Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   www.camfun.de (https://www.trojaner-board.de/89758-www-camfun-de.html)

Donselmo 20.08.2010 07:21
www.camfun.de
 
Hallo,
habe in meinem IE unter Windows7 das Problem, dass sich unter Verlauf regelmäßig ein File mit der Bezeichnung x-check webcams und der URL "www.camfun.de" zeigt. Darüber hinaus akzeptiert mein PC den "Browserverlauf löschen"-Befehl nicht mehr, es bleibt alles beim Alten. Avira findet keinerlei Störquellen. Was kann ich als nächstes tun?
BG, Donselmo

kira 20.08.2010 07:59
Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:
  • "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
    - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
    - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
  • Charakteristische Merkmale/Profilinformationen:
    - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
  • Die Systemprüfung und Bereinigung:
    - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
  • Innerhalb der Betreuungszeit:
    - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
  • Die Reihenfolge:
    - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
  • Ansonsten unsere Forumsregeln:
    - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?


vermutlich damit zu tun - Altersverifizierung per Webcam:
-> http://www.e-recht24.de/forum/6883-a...m-erlaubt.html
-> http://www.e-recht24.de/forum/6883-a...erlaubt-2.html

gruß
CF

Donselmo 20.08.2010 08:16
Hallo,
vielen Dank für die ersten Hinweise, mit Altersverifikation aber hat das m.E. gar nichts zu tun. Die Seite, die sich unter dieser URL öffnet, ist einfach so eine Erotik-Webcam-Seite, die ich jedoch bewusst(!) nie bestellt bzw. gebookmarkt habe. Vor allem ist es irritierend, dass sie immer wieder im Verlauf erscheint, ohne dass ich sie aufrufe und sich auch bei wiederholtem Löschen immer wieder von selbst im Verlauf positioniert.
Donselmo

kira 20.08.2010 21:23
Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:
Zitat:
  • "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
    - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
    - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
  • Charakteristische Merkmale/Profilinformationen:
    - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
  • Die Systemprüfung und Bereinigung:
    - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
  • Innerhalb der Betreuungszeit:
    - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
  • Die Reihenfolge:
    - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
  • Ansonsten unsere Forumsregeln:
    - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
Um das Problem genau analysieren zu können, machts du folgendes:
1.
- Lade dir RSIT - http://filepony.de/download-rsit/:
- an einen Ort deiner Wahl und führe die rsit.exe aus
- wird "Hijackthis" auch von Rsit installiert und ausgeführt
- RSIT erstellt 2 Logfiles (C:\rsit\log.txt und C:\rsit\info.txt) mit erweiterten Infos von deinem System - diese beide bitte komplett hier posten

2.
Bitte Versteckte - und Systemdateien sichtbar machen den Link hier anklicken:
System-Dateien und -Ordner unter XP und Vista sichtbar machen
Am Ende unserer Arbeit, kannst wieder rückgängig machen!

3.
→ Lade Dir HJTscanlist.zip herunter
→ entpacke die Datei auf deinem Desktop
→ Bei WindowsXP Home musst vor dem Scan zusätzlich tasklist.zip installieren
→ per Doppelklick starten
→ Wähle dein Betriebsystem aus - Vista
→ Wenn Du gefragt wirst, die Option "Einstellung" (1) - scanlist" wählen
→ Nach kurzer Zeit sollte sich Dein Editor öffnen und die Datei hjtscanlist.txt präsentieren
→ Bitte kopiere den Inhalt hier in Deinen Thread.

4.
Ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool "Ccleaner" herunter
installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ falls nötig - unter Options settings-> "german" einstellen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

5.
läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit)
Achtung!:
WENN GMER NICHT AUSGEFÜHRT WERDEN KANN ODER PROBMLEME VERURSACHT, fahre mit dem nächsten Punkt fort!- Es ist NICHT sinnvoll einen zweiten Versuch zu starten!
Um einen tieferen Einblick in dein System, um eine mögliche Infektion mit einem Rootkit/Info v.wikipedia.org) aufzuspüren, werden wir ein Tool - Gmer - einsetzen :
  • - also lade Dir Gmer herunter und entpacke es auf deinen Desktop
    - starte gmer.exe
    - [b]schließe alle Programme, ausserdem Antiviren und andere Schutzprogramme usw müssen deaktiviert sein, keine Verbindung zum Internet, WLAN auch trennen)
    - bitte nichts am Pc machen während der Scan läuft!
    - klicke auf "Scan", um das Tool zu starten
    - wenn der Scan fertig ist klicke auf "Copy" (das Log wird automatisch in die Zwischenablage kopiert) und mit STRG + V musst Du gleich da einfügen
    - mit "Ok" wird Gmer beendet.
    - das Log aus der Zwischenablage hier in Deinem Thread vollständig hineinkopieren

** keine Verbindung zu einem Netzwerk und Internet - WLAN nicht vergessen
Wenn der Scan beendet ist, bitte alle Programme und Tools wieder aktivieren!

6.
läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit)
Lade und installiere das Tool RootRepeal herunter
  • setze einen Hacken bei: "Drivers"-> "Scan"-> Save Report"...
  • "Stealth Objects" -> "Scan"-> Save Report"...
  • "Hidden Services" -> "Scan"-> Save Report"...
  • speichere das Logfile als "RootRepeal.txt" auf dem Desktop und Kopiere den Inhalt hier in den Thread

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B hjtsanlist o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]
** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw
gruß
Coverflow

Donselmo 05.09.2010 10:49
Hallo,
vielen Dank vorab, hier meine ganzen Ergebnisse:

ad1)
[code]
RSIT Logfile:
Code:
Logfile of random's system information tool 1.08 (written by random/random)
Run by Anselm at 2010-09-05 11:43:03
Microsoft® Windows Vista™ Home Premium  Service Pack 2
System drive C: has 279 GB (53%) free of 523 GB
Total RAM: 3325 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:43:04, on 05.09.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Cyberlink\Shared files\brs.exe
C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10i_ActiveX.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Anselm\Downloads\RSIT.exe
C:\Program Files\trend micro\Anselm.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.spiegel.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Startup: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: OneNote Inhaltsverzeichnis.onetoc2
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 (file missing)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 (file missing)
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 (file missing) (HKCU)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: AAV UpdateService - Unknown owner - C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\Windows\system32\bgsvcgen.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1ca87b36615f820) (gupdate1ca87b36615f820) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe

--
End of file - 11286 bytes

======Scheduled tasks folder======

C:\Windows\tasks\1-Klick-Wartung.job
C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\User_Feed_Synchronization-{A0F51AA7-6B7F-4737-A6DB-DB03F0473182}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-18 278192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll [2010-06-01 814648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-27 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-18 278192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-10-09 178712]
"BDRegion"=C:\Program Files\Cyberlink\Shared Files\brs.exe [2009-03-30 75048]
"CLMLServer"=C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe [2008-07-18 104936]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2009-02-03 6724128]
"Skytel"=C:\Program Files\Realtek\Audio\HDA\Skytel.exe [2009-02-03 1833504]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2009-03-27 13687328]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2009-03-27 92704]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"LogitechCommunicationsManager"=C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe [2008-08-14 565008]
"LogitechQuickCamRibbon"=C:\Program Files\Logitech\QuickCam\Quickcam.exe [2008-08-14 2407184]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-03-17 421888]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-04-28 142120]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-06-28 2837864]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe /background []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-01-15 147456]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

C:\Users\Anselm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
OneNote Inhaltsverzeichnis.onetoc2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 3 months======

2010-09-05 09:12:22 ----D---- C:\Windows\Minidump
2010-09-04 17:09:31 ----D---- C:\ProgramData\McAfee Security Scan
2010-09-04 17:09:31 ----D---- C:\ProgramData\McAfee
2010-09-04 17:09:30 ----D---- C:\Program Files\McAfee Security Scan
2010-09-03 21:56:26 ----D---- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2010-09-03 00:48:05 ----D---- C:\rsit
2010-09-03 00:23:24 ----D---- C:\Program Files\CCleaner
2010-09-02 23:45:11 ----D---- C:\Users\Anselm\AppData\Roaming\Mozilla
2010-09-02 23:45:05 ----D---- C:\Program Files\Mozilla Firefox
2010-08-19 22:36:29 ----D---- C:\Program Files\Trend Micro
2010-08-19 20:11:24 ----D---- C:\ProgramData\Alwil Software
2010-08-13 09:55:12 ----A---- C:\Windows\system32\rtutils.dll
2010-08-13 09:55:00 ----A---- C:\Windows\system32\mshtml.dll
2010-08-13 09:55:00 ----A---- C:\Windows\system32\iertutil.dll
2010-08-13 09:54:59 ----A---- C:\Windows\system32\ieframe.dll
2010-08-13 09:54:58 ----A---- C:\Windows\system32\wininet.dll
2010-08-13 09:54:58 ----A---- C:\Windows\system32\urlmon.dll
2010-08-13 09:54:58 ----A---- C:\Windows\system32\mstime.dll
2010-08-13 09:54:58 ----A---- C:\Windows\system32\msfeeds.dll
2010-08-13 09:54:58 ----A---- C:\Windows\system32\iedkcs32.dll
2010-08-13 09:54:58 ----A---- C:\Windows\system32\ie4uinit.exe
2010-08-13 09:54:57 ----A---- C:\Windows\system32\occache.dll
2010-08-13 09:54:57 ----A---- C:\Windows\system32\msfeedssync.exe
2010-08-13 09:54:57 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-08-13 09:54:57 ----A---- C:\Windows\system32\jsproxy.dll
2010-08-13 09:54:57 ----A---- C:\Windows\system32\ieUnatt.exe
2010-08-13 09:54:57 ----A---- C:\Windows\system32\ieui.dll
2010-08-13 09:54:57 ----A---- C:\Windows\system32\iesysprep.dll
2010-08-13 09:54:57 ----A---- C:\Windows\system32\iesetup.dll
2010-08-13 09:54:57 ----A---- C:\Windows\system32\iernonce.dll
2010-08-13 09:54:57 ----A---- C:\Windows\system32\iepeers.dll
2010-08-13 09:54:55 ----A---- C:\Windows\system32\iccvid.dll
2010-08-13 09:54:52 ----A---- C:\Windows\system32\schannel.dll
2010-08-13 09:54:46 ----A---- C:\Windows\system32\win32k.sys
2010-08-13 09:53:56 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-08-13 09:53:55 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-08-13 09:53:47 ----A---- C:\Windows\system32\msxml3.dll
2010-08-13 09:53:45 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-08-13 09:53:45 ----A---- C:\Windows\system32\drivers\srv.sys
2010-08-13 09:53:41 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-08-04 21:53:18 ----D---- C:\Users\Anselm\AppData\Roaming\Canon
2010-08-02 20:35:51 ----A---- C:\Windows\system32\shell32.dll
2010-07-30 08:45:05 ----HD---- C:\ProgramData\CanonIJScan
2010-07-25 21:37:56 ----D---- C:\Users\Anselm\AppData\Roaming\elsterformular
2010-07-25 21:35:39 ----D---- C:\ProgramData\elsterformular
2010-06-23 13:18:23 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2010-06-23 13:18:23 ----A---- C:\Windows\system32\PresentationHost.exe
2010-06-23 13:18:23 ----A---- C:\Windows\system32\netfxperf.dll
2010-06-23 13:18:23 ----A---- C:\Windows\system32\mscoree.dll
2010-06-23 13:18:23 ----A---- C:\Windows\system32\dfshim.dll
2010-06-23 12:56:31 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2010-06-23 12:56:31 ----A---- C:\Windows\system32\Apphlpdm.dll
2010-06-20 19:29:20 ----HD---- C:\Windows\system32\CanonIJ Uninstaller Information
2010-06-20 19:29:11 ----HD---- C:\ProgramData\CanonBJ
2010-06-20 19:27:34 ----A---- C:\Windows\system32\CNMLMA0.DLL
2010-06-20 19:26:00 ----A---- C:\Windows\system32\CNHMCA.dll
2010-06-20 19:26:00 ----A---- C:\Windows\system32\CNC560U.dll
2010-06-20 19:26:00 ----A---- C:\Windows\system32\CNC560L.dll
2010-06-20 19:26:00 ----A---- C:\Windows\system32\CNC560I.dll
2010-06-20 19:26:00 ----A---- C:\Windows\system32\CNC560C.dll
2010-06-16 00:08:59 ----D---- C:\Users\Anselm\AppData\Roaming\Apple Computer
2010-06-16 00:08:50 ----A---- C:\Windows\system32\GEARAspi.dll
2010-06-16 00:08:50 ----A---- C:\Windows\system32\drivers\GEARAspiWDM.sys
2010-06-16 00:08:49 ----DC---- C:\Windows\system32\DRVSTORE
2010-06-16 00:07:56 ----D---- C:\Program Files\iPod
2010-06-16 00:07:55 ----D---- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-06-16 00:07:55 ----D---- C:\Program Files\iTunes
2010-06-16 00:06:43 ----D---- C:\Program Files\QuickTime
2010-06-16 00:06:42 ----D---- C:\ProgramData\Apple Computer
2010-06-16 00:06:06 ----D---- C:\Program Files\Apple Software Update
2010-06-16 00:04:29 ----D---- C:\Program Files\Bonjour
2010-06-16 00:04:20 ----D---- C:\ProgramData\Apple
2010-06-16 00:04:20 ----D---- C:\Program Files\Common Files\Apple
2010-06-11 22:34:00 ----A---- C:\Windows\system32\atmfd.dll
2010-06-11 22:34:00 ----A---- C:\Windows\system32\asycfilt.dll
2010-06-11 22:33:59 ----A---- C:\Windows\system32\atmlib.dll

======List of files/folders modified in the last 3 months======

2010-09-05 11:42:55 ----D---- C:\Windows\Temp
2010-09-05 11:42:30 ----D---- C:\Windows\prefetch
2010-09-05 11:30:57 ----D---- C:\Windows\System32
2010-09-05 11:30:56 ----D---- C:\Windows\system32\drivers
2010-09-05 10:42:23 ----D---- C:\Windows\inf
2010-09-05 10:42:23 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-09-05 10:40:23 ----D---- C:\Windows\Tasks
2010-09-05 09:12:22 ----D---- C:\Windows
2010-09-05 08:23:05 ----D---- C:\ProgramData\Google Updater
2010-09-05 08:21:37 ----RD---- C:\Program Files
2010-09-05 08:21:37 ----HD---- C:\ProgramData
2010-09-05 08:21:35 ----SD---- C:\Windows\Downloaded Program Files
2010-09-04 18:21:20 ----SHD---- C:\Windows\Installer
2010-09-04 18:21:14 ----D---- C:\ProgramData\Microsoft Help
2010-09-04 18:19:41 ----RSD---- C:\Windows\assembly
2010-09-04 18:14:54 ----SHD---- C:\System Volume Information
2010-09-04 13:40:01 ----RSD---- C:\Windows\Fonts
2010-09-04 13:39:52 ----D---- C:\Program Files\Common Files\microsoft shared
2010-09-04 13:38:28 ----A---- C:\Windows\win.ini
2010-09-03 21:57:43 ----D---- C:\Program Files\Microsoft Works
2010-09-03 21:54:42 ----D---- C:\Windows\winsxs
2010-09-03 21:27:05 ----D---- C:\Program Files\Microsoft Silverlight
2010-09-03 00:07:44 ----SD---- C:\ProgramData\Microsoft
2010-09-01 15:40:13 ----D---- C:\Windows\system32\catroot2
2010-08-19 20:14:23 ----D---- C:\Program Files\Alwil Software
2010-08-15 11:14:37 ----D---- C:\Windows\Microsoft.NET
2010-08-13 19:34:59 ----D---- C:\Windows\system32\migration
2010-08-13 19:34:59 ----D---- C:\Program Files\Internet Explorer
2010-08-13 19:34:58 ----D---- C:\Program Files\Movie Maker
2010-08-13 13:15:49 ----D---- C:\Windows\system32\catroot
2010-08-13 13:15:46 ----D---- C:\Program Files\Windows Mail
2010-08-03 20:09:31 ----A---- C:\Windows\system32\mrt.exe
2010-07-25 21:36:52 ----D---- C:\Program Files\ElsterFormular
2010-07-25 21:32:47 ----SD---- C:\Users\Anselm\AppData\Roaming\Microsoft
2010-07-25 20:28:13 ----D---- C:\Program Files\Picasa2
2010-06-28 22:57:12 ----A---- C:\Windows\system32\aswBoot.exe
2010-06-26 00:28:44 ----D---- C:\Windows\system32\en-US
2010-06-26 00:28:42 ----D---- C:\Program Files\Microsoft.NET
2010-06-23 13:21:48 ----D---- C:\Windows\AppPatch
2010-06-23 13:19:24 ----D---- C:\Windows\ehome
2010-06-20 19:26:58 ----RSD---- C:\Windows\Media
2010-06-20 19:26:56 ----D---- C:\Windows\twain_32
2010-06-16 00:06:08 ----D---- C:\Windows\system32\Tasks
2010-06-16 00:04:20 ----D---- C:\Program Files\Common Files
2010-06-11 23:11:20 ----D---- C:\Windows\system32\wbem

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2007-10-09 306200]
R0 PxHelp20;PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [2008-11-20 43872]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-06-28 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-06-28 165456]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-06-28 46672]
R1 cdrbsdrv;cdrbsdrv; C:\Windows\system32\drivers\cdrbsdrv.sys [2006-02-20 33408]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/04/22 16:10:50]; \??\C:\Program Files\HomeCinema\PowerDVD9\000.fcl [2009-03-30 87536]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-06-28 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-06-28 50256]
R3 e1express;Intel(R) PRO/1000 PCI Express-Netzwerkverbindungstreiber; C:\Windows\system32\DRIVERS\e1e6032.sys [2008-01-21 220672]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2009-02-03 2320480]
R3 LVPr2Mon;Logitech LVPr2Mon Driver; C:\Windows\system32\DRIVERS\LVPr2Mon.sys [2008-07-26 25624]
R3 LVRS;Logitech RightSound Filter Driver; C:\Windows\system32\DRIVERS\lvrs.sys [2008-07-26 627864]
R3 LVUSBSta;Logitech USB Monitor Filter; C:\Windows\system32\drivers\LVUSBSta.sys [2008-07-26 41752]
R3 LVUVC;Logitech QuickCam S7500(UVC); C:\Windows\system32\DRIVERS\lvuvc.sys [2008-07-26 4658584]
R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista; C:\Windows\system32\DRIVERS\netr28u.sys [2007-09-21 554496]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2009-03-27 7738816]
R3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2010-04-16 41472]
R3 usbaudio;USB-Audiotreiber (WDM); C:\Windows\system32\drivers\usbaudio.sys [2009-04-11 73216]
R3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AAV UpdateService;AAV UpdateService; C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [2008-10-24 128296]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-04-16 144672]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
R2 bgsvcgen;B's Recorder GOLD Library General Service; C:\Windows\system32\bgsvcgen.exe [2007-06-15 145504]
R2 Bonjour Service;Dienst "Bonjour"; C:\Program Files\Bonjour\mDNSResponder.exe [2010-04-08 345376]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-10-09 358936]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2009-01-27 73728]
R2 LVCOMSer;LVCOMSer; C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe [2008-07-26 186904]
R2 LVPrcSrv;Process Monitor; C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2008-07-26 150040]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-03-27 207392]
R2 ProtexisLicensing;ProtexisLicensing; C:\Windows\system32\PSIService.exe [2007-06-05 177704]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\Cyberlink\Shared files\RichVideo.exe [2009-02-25 247152]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
R3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2010-04-28 545576]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-01-15 266240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate1ca87b36615f820;Google Update Service (gupdate1ca87b36615f820); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-28 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-23 182768]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

-----------------EOF-----------------
--- --- ---


ad2)
done

ad3)
PC sagt mir beim Durchführen nur "Zugriff verweigert" und gibt mir keinen Logfile aus. -Was mache ich falsch?

ad4)
Code:
AAVUpdateManager        Akademische Arbeitsgemeinschaft        23.06.2009        13,8MB        3.00.0000
Activation Assistant for the 2007 Microsoft Office suites        Microsoft Corporation        22.06.2009        14,0MB       
Adobe Flash Player 10 ActiveX        Adobe Systems Incorporated        03.09.2010                10.1.82.76
Adobe Flash Player 10 Plugin        Adobe Systems Incorporated        22.06.2009                10.0.22.87
Adobe Photoshop 7.0        Adobe Systems, Inc.        02.01.2010        144,8MB        7.0
Adobe Reader 9.3.4 - Deutsch        Adobe Systems Incorporated        20.08.2010        168,9MB        9.3.4
Adobe Shockwave Player 11.5        Adobe Systems, Inc.        22.06.2009        21,2MB        11.5
ALNO AG  Küchenplaner        ALNO AG        21.03.2010                0.98a
Angebote ALDI SÜD Bildschirmschoner                22.06.2009               
Apple Application Support        Apple Inc.        15.06.2010        39,7MB        1.2.1
Apple Mobile Device Support        Apple Inc.        15.06.2010        19,7MB        3.0.1.3
Apple Software Update        Apple Inc.        15.06.2010        2,26MB        2.1.2.120
avast! Free Antivirus        Alwil Software        18.08.2010        133,8MB        5.0.594.0
Bonjour        Apple Inc.        15.06.2010        0,76MB        2.0.1.2
Canon Camera TWAIN Driver 6.2        Canon        04.07.2009                6.2.0
Canon Camera Window for ZoomBrowser EX        Canon        04.07.2009                4.5.1
Canon Internet Library for ZoomBrowser EX        Canon Inc.        04.07.2009                1.3.1
Canon MP560 series MP Drivers                19.06.2010               
Canon PhotoRecord        Cisra        04.07.2009        80,3MB        02.00.00029
Canon RAW Image Task for ZoomBrowser EX        Canon        04.07.2009        0,11MB        0.9.0
Canon RemoteCapture Task for ZoomBrowser EX        Canon        04.07.2009                1.0
Canon Utilities PhotoStitch 3.1        Canon        04.07.2009                3.1.11
Canon Utilities ZoomBrowser EX        CISRA        04.07.2009        8,49MB        04.05.01148
CCleaner        Piriform        02.09.2010        2,95MB        2.35
Compatibility Pack für 2007 Office System        Microsoft Corporation        02.09.2010        168,6MB        12.0.6425.1000
Corel MediaOne        Corel Corporation        01.04.2009        181,3MB        2.100.0000
CorelDRAW Essential Edition 3        Corel Corporation        01.04.2009        229,2MB       
CyberLink LabelPrint        CyberLink Corp.        21.04.2009        126,8MB        2.5.1616
CyberLink MediaShow        CyberLink Corp.        21.04.2009        182,7MB        4.1.2609
CyberLink PhotoNow        CyberLink Corp.        21.04.2009        21,8MB        1.1.5615
CyberLink Power2Go        CyberLink Corp.        21.04.2009        102,7MB        6.1.2806
CyberLink PowerDirector        CyberLink Corp.        21.04.2009        324,6MB        7.0.2718
CyberLink PowerDVD 9        CyberLink Corp.        21.04.2009        195,8MB        9.0.1531
CyberLink PowerDVD Copy        CyberLink Corp.        22.06.2009        11,5MB        1.0.5611
CyberLink PowerProducer        CyberLink Corp.        21.04.2009        166,2MB        5.0.1.1412
ElsterFormular        Landesfinanzdirektion Thüringen        24.07.2010        296,0MB        11.5.0.4546
ElsterFormular 2008/2009        Steuerverwaltung des Bundes und der Länder        02.01.2010        154,4MB        10.3.2.0
Google Chrome        Google Inc.        27.12.2009        221,9MB        5.0.375.127
Google Toolbar for Internet Explorer        Google Inc.        17.07.2010        12,3MB       
Google Updater        Google Inc.        22.06.2009        4,57MB        2.4.1487.6512
HD Writer 2.5E for HDC        Panasonic Corporation        23.07.2009        259,3MB        2.5.816.1031
HijackThis 2.0.2        TrendMicro        18.08.2010        0,39MB        2.0.2
Intel(R) Matrix Storage Manager                22.06.2009        8,14MB       
iTunes        Apple Inc.        15.06.2010        160,0MB        9.1.1.12
Java(TM) 6 Update 13        Sun Microsystems, Inc.        26.03.2009        97,0MB        6.0.130
LightScribe System Software        LightScribe        21.04.2009        23,0MB        1.18.1.1
Logitech QuickCam        Logitech Inc.        27.12.2009        26,3MB        11.80.1065
Logitech QuickCam-Treiberpaket                27.12.2009               
Logitech Updater        Ihr Firmenname        01.01.2010        1,30MB        1.70
mb Software ArCon 6.5                15.08.2009        1.141,6MB       
McAfee Security Scan Plus        McAfee, Inc.        03.09.2010        2,33MB        2.0.181.2
MCE Software Encoder 1.1        CyberLink Corporation        22.06.2009        1,51MB        1.1.0.1918
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU        Microsoft Corporation        24.03.2009        37,4MB       
Microsoft .NET Framework 3.5 SP1        Microsoft Corporation        24.03.2009        37,4MB       
Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        25.06.2010        120,3MB        4.0.30319
Microsoft Office Outlook Connector        Microsoft Corporation        20.09.2009        6,15MB        12.0.6423.1000
Microsoft Office Ultimate 2007        Microsoft Corporation        03.09.2010        624,0MB        12.0.6425.1000
Microsoft Silverlight        Microsoft Corporation        02.09.2010        12,1MB        4.0.50826.0
Microsoft SQL Server 2005 Compact Edition [DEU]        Microsoft Corporation        26.03.2009        0,32MB        3.1.0000
Microsoft SQL Server 2005 Compact Edition [ENU]        Microsoft Corporation        26.03.2009        1,74MB        3.1.0000
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053        Microsoft Corporation        02.09.2010        0,25MB        8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        23.07.2009        2,38MB        8.0.56336
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729        Microsoft Corporation        24.07.2010        0,59MB        9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        18.08.2010        0,58MB        9.0.30729.4148
Microsoft Works        Microsoft Corporation        02.09.2010        378,0MB        9.7.0621
Mozilla Firefox (3.6.8)        Mozilla        01.09.2010        27,8MB        3.6.8 (de)
MSXML 4.0 SP2 (KB936181)        Microsoft Corporation        01.04.2009        1,28MB        4.20.9848.0
MSXML 4.0 SP2 (KB941833)        Microsoft Corporation        01.04.2009        1,28MB        4.20.9849.0
MSXML 4.0 SP2 (KB954430)        Microsoft Corporation        01.04.2009        1,29MB        4.20.9870.0
MSXML 4.0 SP2 (KB973688)        Microsoft Corporation        24.11.2009        1,35MB        4.20.9876.0
Nero 7 Premium        Nero AG        01.01.2010        1.543,7MB        7.02.4716
NVIDIA Drivers        NVIDIA Corporation        22.06.2009        2.988,8MB        1.3
NVIDIA PhysX        NVIDIA Corporation        16.04.2009        119,9MB        9.09.0203
Picasa 3        Google, Inc.        24.07.2010        86,7MB        3.6
QuickTime        Apple Inc.        15.06.2010        73,8MB        7.66.71.0
Realtek High Definition Audio Driver        Realtek Semiconductor Corp.        01.04.2009        9,79MB        6.0.1.5783
Skype Toolbars        Skype Technologies S.A.        29.03.2010        6,12MB        1.0.4051
Skype™ 4.2        Skype Technologies S.A.        29.03.2010        31,7MB        4.2.155
Spelling Dictionaries Support For Adobe Reader 9        Adobe Systems Incorporated        26.03.2009        64,7MB        9.0.0
Steuer-Spar-Erklärung 2007                23.06.2009        143,9MB        12.03
Steuer-Spar-Erklärung 2009        Akademische Arbeitsgemeinschaft Verlag        23.06.2009        265,2MB        14.01.0000
TuneUp Utilities 2007        TuneUp Software        26.08.2009        26,3MB        6.0.2311
Windows Live Anmelde-Assistent        Microsoft Corporation        16.04.2009        1,93MB        5.000.818.6
Windows Live Essentials        Microsoft Corporation        26.03.2009        136,5MB        14.0.8050.1202
Windows Live Sync        Microsoft Corporation        26.03.2009        2,80MB        14.0.8050.1202
Windows Live-Uploadtool        Microsoft Corporation        26.03.2009        0,22MB        14.0.8014.1029
ad 5)
PC hat sich selbsttätig ausgeschaltet und ist wieder hochgefahren, kein 2. Versuch, wie ja angegegben.

ad 6)
Code:
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:                2010/09/05 11:32
Program Version:                Version 1.3.5.0
Windows Version:                Windows Vista SP2
==================================================

Drivers
-------------------
Name: 000.fcl
Image Path: C:\Program Files\HomeCinema\PowerDVD9\000.fcl
Address: 0xA1D4F000        Size: 180224        File Visible: -        Signed: -
Status: -

Name: 1394BUS.SYS
Image Path: C:\Windows\system32\DRIVERS\1394BUS.SYS
Address: 0x8F3DE000        Size: 57344        File Visible: -        Signed: -
Status: -

Name: acpi.sys
Image Path: C:\Windows\system32\drivers\acpi.sys
Address: 0x80694000        Size: 286720        File Visible: -        Signed: -
Status: -

Name: ACPI_HAL
Image Path: \Driver\ACPI_HAL
Address: 0x81E35000        Size: 3903488        File Visible: -        Signed: -
Status: -

Name: afd.sys
Image Path: C:\Windows\system32\drivers\afd.sys
Address: 0x9040A000        Size: 294912        File Visible: -        Signed: -
Status: -

Name: aswFsBlk.SYS
Image Path: C:\Windows\System32\Drivers\aswFsBlk.SYS
Address: 0x90DAE000        Size: 11008        File Visible: -        Signed: -
Status: -

Name: aswMonFlt.sys
Image Path: C:\Windows\system32\drivers\aswMonFlt.sys
Address: 0x90D97000        Size: 94208        File Visible: -        Signed: -
Status: -

Name: aswRdr.SYS
Image Path: C:\Windows\System32\Drivers\aswRdr.SYS
Address: 0x90452000        Size: 16640        File Visible: -        Signed: -
Status: -

Name: aswSP.SYS
Image Path: C:\Windows\System32\Drivers\aswSP.SYS
Address: 0x9051D000        Size: 158720        File Visible: -        Signed: -
Status: -

Name: aswTdi.SYS
Image Path: C:\Windows\System32\Drivers\aswTdi.SYS
Address: 0x8FDF4000        Size: 39936        File Visible: -        Signed: -
Status: -

Name: Beep.SYS
Image Path: C:\Windows\System32\Drivers\Beep.SYS
Address: 0x8FD7E000        Size: 28672        File Visible: -        Signed: -
Status: -

Name: BOOTVID.dll
Image Path: C:\Windows\system32\BOOTVID.dll
Address: 0x80490000        Size: 32768        File Visible: -        Signed: -
Status: -

Name: bowser.sys
Image Path: C:\Windows\system32\DRIVERS\bowser.sys
Address: 0x9F19A000        Size: 102400        File Visible: -        Signed: -
Status: -

Name: cdd.dll
Image Path: C:\Windows\System32\cdd.dll
Address: 0x99080000        Size: 57344        File Visible: -        Signed: -
Status: -

Name: cdfs.sys
Image Path: C:\Windows\system32\DRIVERS\cdfs.sys
Address: 0xA1DA7000        Size: 90112        File Visible: -        Signed: -
Status: -

Name: cdrbsdrv.SYS
Image Path: C:\Windows\System32\Drivers\cdrbsdrv.SYS
Address: 0x8F3F6000        Size: 33408        File Visible: -        Signed: -
Status: -

Name: cdrom.sys
Image Path: C:\Windows\system32\DRIVERS\cdrom.sys
Address: 0x8F181000        Size: 98304        File Visible: -        Signed: -
Status: -

Name: CI.dll
Image Path: C:\Windows\system32\CI.dll
Address: 0x804D9000        Size: 917504        File Visible: -        Signed: -
Status: -

Name: CLASSPNP.SYS
Image Path: C:\Windows\system32\drivers\CLASSPNP.SYS
Address: 0x8AF9D000        Size: 135168        File Visible: -        Signed: -
Status: -

Name: CLFS.SYS
Image Path: C:\Windows\system32\CLFS.SYS
Address: 0x80498000        Size: 266240        File Visible: -        Signed: -
Status: -

Name: crashdmp.sys
Image Path: C:\Windows\System32\Drivers\crashdmp.sys
Address: 0x90D56000        Size: 53248        File Visible: -        Signed: -
Status: -

Name: crcdisk.sys
Image Path: C:\Windows\system32\drivers\crcdisk.sys
Address: 0x8AFBE000        Size: 36864        File Visible: -        Signed: -
Status: -

Name: dfsc.sys
Image Path: C:\Windows\System32\Drivers\dfsc.sys
Address: 0x90506000        Size: 94208        File Visible: -        Signed: -
Status: -

Name: disk.sys
Image Path: C:\Windows\system32\drivers\disk.sys
Address: 0x8AF8C000        Size: 69632        File Visible: -        Signed: -
Status: -

Name: drmk.sys
Image Path: C:\Windows\system32\drivers\drmk.sys
Address: 0x8FC6B000        Size: 151552        File Visible: -        Signed: -
Status: -

Name: dump_iaStor.sys
Image Path: C:\Windows\System32\Drivers\dump_iaStor.sys
Address: 0x8AD0B000        Size: 815104        File Visible: No        Signed: -
Status: -

Name: Dxapi.sys
Image Path: C:\Windows\System32\drivers\Dxapi.sys
Address: 0x90D63000        Size: 40960        File Visible: -        Signed: -
Status: -

Name: dxgkrnl.sys
Image Path: C:\Windows\System32\drivers\dxgkrnl.sys
Address: 0x8F202000        Size: 659456        File Visible: -        Signed: -
Status: -

Name: e1e6032.sys
Image Path: C:\Windows\system32\DRIVERS\e1e6032.sys
Address: 0x8F2AF000        Size: 237568        File Visible: -        Signed: -
Status: -

Name: ecache.sys
Image Path: C:\Windows\System32\drivers\ecache.sys
Address: 0x8AF65000        Size: 159744        File Visible: -        Signed: -
Status: -

Name: fastfat.SYS
Image Path: C:\Windows\System32\Drivers\fastfat.SYS
Address: 0x90D2E000        Size: 163840        File Visible: -        Signed: -
Status: -

Name: fastfat.SYS
Image Path: C:\Windows\System32\Drivers\fastfat.SYS
Address: 0x90D2E000        Size: 163840        File Visible: -        Signed: -
Status: Hidden from the Windows API!

Name: fileinfo.sys
Image Path: C:\Windows\system32\drivers\fileinfo.sys
Address: 0x8A901000        Size: 65536        File Visible: -        Signed: -
Status: -

Name: fltmgr.sys
Image Path: C:\Windows\system32\drivers\fltmgr.sys
Address: 0x8A8CF000        Size: 204800        File Visible: -        Signed: -
Status: -

Name: Fs_Rec.SYS
Image Path: C:\Windows\System32\Drivers\Fs_Rec.SYS
Address: 0x8FD6E000        Size: 36864        File Visible: -        Signed: -
Status: -

Name: fwpkclnt.sys
Image Path: C:\Windows\System32\drivers\fwpkclnt.sys
Address: 0x8ACF0000        Size: 110592        File Visible: -        Signed: -
Status: -

Name: GEARAspiWDM.sys
Image Path: C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
Address: 0x8F199000        Size: 21120        File Visible: -        Signed: -
Status: -

Name: hal.dll
Image Path: C:\Windows\system32\hal.dll
Address: 0x81E02000        Size: 208896        File Visible: -        Signed: -
Status: -

Name: HDAudBus.sys
Image Path: C:\Windows\system32\DRIVERS\HDAudBus.sys
Address: 0x8F341000        Size: 577536        File Visible: -        Signed: -
Status: -

Name: HIDCLASS.SYS
Image Path: C:\Windows\system32\DRIVERS\HIDCLASS.SYS
Address: 0x9054D000        Size: 65536        File Visible: -        Signed: -
Status: -

Name: HIDPARSE.SYS
Image Path: C:\Windows\system32\DRIVERS\HIDPARSE.SYS
Address: 0x8FD8E000        Size: 28672        File Visible: -        Signed: -
Status: -

Name: hidusb.sys
Image Path: C:\Windows\system32\DRIVERS\hidusb.sys
Address: 0x90544000        Size: 36864        File Visible: -        Signed: -
Status: -

Name: HTTP.sys
Image Path: C:\Windows\system32\drivers\HTTP.sys
Address: 0x9F110000        Size: 446464        File Visible: -        Signed: -
Status: -

Name: iaStor.sys
Image Path: C:\Windows\system32\DRIVERS\iaStor.sys
Address: 0x8A808000        Size: 815104        File Visible: -        Signed: -
Status: -

Name: intelppm.sys
Image Path: C:\Windows\system32\DRIVERS\intelppm.sys
Address: 0x8AFE8000        Size: 61440        File Visible: -        Signed: -
Status: -

Name: kbdclass.sys
Image Path: C:\Windows\system32\DRIVERS\kbdclass.sys
Address: 0x8ADF5000        Size: 45056        File Visible: -        Signed: -
Status: -

Name: kbdhid.sys
Image Path: C:\Windows\system32\DRIVERS\kbdhid.sys
Address: 0x90D1D000        Size: 36864        File Visible: -        Signed: -
Status: -

Name: kdcom.dll
Image Path: C:\Windows\system32\kdcom.dll
Address: 0x80408000        Size: 28672        File Visible: -        Signed: -
Status: -

Name: ks.sys
Image Path: C:\Windows\system32\DRIVERS\ks.sys
Address: 0x8A99B000        Size: 172032        File Visible: -        Signed: -
Status: -

Name: ksecdd.sys
Image Path: C:\Windows\System32\Drivers\ksecdd.sys
Address: 0x8A91A000        Size: 462848        File Visible: -        Signed: -
Status: -

Name: lltdio.sys
Image Path: C:\Windows\system32\DRIVERS\lltdio.sys
Address: 0x9F0B9000        Size: 65536        File Visible: -        Signed: -
Status: -

Name: luafv.sys
Image Path: C:\Windows\system32\drivers\luafv.sys
Address: 0x90D7C000        Size: 110592        File Visible: -        Signed: -
Status: -

Name: LVPr2Mon.sys
Image Path: C:\Windows\system32\DRIVERS\LVPr2Mon.sys
Address: 0xA1DA2000        Size: 18944        File Visible: -        Signed: -
Status: -

Name: lvrs.sys
Image Path: C:\Windows\system32\DRIVERS\lvrs.sys
Address: 0x90C85000        Size: 621184        File Visible: -        Signed: -
Status: -

Name: LVUSBSta.sys
Image Path: C:\Windows\system32\drivers\LVUSBSta.sys
Address: 0x8FD4E000        Size: 35072        File Visible: -        Signed: -
Status: -

Name: lvuvc.sys
Image Path: C:\Windows\system32\DRIVERS\lvuvc.sys
Address: 0x90803000        Size: 4651904        File Visible: -        Signed: -
Status: -

Name: mcupdate_GenuineIntel.dll
Image Path: C:\Windows\system32\mcupdate_GenuineIntel.dll
Address: 0x8040F000        Size: 458752        File Visible: -        Signed: -
Status: -

Name: monitor.sys
Image Path: C:\Windows\system32\DRIVERS\monitor.sys
Address: 0x90D6D000        Size: 61440        File Visible: -        Signed: -
Status: -

Name: mouclass.sys
Image Path: C:\Windows\system32\DRIVERS\mouclass.sys
Address: 0x8AA00000        Size: 45056        File Visible: -        Signed: -
Status: -

Name: mouhid.sys
Image Path: C:\Windows\system32\DRIVERS\mouhid.sys
Address: 0x90D26000        Size: 32768        File Visible: -        Signed: -
Status: -

Name: mountmgr.sys
Image Path: C:\Windows\System32\drivers\mountmgr.sys
Address: 0x8077A000        Size: 65536        File Visible: -        Signed: -
Status: -

Name: mpsdrv.sys
Image Path: C:\Windows\System32\drivers\mpsdrv.sys
Address: 0x9F1B3000        Size: 86016        File Visible: -        Signed: -
Status: -

Name: mrxdav.sys
Image Path: C:\Windows\system32\drivers\mrxdav.sys
Address: 0x9F1C8000        Size: 135168        File Visible: -        Signed: -
Status: -

Name: mrxsmb.sys
Image Path: C:\Windows\system32\DRIVERS\mrxsmb.sys
Address: 0x90DB1000        Size: 126976        File Visible: -        Signed: -
Status: -

Name: mrxsmb10.sys
Image Path: C:\Windows\system32\DRIVERS\mrxsmb10.sys
Address: 0x9055D000        Size: 233472        File Visible: -        Signed: -
Status: -

Name: mrxsmb20.sys
Image Path: C:\Windows\system32\DRIVERS\mrxsmb20.sys
Address: 0x90DD0000        Size: 98304        File Visible: -        Signed: -
Status: -

Name: Msfs.SYS
Image Path: C:\Windows\System32\Drivers\Msfs.SYS
Address: 0x8FDD2000        Size: 45056        File Visible: -        Signed: -
Status: -

Name: msisadrv.sys
Image Path: C:\Windows\system32\drivers\msisadrv.sys
Address: 0x806E3000        Size: 32768        File Visible: -        Signed: -
Status: -

Name: msiscsi.sys
Image Path: C:\Windows\system32\DRIVERS\msiscsi.sys
Address: 0x8F19F000        Size: 192512        File Visible: -        Signed: -
Status: -

Name: msrpc.sys
Image Path: C:\Windows\system32\drivers\msrpc.sys
Address: 0x8AB18000        Size: 176128        File Visible: -        Signed: -
Status: -

Name: mssmbios.sys
Image Path: C:\Windows\system32\DRIVERS\mssmbios.sys
Address: 0x8A9C5000        Size: 40960        File Visible: -        Signed: -
Status: -

Name: mup.sys
Image Path: C:\Windows\System32\Drivers\mup.sys
Address: 0x8AF56000        Size: 61440        File Visible: -        Signed: -
Status: -

Name: ndis.sys
Image Path: C:\Windows\system32\drivers\ndis.sys
Address: 0x8AA0D000        Size: 1093632        File Visible: -        Signed: -
Status: -

Name: ndistapi.sys
Image Path: C:\Windows\system32\DRIVERS\ndistapi.sys
Address: 0x8F1F0000        Size: 45056        File Visible: -        Signed: -
Status: -

Name: ndisuio.sys
Image Path: C:\Windows\system32\DRIVERS\ndisuio.sys
Address: 0x9F0F3000        Size: 40960        File Visible: -        Signed: -
Status: -

Name: ndiswan.sys
Image Path: C:\Windows\system32\DRIVERS\ndiswan.sys
Address: 0x8ADD2000        Size: 143360        File Visible: -        Signed: -
Status: -

Name: NDProxy.SYS
Image Path: C:\Windows\System32\Drivers\NDProxy.SYS
Address: 0x8A9DC000        Size: 69632        File Visible: -        Signed: -
Status: -

Name: netbios.sys
Image Path: C:\Windows\system32\DRIVERS\netbios.sys
Address: 0x9049F000        Size: 57344        File Visible: -        Signed: -
Status: -

Name: netbt.sys
Image Path: C:\Windows\System32\DRIVERS\netbt.sys
Address: 0x90457000        Size: 204800        File Visible: -        Signed: -
Status: -

Name: NETIO.SYS
Image Path: C:\Windows\system32\drivers\NETIO.SYS
Address: 0x8AB43000        Size: 241664        File Visible: -        Signed: -
Status: -

Name: netr28u.sys
Image Path: C:\Windows\system32\DRIVERS\netr28u.sys
Address: 0x8FCA7000        Size: 589824        File Visible: -        Signed: -
Status: -

Name: Npfs.SYS
Image Path: C:\Windows\System32\Drivers\Npfs.SYS
Address: 0x8FDDD000        Size: 57344        File Visible: -        Signed: -
Status: -

Name: nsiproxy.sys
Image Path: C:\Windows\system32\drivers\nsiproxy.sys
Address: 0x904FC000        Size: 40960        File Visible: -        Signed: -
Status: -

Name: Ntfs.sys
Image Path: C:\Windows\System32\Drivers\Ntfs.sys
Address: 0x8AE05000        Size: 1114112        File Visible: -        Signed: -
Status: -

Name: ntkrnlpa.exe
Image Path: C:\Windows\system32\ntkrnlpa.exe
Address: 0x81E35000        Size: 3903488        File Visible: -        Signed: -
Status: -

Name: Null.SYS
Image Path: C:\Windows\System32\Drivers\Null.SYS
Address: 0x8FD77000        Size: 28672        File Visible: -        Signed: -
Status: -

Name: nvBridge.kmd
Image Path: C:\Windows\system32\DRIVERS\nvBridge.kmd
Address: 0x8F165000        Size: 8192        File Visible: -        Signed: -
Status: -

Name: nvlddmkm.sys
Image Path: C:\Windows\system32\DRIVERS\nvlddmkm.sys
Address: 0x8EA03000        Size: 7738816        File Visible: -        Signed: -
Status: -

Name: nwifi.sys
Image Path: C:\Windows\system32\DRIVERS\nwifi.sys
Address: 0x9F0C9000        Size: 172032        File Visible: -        Signed: -
Status: -

Name: ohci1394.sys
Image Path: C:\Windows\system32\DRIVERS\ohci1394.sys
Address: 0x8F3CE000        Size: 62208        File Visible: -        Signed: -
Status: -

Name: pacer.sys
Image Path: C:\Windows\system32\DRIVERS\pacer.sys
Address: 0x90489000        Size: 90112        File Visible: -        Signed: -
Status: -

Name: partmgr.sys
Image Path: C:\Windows\System32\drivers\partmgr.sys
Address: 0x80712000        Size: 61440        File Visible: -        Signed: -
Status: -

Name: pci.sys
Image Path: C:\Windows\system32\drivers\pci.sys
Address: 0x806EB000        Size: 159744        File Visible: -        Signed: -
Status: -

Name: peauth.sys
Image Path: C:\Windows\system32\drivers\peauth.sys
Address: 0xA1C5B000        Size: 909312        File Visible: -        Signed: -
Status: -

Name: PnpManager
Image Path: \Driver\PnpManager
Address: 0x81E35000        Size: 3903488        File Visible: -        Signed: -
Status: -

Name: portcls.sys
Image Path: C:\Windows\system32\drivers\portcls.sys
Address: 0x8FC3E000        Size: 184320        File Visible: -        Signed: -
Status: -

Name: PSHED.dll
Image Path: C:\Windows\system32\PSHED.dll
Address: 0x8047F000        Size: 69632        File Visible: -        Signed: -
Status: -

Name: PxHelp20.sys
Image Path: C:\Windows\System32\Drivers\PxHelp20.sys
Address: 0x8A911000        Size: 36320        File Visible: -        Signed: -
Status: -

Name: rasacd.sys
Image Path: C:\Windows\System32\DRIVERS\rasacd.sys
Address: 0x8FDEB000        Size: 36864        File Visible: -        Signed: -
Status: -

Name: rasl2tp.sys
Image Path: C:\Windows\system32\DRIVERS\rasl2tp.sys
Address: 0x8F1D9000        Size: 94208        File Visible: -        Signed: -
Status: -

Name: raspppoe.sys
Image Path: C:\Windows\system32\DRIVERS\raspppoe.sys
Address: 0x8ABBF000        Size: 61440        File Visible: -        Signed: -
Status: -

Name: raspptp.sys
Image Path: C:\Windows\system32\DRIVERS\raspptp.sys
Address: 0x8ABCE000        Size: 81920        File Visible: -        Signed: -
Status: -

Name: rassstp.sys
Image Path: C:\Windows\system32\DRIVERS\rassstp.sys
Address: 0x8ABE2000        Size: 86016        File Visible: -        Signed: -
Status: -

Name: RAW
Image Path: \FileSystem\RAW
Address: 0x81E35000        Size: 3903488        File Visible: -        Signed: -
Status: -

Name: rdbss.sys
Image Path: C:\Windows\system32\DRIVERS\rdbss.sys
Address: 0x904C0000        Size: 245760        File Visible: -        Signed: -
Status: -

Name: RDPCDD.sys
Image Path: C:\Windows\System32\DRIVERS\RDPCDD.sys
Address: 0x8FDC2000        Size: 32768        File Visible: -        Signed: -
Status: -

Name: rdpencdd.sys
Image Path: C:\Windows\system32\drivers\rdpencdd.sys
Address: 0x8FDCA000        Size: 32768        File Visible: -        Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0xA1DD9000        Size: 49152        File Visible: No        Signed: -
Status: -

Name: rspndr.sys
Image Path: C:\Windows\system32\DRIVERS\rspndr.sys
Address: 0x9F0FD000        Size: 77824        File Visible: -        Signed: -
Status: -

Name: RTKVHDA.sys
Image Path: C:\Windows\system32\drivers\RTKVHDA.sys
Address: 0x8FA08000        Size: 2315072        File Visible: -        Signed: -
Status: -

Name: secdrv.SYS
Image Path: C:\Windows\System32\Drivers\secdrv.SYS
Address: 0xA1D39000        Size: 40960        File Visible: -        Signed: -
Status: -

Name: serenum.sys
Image Path: C:\Windows\system32\DRIVERS\serenum.sys
Address: 0x8F3EC000        Size: 40960        File Visible: -        Signed: -
Status: -

Name: serial.sys
Image Path: C:\Windows\system32\DRIVERS\serial.sys
Address: 0x8F167000        Size: 106496        File Visible: -        Signed: -
Status: -

Name: smb.sys
Image Path: C:\Windows\system32\DRIVERS\smb.sys
Address: 0x807D5000        Size: 81920        File Visible: -        Signed: -
Status: -

Name: spldr.sys
Image Path: C:\Windows\System32\Drivers\spldr.sys
Address: 0x8AF4E000        Size: 32768        File Visible: -        Signed: -
Status: -

Name: spsys.sys
Image Path: C:\Windows\system32\drivers\spsys.sys
Address: 0x9F009000        Size: 720896        File Visible: -        Signed: -
Status: -

Name: srv.sys
Image Path: C:\Windows\System32\DRIVERS\srv.sys
Address: 0xA1C0D000        Size: 319488        File Visible: -        Signed: -
Status: -

Name: srv2.sys
Image Path: C:\Windows\System32\DRIVERS\srv2.sys
Address: 0x90596000        Size: 159744        File Visible: -        Signed: -
Status: -

Name: srvnet.sys
Image Path: C:\Windows\System32\DRIVERS\srvnet.sys
Address: 0x9F17D000        Size: 118784        File Visible: -        Signed: -
Status: -

Name: storport.sys
Image Path: C:\Windows\system32\DRIVERS\storport.sys
Address: 0x8AB7E000        Size: 266240        File Visible: -        Signed: -
Status: -

Name: swenum.sys
Image Path: C:\Windows\system32\DRIVERS\swenum.sys
Address: 0x8F200000        Size: 4992        File Visible: -        Signed: -
Status: -

Name: tcpip.sys
Image Path: C:\Windows\System32\drivers\tcpip.sys
Address: 0x8AC06000        Size: 958464        File Visible: -        Signed: -
Status: -

Name: tcpipreg.sys
Image Path: C:\Windows\System32\drivers\tcpipreg.sys
Address: 0xA1D43000        Size: 49152        File Visible: -        Signed: -
Status: -

Name: TDI.SYS
Image Path: C:\Windows\system32\DRIVERS\TDI.SYS
Address: 0x8F1CE000        Size: 45056        File Visible: -        Signed: -
Status: -

Name: tdx.sys
Image Path: C:\Windows\system32\DRIVERS\tdx.sys
Address: 0x807BF000        Size: 90112        File Visible: -        Signed: -
Status: -

Name: termdd.sys
Image Path: C:\Windows\system32\DRIVERS\termdd.sys
Address: 0x8A98B000        Size: 65536        File Visible: -        Signed: -
Status: -

Name: TSDDD.dll
Image Path: C:\Windows\System32\TSDDD.dll
Address: 0x99060000        Size: 36864        File Visible: -        Signed: -
Status: -

Name: tunmp.sys
Image Path: C:\Windows\system32\DRIVERS\tunmp.sys
Address: 0x8AFDF000        Size: 36864        File Visible: -        Signed: -
Status: -

Name: tunnel.sys
Image Path: C:\Windows\system32\DRIVERS\tunnel.sys
Address: 0x8AFD4000        Size: 45056        File Visible: -        Signed: -
Status: -

Name: umbus.sys
Image Path: C:\Windows\system32\DRIVERS\umbus.sys
Address: 0x8A9CF000        Size: 53248        File Visible: -        Signed: -
Status: -

Name: usbaapl.sys
Image Path: C:\Windows\System32\Drivers\usbaapl.sys
Address: 0xA1DBD000        Size: 57344        File Visible: -        Signed: -
Status: -

Name: usbaudio.sys
Image Path: C:\Windows\system32\drivers\usbaudio.sys
Address: 0x90C73000        Size: 73216        File Visible: -        Signed: -
Status: -

Name: usbccgp.sys
Image Path: C:\Windows\system32\DRIVERS\usbccgp.sys
Address: 0x8FD37000        Size: 94208        File Visible: -        Signed: -
Status: -

Name: USBD.SYS
Image Path: C:\Windows\system32\DRIVERS\USBD.SYS
Address: 0x8FCA5000        Size: 8192        File Visible: -        Signed: -
Status: -

Name: usbehci.sys
Image Path: C:\Windows\system32\DRIVERS\usbehci.sys
Address: 0x8F332000        Size: 61440        File Visible: -        Signed: -
Status: -

Name: usbhub.sys
Image Path: C:\Windows\system32\DRIVERS\usbhub.sys
Address: 0x8078A000        Size: 217088        File Visible: -        Signed: -
Status: -

Name: USBPORT.SYS
Image Path: C:\Windows\system32\DRIVERS\USBPORT.SYS
Address: 0x8F2F4000        Size: 253952        File Visible: -        Signed: -
Status: -

Name: USBSTOR.SYS
Image Path: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Address: 0x8FC90000        Size: 86016        File Visible: -        Signed: -
Status: -

Name: usbuhci.sys
Image Path: C:\Windows\system32\DRIVERS\usbuhci.sys
Address: 0x8F2E9000        Size: 45056        File Visible: -        Signed: -
Status: -

Name: vga.sys
Image Path: C:\Windows\System32\drivers\vga.sys
Address: 0x8FD95000        Size: 49152        File Visible: -        Signed: -
Status: -

Name: VIDEOPRT.SYS
Image Path: C:\Windows\System32\drivers\VIDEOPRT.SYS
Address: 0x8FDA1000        Size: 135168        File Visible: -        Signed: -
Status: -

Name: volmgr.sys
Image Path: C:\Windows\system32\drivers\volmgr.sys
Address: 0x80721000        Size: 61440        File Visible: -        Signed: -
Status: -

Name: volmgrx.sys
Image Path: C:\Windows\System32\drivers\volmgrx.sys
Address: 0x80730000        Size: 303104        File Visible: -        Signed: -
Status: -

Name: volsnap.sys
Image Path: C:\Windows\system32\drivers\volsnap.sys
Address: 0x8AF15000        Size: 233472        File Visible: -        Signed: -
Status: -

Name: wanarp.sys
Image Path: C:\Windows\system32\DRIVERS\wanarp.sys
Address: 0x904AD000        Size: 77824        File Visible: -        Signed: -
Status: -

Name: watchdog.sys
Image Path: C:\Windows\System32\drivers\watchdog.sys
Address: 0x8F2A3000        Size: 49152        File Visible: -        Signed: -
Status: -

Name: Wdf01000.sys
Image Path: C:\Windows\system32\drivers\Wdf01000.sys
Address: 0x8060B000        Size: 507904        File Visible: -        Signed: -
Status: -

Name: WDFLDR.SYS
Image Path: C:\Windows\system32\drivers\WDFLDR.SYS
Address: 0x80687000        Size: 53248        File Visible: -        Signed: -
Status: -

Name: Win32k
Image Path: \Driver\Win32k
Address: 0x98E40000        Size: 2109440        File Visible: -        Signed: -
Status: -

Name: win32k.sys
Image Path: C:\Windows\System32\win32k.sys
Address: 0x98E40000        Size: 2109440        File Visible: -        Signed: -
Status: -

Name: WMILIB.SYS
Image Path: C:\Windows\system32\drivers\WMILIB.SYS
Address: 0x806DA000        Size: 36864        File Visible: -        Signed: -
Status: -

Name: WMIxWDM
Image Path: \Driver\WMIxWDM
Address: 0x81E35000        Size: 3903488        File Visible: -        Signed: -
Status: -

Name: wpdusb.sys
Image Path: C:\Windows\system32\DRIVERS\wpdusb.sys
Address: 0xA1DCB000        Size: 57344        File Visible: -        Signed: -
Status: -

Name: WUDFPf.sys
Image Path: C:\Windows\system32\DRIVERS\WUDFPf.sys
Address: 0xA1D90000        Size: 73728        File Visible: -        Signed: -
Status: -

Name: WUDFRd.sys
Image Path: C:\Windows\system32\DRIVERS\WUDFRd.sys
Address: 0xA1D7B000        Size: 83328        File Visible: -        Signed: -
Status: -
Könnt Ihr damit etwas anfangen?
Freue mich über weitere Infos.

Danke und beste Grüße,
Donselmo

Donselmo 12.09.2010 15:55
Hallo,

in der Hoffnung auf eine Antwort auf mein skizziertes Problemchen hier noch mal ein paar Hinweise: Mit keinem der angebotenen Schutzprogramme bekomme ich einen Zugriff auf meine IE-Historie. WO sind diese Daten abgelegt? Wo kann ich die Historie, die sich ja - wie gesagt - immer wieder von selbst "regeneriert" und nicht löschen lässt, einsehen? Welches Programm blockiert im IE Zugriff und Löschung der IE-Historie? Da ist irgendwo der "Wurm" drin...

Danke vorab für einen TIPP,
Donselmo

Donselmo 03.10.2010 11:27
Hallo, hilfe, kann mir denn tatsächlich niemend hier weiterhelfen?!

Viele Grüße,
Donselmo

kira 04.10.2010 06:07
Zitat:
Zitat von Donselmo (Beitrag 567165)
WO sind diese Daten abgelegt? Wo kann ich die Historie, die sich ja - wie gesagt - immer wieder von selbst "regeneriert" und nicht löschen lässt, einsehen? Welches Programm blockiert im IE Zugriff und Löschung der IE-Historie?
IE starten-> auf "Stern" neben Favoriten" klicken...

- vlt das Programm - McAfee Security Scan Plus - Einstellung überprüfen, oder deinstallieren...?

Zitat:
Zitat von Donselmo (Beitrag 557825)
...Die Seite, die sich unter dieser URL öffnet, ist einfach so eine Erotik-Webcam-Seite, die ich jedoch bewusst(!) nie bestellt bzw. gebookmarkt habe. Vor allem ist es irritierend, dass sie immer wieder im Verlauf erscheint, ohne dass ich sie aufrufe und sich auch bei wiederholtem Löschen immer wieder von selbst im Verlauf positioniert.
** Addons bzw. Plugins installiert?
- probiers mal hiermit - Add-Ons deaktivieren bzw. auch deinstallieren::
-> http://windows.microsoft.com/de-AT/w...sked-questions
-> http://iefaq.info/index.php?action=a...=59&artlang=de
-> http://support.microsoft.com/kb/936213/de

1.
läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit)
Achtung!:
WENN GMER NICHT AUSGEFÜHRT WERDEN KANN ODER PROBMLEME VERURSACHT, fahre mit dem nächsten Punkt fort!- Es ist NICHT sinnvoll einen zweiten Versuch zu starten!
Um einen tieferen Einblick in dein System, um eine mögliche Infektion mit einem Rootkit/Info v.wikipedia.org) aufzuspüren, werden wir ein Tool - Gmer - einsetzen :
  • - also lade Dir Gmer herunter und entpacke es auf deinen Desktop
    - starte gmer.exe
    - [b]schließe alle Programme, ausserdem Antiviren und andere Schutzprogramme usw müssen deaktiviert sein, keine Verbindung zum Internet, WLAN auch trennen)
    - bitte nichts am Pc machen während der Scan läuft!
    - klicke auf "Scan", um das Tool zu starten
    - wenn der Scan fertig ist klicke auf "Copy" (das Log wird automatisch in die Zwischenablage kopiert) und mit STRG + V musst Du gleich da einfügen
    - mit "Ok" wird Gmer beendet.
    - das Log aus der Zwischenablage hier in Deinem Thread vollständig hineinkopieren

** keine Verbindung zu einem Netzwerk und Internet - WLAN nicht vergessen
Wenn der Scan beendet ist, bitte alle Programme und Tools wieder aktivieren!

2.
läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit)
Lade und installiere das Tool RootRepeal herunter
  • setze einen Hacken bei: "Drivers"-> "Scan"-> Save Report"...
  • "Stealth Objects" -> "Scan"-> Save Report"...
  • "Hidden Services" -> "Scan"-> Save Report"...
  • speichere das Logfile als "RootRepeal.txt" auf dem Desktop und Kopiere den Inhalt hier in den Thread


Alle Zeitangaben in WEZ +1. Es ist jetzt 04:59 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131