dll
12:50:32.0466 3640  seclogon - ok
12:50:32.0586 3640  [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS            C:\WINDOWS\system32\sens.dll
12:50:32.0866 3640  SENS - ok
12:50:32.0916 3640  [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial          C:\WINDOWS\system32\drivers\Serial.sys
12:50:33.0307 3640  Serial - ok
12:50:33.0407 3640  [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy        C:\WINDOWS\system32\DRIVERS\sfloppy.sys
12:50:33.0677 3640  Sfloppy - ok
12:50:33.0908 3640  [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess    C:\WINDOWS\System32\ipnathlp.dll
12:50:34.0458 3640  SharedAccess - ok
12:50:34.0609 3640  [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
12:50:34.0899 3640  ShellHWDetection - ok
12:50:34.0909 3640  Simbad - ok
12:50:35.0410 3640  [ 6B33D0EBD30DB32E27D1D78FE946A754 ] sisagp          C:\WINDOWS\system32\DRIVERS\sisagp.sys
12:50:36.0241 3640  sisagp - ok
12:50:36.0401 3640  [ 83C0F71F86D3BDAF915685F3D568B20E ] Sparrow        C:\WINDOWS\system32\DRIVERS\sparrow.sys
12:50:36.0622 3640  Sparrow - ok
12:50:36.0782 3640  [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter        C:\WINDOWS\system32\drivers\splitter.sys
12:50:37.0132 3640  splitter - ok
12:50:37.0212 3640  [ 60784F891563FB1B767F70117FC2428F ] Spooler        C:\WINDOWS\system32\spoolsv.exe
12:50:37.0423 3640  Spooler - ok
12:50:37.0603 3640  [ 50FA898F8C032796D3B1B9951BB5A90F ] sr              C:\WINDOWS\system32\DRIVERS\sr.sys
12:50:37.0923 3640  sr - ok
12:50:38.0194 3640  [ FE77A85495065F3AD59C5C65B6C54182 ] srservice      C:\WINDOWS\system32\srsvc.dll
12:50:47.0748 3640  srservice - ok
12:50:50.0912 3640  [ 83726CF02ECED69138948083E06B6EAC ] SRTSP          C:\WINDOWS\System32\Drivers\NAV\1207010.003\SRTSP.SYS
12:50:51.0303 3640  SRTSP - ok
12:50:51.0373 3640  [ 4E7EAB2E5615D39CF1F1DF9C71E5E225 ] SRTSPX          C:\WINDOWS\system32\drivers\NAV\1207010.003\SRTSPX.SYS
12:50:51.0473 3640  SRTSPX - ok
12:50:51.0723 3640  [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv            C:\WINDOWS\system32\DRIVERS\srv.sys
12:50:52.0304 3640  Srv - ok
12:50:52.0865 3640  [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV        C:\WINDOWS\System32\ssdpsrv.dll
12:50:53.0235 3640  SSDPSRV - ok
12:50:53.0506 3640  [ 71D609C5DFF067906D930BDE031C4CFE ] ssmdrv          C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
12:50:53.0656 3640  ssmdrv ( UnsignedFile.Multi.Generic ) - warning
12:50:53.0656 3640  ssmdrv - detected UnsignedFile.Multi.Generic (1)
12:50:54.0888 3640  [ BC2C5985611C5356B24AEB370953DED9 ] stisvc          C:\WINDOWS\system32\wiaservc.dll
12:50:55.0569 3640  stisvc - ok
12:50:55.0859 3640  [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum          C:\WINDOWS\system32\DRIVERS\swenum.sys
12:50:56.0160 3640  swenum - ok
12:50:56.0370 3640  [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi          C:\WINDOWS\system32\drivers\swmidi.sys
12:50:56.0720 3640  swmidi - ok
12:50:56.0730 3640  SwPrv - ok
12:50:56.0971 3640  [ 1FF3217614018630D0A6758630FC698C ] symc810        C:\WINDOWS\system32\DRIVERS\symc810.sys
12:50:57.0331 3640  symc810 - ok
12:50:57.0572 3640  [ 070E001D95CF725186EF8B20335F933C ] symc8xx        C:\WINDOWS\system32\DRIVERS\symc8xx.sys
12:50:58.0002 3640  symc8xx - ok
12:50:58.0383 3640  [ 9BBEB8C6258E72D62E7560E6667AAD39 ] SymDS          C:\WINDOWS\system32\drivers\NAV\1207010.003\SYMDS.SYS
12:50:58.0954 3640  SymDS - ok
12:50:59.0995 3640  [ D5C02629C02A820A7E71BCA3D44294A3 ] SymEFA          C:\WINDOWS\system32\drivers\NAV\1207010.003\SYMEFA.SYS
12:51:01.0267 3640  SymEFA - ok
12:51:01.0728 3640  [ AB33C3B196197CA467CBDDA717860DBA ] SymEvent        C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
12:51:02.0028 3640  SymEvent - ok
12:51:02.0319 3640  [ A73399804D5D4A8B20BA60FCF70C9F1F ] SymIRON        C:\WINDOWS\system32\drivers\NAV\1207010.003\Ironx86.SYS
12:51:02.0619 3640  SymIRON - ok
12:51:03.0360 3640  [ 336CACE58F0359D5CBB1AE6B8A2FB205 ] SYMTDI          C:\WINDOWS\System32\Drivers\NAV\1207010.003\SYMTDI.SYS
12:51:03.0851 3640  SYMTDI - ok
12:51:03.0931 3640  [ 80AC1C4ABBE2DF3B738BF15517A51F2C ] sym_hi          C:\WINDOWS\system32\DRIVERS\sym_hi.sys
12:51:04.0161 3640  sym_hi - ok
12:51:04.0201 3640  [ BF4FAB949A382A8E105F46EBB4937058 ] sym_u3          C:\WINDOWS\system32\DRIVERS\sym_u3.sys
12:51:04.0442 3640  sym_u3 - ok
12:51:04.0572 3640  [ E210581E41D936F1C10FB7B3D67F5A1A ] SynTP          C:\WINDOWS\system32\DRIVERS\SynTP.sys
12:51:04.0872 3640  SynTP - ok
12:51:05.0022 3640  [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio        C:\WINDOWS\system32\drivers\sysaudio.sys
12:51:05.0293 3640  sysaudio - ok
12:51:05.0393 3640  [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog      C:\WINDOWS\system32\smlogsvc.exe
12:51:05.0743 3640  SysmonLog - ok
12:51:05.0874 3640  [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv        C:\WINDOWS\System32\tapisrv.dll
12:51:06.0254 3640  TapiSrv - ok
12:51:06.0444 3640  [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip          C:\WINDOWS\system32\DRIVERS\tcpip.sys
12:51:06.0805 3640  Tcpip - ok
12:51:06.0915 3640  [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE          C:\WINDOWS\system32\drivers\TDPIPE.sys
12:51:07.0306 3640  TDPIPE - ok
12:51:07.0416 3640  [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP          C:\WINDOWS\system32\drivers\TDTCP.sys
12:51:07.0696 3640  TDTCP - ok
12:51:07.0736 3640  [ 88155247177638048422893737429D9E ] TermDD          C:\WINDOWS\system32\DRIVERS\termdd.sys
12:51:08.0007 3640  TermDD - ok
12:51:08.0237 3640  [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService    C:\WINDOWS\System32\termsrv.dll
12:51:08.0618 3640  TermService - ok
12:51:08.0718 3640  [ 2DB7D303C36DDD055215052F118E8E75 ] Themes          C:\WINDOWS\System32\shsvcs.dll
12:51:08.0758 3640  Themes - ok
12:51:08.0918 3640  [ D213A9247DC347F305A2D4CC9B951487 ] TosIde          C:\WINDOWS\system32\DRIVERS\toside.sys
12:51:09.0158 3640  TosIde - ok
12:51:09.0248 3640  [ 626504572B175867F30F3215C04B3E2F ] TrkWks          C:\WINDOWS\system32\trkwks.dll
12:51:09.0509 3640  TrkWks - ok
12:51:09.0609 3640  [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs            C:\WINDOWS\system32\drivers\Udfs.sys
12:51:09.0980 3640  Udfs - ok
12:51:10.0070 3640  [ 1B698A51CD528D8DA4FFAED66DFC51B9 ] ultra          C:\WINDOWS\system32\DRIVERS\ultra.sys
12:51:10.0250 3640  ultra - ok
12:51:10.0580 3640  [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update          C:\WINDOWS\system32\DRIVERS\update.sys
12:51:11.0081 3640  Update - ok
12:51:11.0572 3640  [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost        C:\WINDOWS\System32\upnphost.dll
12:51:11.0862 3640  upnphost - ok
12:51:11.0962 3640  [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS            C:\WINDOWS\System32\ups.exe
12:51:12.0273 3640  UPS - ok
12:51:12.0323 3640  [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci        C:\WINDOWS\system32\DRIVERS\usbehci.sys
12:51:12.0563 3640  usbehci - ok
12:51:12.0663 3640  [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub          C:\WINDOWS\system32\DRIVERS\usbhub.sys
12:51:12.0944 3640  usbhub - ok
12:51:13.0024 3640  [ A717C8721046828520C9EDF31288FC00 ] usbprint        C:\WINDOWS\system32\DRIVERS\usbprint.sys
12:51:13.0244 3640  usbprint - ok
12:51:13.0294 3640  [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor        C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
12:51:13.0515 3640  usbstor - ok
12:51:13.0565 3640  [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci        C:\WINDOWS\system32\DRIVERS\usbuhci.sys
12:51:13.0835 3640  usbuhci - ok
12:51:13.0945 3640  [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave        C:\WINDOWS\System32\drivers\vga.sys
12:51:14.0176 3640  VgaSave - ok
12:51:14.0326 3640  [ 754292CE5848B3738281B4F3607EAEF4 ] viaagp          C:\WINDOWS\system32\DRIVERS\viaagp.sys
12:51:14.0606 3640  viaagp - ok
12:51:14.0726 3640  [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde          C:\WINDOWS\system32\DRIVERS\viaide.sys
12:51:15.0067 3640  ViaIde - ok
12:51:15.0207 3640  [ A5A712F4E880874A477AF790B5186E1D ] VolSnap        C:\WINDOWS\system32\drivers\VolSnap.sys
12:51:15.0467 3640  VolSnap - ok
12:51:15.0658 3640  [ 68F106273BE29E7B7EF8266977268E78 ] VSS            C:\WINDOWS\System32\vssvc.exe
12:51:16.0088 3640  VSS - ok
12:51:16.0219 3640  [ 7B353059E665F8B7AD2BBEAEF597CF45 ] W32Time        C:\WINDOWS\system32\w32time.dll
12:51:16.0519 3640  W32Time - ok
12:51:16.0549 3640  [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp          C:\WINDOWS\system32\DRIVERS\wanarp.sys
12:51:16.0779 3640  Wanarp - ok
12:51:16.0789 3640  WDICA - ok
12:51:16.0819 3640  [ 6768ACF64B18196494413695F0C3A00F ] wdmaud          C:\WINDOWS\system32\drivers\wdmaud.sys
12:51:17.0050 3640  wdmaud - ok
12:51:17.0160 3640  [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient      C:\WINDOWS\System32\webclnt.dll
12:51:17.0440 3640  WebClient - ok
12:51:17.0791 3640  [ 6F3F3973D97714CC5F906A19FE883729 ] winmgmt        C:\WINDOWS\system32\wbem\WMIsvc.dll
12:51:18.0221 3640  winmgmt - ok
12:51:18.0352 3640  [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN        C:\WINDOWS\system32\MsPMSNSv.dll
12:51:18.0712 3640  WmdmPmSN - ok
12:51:18.0862 3640  [ 93908111BA57A6E60EC2FA2DE202105C ] WmiApSrv        C:\WINDOWS\system32\wbem\wmiapsrv.exe
12:51:19.0153 3640  WmiApSrv - ok
12:51:19.0553 3640  [ BF05650BB7DF5E9EBDD25974E22403BB ] WMPNetworkSvc  C:\Programme\Windows Media Player\WMPNetwk.exe
12:51:20.0715 3640  WMPNetworkSvc - ok
12:51:20.0795 3640  [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc          C:\WINDOWS\system32\wscsvc.dll
12:51:21.0035 3640  wscsvc - ok
12:51:21.0136 3640  [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv        C:\WINDOWS\system32\wuauserv.dll
12:51:21.0406 3640  wuauserv - ok
12:51:21.0486 3640  [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf          C:\WINDOWS\system32\DRIVERS\WudfPf.sys
12:51:21.0696 3640  WudfPf - ok
12:51:21.0736 3640  [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc        C:\WINDOWS\System32\WUDFSvc.dll
12:51:21.0897 3640  WudfSvc - ok
12:51:22.0097 3640  [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC          C:\WINDOWS\System32\wzcsvc.dll
12:51:22.0608 3640  WZCSVC - ok
12:51:22.0688 3640  [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov        C:\WINDOWS\System32\xmlprov.dll
12:51:22.0988 3640  xmlprov - ok
12:51:22.0998 3640  ================ Scan global ===============================
12:51:23.0068 3640  [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll
12:51:23.0209 3640  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
12:51:23.0389 3640  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
12:51:23.0429 3640  [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe
12:51:23.0429 3640  [Global] - ok
12:51:23.0429 3640  ================ Scan MBR ==================================
12:51:23.0469 3640  [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
12:51:34.0935 3640  \Device\Harddisk0\DR0 - ok
12:51:34.0955 3640  [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR2
12:51:39.0292 3640  \Device\Harddisk1\DR2 - ok
12:51:39.0292 3640  ================ Scan VBR ==================================
12:51:39.0312 3640  [ D3C3E9943DA39A6B0295334B56EF2C99 ] \Device\Harddisk0\DR0\Partition1
12:51:39.0322 3640  \Device\Harddisk0\DR0\Partition1 - ok
12:51:39.0322 3640  [ D0DD2076D1745BBD0EF1D3723D6EAE55 ] \Device\Harddisk1\DR2\Partition1
12:51:39.0332 3640  \Device\Harddisk1\DR2\Partition1 - ok
12:51:39.0332 3640  ============================================================
12:51:39.0332 3640  Scan finished
12:51:39.0332 3640  ============================================================
12:51:39.0512 3632  Detected object count: 3
12:51:39.0512 3632  Actual detected object count: 3
12:51:47.0283 3632  aspnet_state ( UnsignedFile.Multi.Generic ) - skipped by user
12:51:47.0283 3632  aspnet_state ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:51:47.0283 3632  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
12:51:47.0283 3632  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:51:47.0293 3632  ssmdrv ( UnsignedFile.Multi.Generic ) - skipped by user
12:51:47.0293 3632  ssmdrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:51:52.0270 3568  Deinitialize success

markusg 06.02.2013 13:04
Hi,
nutzt du das Gerät für Onlinebanking, zum einkaufen, für sonstige Zahlungsabwicklungen, oder ähnlich wichtigem, wie beruflichem?

K2G 06.02.2013 13:32
Ja.

markusg 06.02.2013 13:34
Hi
rufe die Bank an, lasse das Onlinebanking wegen Rootkit befall sperren.
Da die Besitzer von Rootkits auf deinem PC uneingeschrenkt änderungen vornemen konnten, kann ich dir nur raten, das System neu aufzusetzen, da wir nicht garantieren können, alle änderungen rückgängig machen zu können.
Das währe aber nötig, da du ja sensible Geschäfte an diesem PC vornimmst.
deswegen:
1. Datenrettung:2. Formatieren, Windows neu instalieren:3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
ich werde außerdem noch weitere punkte dazu posten.
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.

K2G 06.02.2013 13:54
OK, vielen Dank für deine Unterstützung. :dankeschoen:

markusg 06.02.2013 14:12
hi,
weist du wie man formatiert?
wenn dazu noch Fragen sind, stelle sie, ansonsten poste ich schon mal die Anleitung zum absichern:
als antimalware programm würde ich emsisoft empfehlen.
diese haben für mich den besten schutz kostet aber etwas.
Computeractive Software Store - Emsisoft Anti-Malware 7 [1-PC] - 63% off RRP
testversion:
Meine Antivirus-Empfehlung: Emsisoft Anti-Malware
insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren.
vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen.

kostenlos, aber eben nicht ganz so gut währe avast zu empfehlen.
http://www.trojaner-board.de/110895-...antivirus.html

sag mir welches du nutzt, dann gebe ich konfigurationshinweise.
bitte dein bisheriges av deinstalieren
die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch!

http://www.trojaner-board.de/96344-a...-rechners.html
Starte bitte mit der Passage, Windows Vista und Windows 7
Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.
Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist.
aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen.
als browser rate ich dir zu chrome:
Installation von Google Chrome für mehrere Nutzerkonten - Google Chrome-Hilfe
anleitung lesen bitte
falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung anpassen.


Sandboxie
Die devinition einer Sandbox ist hier nachzulesen:
Sandbox
Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen.

Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen.
Download Link:
Sandboxie - Download - Filepony

anleitung:
http://www.trojaner-board.de/71542-a...sandboxie.html
ausführliche anleitung als pdf, auch abarbeiten:
Sandbox Einstellungen |

bitte folgende zusatz konfiguration machen:
sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen.
dort klicke auf sandbox einstellungen.
beschrenkungen, bei programm start und internet zugriff schreibe:
chrome.exe
dann gehe auf anwendungen, webbrowser, chrome.
dort aktiviere alles außer gesammten profil ordner freigeben.
Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen.
Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate.
Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten.
Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten.
Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar.

Weiter mit:
Maßnahmen für ALLE Windows-Versionen
alles komplett durcharbeiten
anmerkung zu file hippo.
in den settings zusätzlich auswählen:
hide beta updates.
Run updateChecker when Windows starts

Backup Programm:
in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an:
http://www.trojaner-board.de/82962-w...en-backup.html
Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar.
Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist.

Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern
bitte auch lesen, wie mache ich programme für alle sichtbar:
Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe
surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox.
wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird sandboxie immer gestartet wenn du nen browser aufrufst.
wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser

passwort sicherheit:
jeder dienst benötigt ein eigenes, mindestens 12-stelliges passwort
bei der passwort verwaltung und erstellung hilft roboform
Passwort Manager, Formular Ausfueller, Passwort Management | RoboForm Passwort Manager
anleitung:
RoboForm-Bedienungsanleitung: Passwort-Manager, Verwalten von Passwörtern und persönlichen Daten

K2G 06.02.2013 15:29
Danke für die umfangreichen Tipps.

Von hier an komme ich alleine klar.
Thema kann geschlossen werden.


Alle Zeitangaben in WEZ +1. Es ist jetzt 22:31 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131