| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Google leitet mich auf werbeseiten umWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
14.06.2012, 14:59
| #1 |
 |  Google leitet mich auf werbeseiten um Hallo, seit kurzer Zeit kommt bei Google Suche nicht mehr der link den man sucht sondern es werden Werbeseiten angezeigt. Desweiteren kommen unten rechts Werbeeinblendungen. Habe versucht schon mit Malwarbytes & HouseCall den Fehler zu beheben Es wurden Troj_Gen gefunden und bereits gelöscht. Aber das Problem besteht leider immer noch Wir sind ein kleines Unternehmen und ich hoffe Sie können mir helfen mfg stefgig12 |
|
14.06.2012, 15:08
| #2 |
  | Google leitet mich auf werbeseiten um Hi,
__________________Rootkit... Ein paar mehr Angaben (Windowsversion etc.) wären schön... TDSS-Killer Download und Anweisung unter: Wie werden Schadprogramme der Familie Rootkit.Win32.TDSS bekämpft? Entpacke alle Dateien in einem eigenen Verzeichnis (z. B: C:\TDSS)! Aufruf über den Explorer duch Doppelklick auf die TDSSKiller.exe. Stelle den Killer wir folgt ein:  Dann den Scan starten durch (Start Scan). Wenn der Scan fertig ist bitte "Report" anwählen (eventuelle Funde erstmal mit Skip übergehen). Es öffnet sich ein Fenster, den Text abkopieren und hier posten... OTL Lade Dir OTL von Oldtimer herunter (http://filepony.de/download-otl/) und speichere es auf Deinem Desktop
chris
__________________ |
|
14.06.2012, 15:30
| #3 |
| | Google leitet mich auf werbeseiten um Hallo,
__________________Hier die Angabe Windows XP SP3 Code:
ATTFilter
16:22:49.0640 3384 TDSS rootkit removing tool 2.7.39.0 Jun 14 2012 08:11:46
16:22:49.0781 3384 ============================================================
16:22:49.0781 3384 Current date / time: 2012/06/14 16:22:49.0781
16:22:49.0781 3384 SystemInfo:
16:22:49.0781 3384
16:22:49.0781 3384 OS Version: 5.1.2600 ServicePack: 3.0
16:22:49.0781 3384 Product type: Workstation
16:22:49.0781 3384 ComputerName: NPC18
16:22:49.0781 3384 UserName: npc18
16:22:49.0781 3384 Windows directory: C:\WINDOWS
16:22:49.0781 3384 System windows directory: C:\WINDOWS
16:22:49.0781 3384 Processor architecture: Intel x86
16:22:49.0781 3384 Number of processors: 2
16:22:49.0781 3384 Page size: 0x1000
16:22:49.0781 3384 Boot type: Normal boot
16:22:49.0781 3384 ============================================================
16:22:51.0656 3384 Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
16:22:51.0656 3384 ============================================================
16:22:51.0656 3384 \Device\Harddisk0\DR0:
16:22:51.0656 3384 MBR partitions:
16:22:51.0656 3384 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x5E6C014
16:22:51.0656 3384 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x5E6FF0E, BlocksNum 0x369E5B3
16:22:51.0656 3384 ============================================================
16:22:51.0718 3384 D: <-> \Device\Harddisk0\DR0\Partition1
16:22:51.0765 3384 C: <-> \Device\Harddisk0\DR0\Partition0
16:22:51.0765 3384 ============================================================
16:22:51.0765 3384 Initialize success
16:22:51.0765 3384 ============================================================
16:23:23.0500 1448 ============================================================
16:23:23.0500 1448 Scan started
16:23:23.0500 1448 Mode: Manual; SigCheck; TDLFS;
16:23:23.0500 1448 ============================================================
16:23:23.0843 1448 Abiosdsk - ok
16:23:23.0906 1448 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS
16:23:25.0468 1448 abp480n5 - ok
16:23:25.0515 1448 ACPI (95cdd68b6dca09f581b043734854c87d) C:\WINDOWS\system32\DRIVERS\ACPI.sys
16:23:25.0515 1448 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ACPI.sys. Real md5: 95cdd68b6dca09f581b043734854c87d, Fake md5: ac407f1a62c3a300b4f2b5a9f1d55b2c
16:23:25.0515 1448 ACPI ( Virus.Win32.Rloader.a ) - infected
16:23:25.0515 1448 ACPI - detected Virus.Win32.Rloader.a (0)
16:23:25.0546 1448 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
16:23:25.0734 1448 ACPIEC - ok
16:23:25.0828 1448 AcrSch2Svc (1b77cac441b53553db0122468926ad73) C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
16:23:25.0843 1448 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - warning
16:23:25.0843 1448 AcrSch2Svc - detected UnsignedFile.Multi.Generic (1)
16:23:25.0890 1448 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\System32\DRIVERS\adpu160m.sys
16:23:26.0078 1448 adpu160m - ok
16:23:26.0125 1448 adpu320 (5e30228eaebf369c24cd0b87a93a2a4a) C:\WINDOWS\System32\DRIVERS\adpu320.sys
16:23:26.0250 1448 adpu320 - ok
16:23:26.0281 1448 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
16:23:26.0468 1448 aec - ok
16:23:26.0515 1448 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
16:23:26.0609 1448 AFD - ok
16:23:26.0640 1448 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
16:23:26.0828 1448 agp440 - ok
16:23:26.0859 1448 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\System32\DRIVERS\agpCPQ.sys
16:23:27.0046 1448 agpCPQ - ok
16:23:27.0078 1448 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\System32\DRIVERS\aha154x.sys
16:23:27.0187 1448 Aha154x - ok
16:23:27.0203 1448 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\System32\DRIVERS\aic78u2.sys
16:23:27.0421 1448 aic78u2 - ok
16:23:27.0437 1448 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\System32\DRIVERS\aic78xx.sys
16:23:27.0671 1448 aic78xx - ok
16:23:27.0718 1448 ALCXSENS (d3fb0a70fa3e3a62f1b2faa88daabae8) C:\WINDOWS\system32\drivers\ALCXSENS.SYS
16:23:27.0875 1448 ALCXSENS - ok
16:23:27.0937 1448 ALCXWDM (36585ee98345223e2963c8edd27fc40d) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
16:23:28.0062 1448 ALCXWDM - ok
16:23:28.0093 1448 Alerter (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
16:23:28.0281 1448 Alerter - ok
16:23:28.0312 1448 ALG (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
16:23:28.0453 1448 ALG - ok
16:23:28.0500 1448 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\System32\DRIVERS\aliide.sys
16:23:28.0687 1448 AliIde - ok
16:23:28.0718 1448 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\System32\DRIVERS\alim1541.sys
16:23:28.0890 1448 alim1541 - ok
16:23:28.0937 1448 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
16:23:29.0156 1448 amdagp - ok
16:23:29.0203 1448 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\System32\DRIVERS\amsint.sys
16:23:29.0312 1448 amsint - ok
16:23:29.0359 1448 AN983 (e2ad6cc7d407f2b5cb2899775cf84f51) C:\WINDOWS\system32\DRIVERS\AN983.sys
16:23:29.0406 1448 AN983 - ok
16:23:29.0437 1448 AppMgmt (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll
16:23:29.0640 1448 AppMgmt - ok
16:23:29.0656 1448 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\System32\DRIVERS\asc.sys
16:23:29.0875 1448 asc - ok
16:23:29.0890 1448 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\System32\DRIVERS\asc3350p.sys
16:23:30.0000 1448 asc3350p - ok
16:23:30.0015 1448 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\System32\DRIVERS\asc3550.sys
16:23:30.0203 1448 asc3550 - ok
16:23:30.0343 1448 aspnet_state (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
16:23:30.0375 1448 aspnet_state - ok
16:23:30.0406 1448 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:23:30.0546 1448 AsyncMac - ok
16:23:30.0578 1448 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
16:23:30.0718 1448 atapi - ok
16:23:30.0718 1448 Atdisk - ok
16:23:30.0750 1448 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:23:30.0953 1448 Atmarpc - ok
16:23:30.0984 1448 AudioSrv (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
16:23:31.0171 1448 AudioSrv - ok
16:23:31.0218 1448 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
16:23:31.0421 1448 audstub - ok
16:23:31.0453 1448 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
16:23:31.0687 1448 Beep - ok
16:23:31.0734 1448 BITS (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
16:23:31.0953 1448 BITS - ok
16:23:31.0984 1448 bizVSerial (66f655b08eed3230e059d197c8a1969b) C:\WINDOWS\system32\drivers\bizVSerialNT.sys
16:23:32.0046 1448 bizVSerial ( UnsignedFile.Multi.Generic ) - warning
16:23:32.0046 1448 bizVSerial - detected UnsignedFile.Multi.Generic (1)
16:23:32.0125 1448 Bonjour Service (9efe4236f8670846b6e7c5b0eff6e715) C:\Programme\Bonjour\mDNSResponder.exe
16:23:32.0140 1448 Bonjour Service - ok
16:23:32.0187 1448 Browser (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
16:23:32.0343 1448 Browser - ok
16:23:32.0375 1448 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\System32\DRIVERS\cbidf2k.sys
16:23:32.0578 1448 cbidf - ok
16:23:32.0578 1448 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
16:23:32.0750 1448 cbidf2k - ok
16:23:32.0765 1448 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\System32\DRIVERS\cd20xrnt.sys
16:23:32.0859 1448 cd20xrnt - ok
16:23:32.0890 1448 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
16:23:33.0078 1448 Cdaudio - ok
16:23:33.0125 1448 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
16:23:33.0296 1448 Cdfs - ok
16:23:33.0328 1448 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
16:23:33.0500 1448 Cdrom - ok
16:23:33.0515 1448 Changer - ok
16:23:33.0562 1448 CiSvc (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
16:23:33.0734 1448 CiSvc - ok
16:23:33.0796 1448 cjpcsc (cf5cf5aa461883812c1ee234f01779d8) C:\WINDOWS\system32\cjpcsc.exe
16:23:33.0859 1448 cjpcsc ( UnsignedFile.Multi.Generic ) - warning
16:23:33.0859 1448 cjpcsc - detected UnsignedFile.Multi.Generic (1)
16:23:33.0906 1448 cjusb (466d2beca5f06145a3cb2bbe14ace79d) C:\WINDOWS\system32\DRIVERS\cjusb.sys
16:23:33.0968 1448 cjusb - ok
16:23:34.0000 1448 ClipSrv (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
16:23:34.0156 1448 ClipSrv - ok
16:23:34.0281 1448 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:23:34.0437 1448 clr_optimization_v2.0.50727_32 - ok
16:23:34.0515 1448 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:23:34.0609 1448 clr_optimization_v4.0.30319_32 - ok
16:23:34.0625 1448 CmdIde (c687f81290303d90099b027a6474f99f) C:\WINDOWS\System32\DRIVERS\cmdide.sys
16:23:34.0828 1448 CmdIde - ok
16:23:34.0843 1448 COMSysApp - ok
16:23:34.0875 1448 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\System32\DRIVERS\cpqarray.sys
16:23:35.0062 1448 Cpqarray - ok
16:23:35.0093 1448 CryptSvc (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
16:23:35.0250 1448 CryptSvc - ok
16:23:35.0312 1448 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\System32\DRIVERS\dac2w2k.sys
16:23:35.0546 1448 dac2w2k - ok
16:23:35.0562 1448 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\System32\DRIVERS\dac960nt.sys
16:23:35.0750 1448 dac960nt - ok
16:23:35.0812 1448 DcomLaunch (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
16:23:35.0906 1448 DcomLaunch - ok
16:23:35.0953 1448 Dhcp (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
16:23:36.0093 1448 Dhcp - ok
16:23:36.0125 1448 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
16:23:36.0281 1448 Disk - ok
16:23:36.0296 1448 dmadmin - ok
16:23:36.0359 1448 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
16:23:36.0609 1448 dmboot - ok
16:23:36.0656 1448 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
16:23:36.0828 1448 dmio - ok
16:23:36.0859 1448 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
16:23:37.0062 1448 dmload - ok
16:23:37.0093 1448 dmserver (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
16:23:37.0250 1448 dmserver - ok
16:23:37.0281 1448 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
16:23:37.0453 1448 DMusic - ok
16:23:37.0484 1448 Dnscache (8c9ed3b2834aae63081ab2da831c6fe9) C:\WINDOWS\System32\dnsrslvr.dll
16:23:37.0625 1448 Dnscache - ok
16:23:37.0656 1448 Dot3svc (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
16:23:37.0859 1448 Dot3svc - ok
16:23:37.0890 1448 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\System32\DRIVERS\dpti2o.sys
16:23:38.0093 1448 dpti2o - ok
16:23:38.0125 1448 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
16:23:38.0281 1448 drmkaud - ok
16:23:38.0343 1448 DwMirror (383182215a2c238e76b86e3b5ede40eb) C:\WINDOWS\system32\DRIVERS\DamewareMini.sys
16:23:38.0406 1448 DwMirror - ok
16:23:38.0421 1448 DWMRCS - ok
16:23:38.0453 1448 dwvkbd (5a402c57f621114c99f813c6ae7bc37a) C:\WINDOWS\system32\DRIVERS\dwvkbd.sys
16:23:38.0546 1448 dwvkbd - ok
16:23:38.0578 1448 E100B (a6de5342417fec3c0aa8efebb899c431) C:\WINDOWS\system32\DRIVERS\e100b325.sys
16:23:38.0796 1448 E100B - ok
16:23:38.0828 1448 EapHost (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
16:23:39.0015 1448 EapHost - ok
16:23:39.0046 1448 epmntdrv (f07ba56b0235f15eff8f10dc6389c42e) C:\WINDOWS\system32\epmntdrv.sys
16:23:39.0125 1448 epmntdrv ( UnsignedFile.Multi.Generic ) - warning
16:23:39.0125 1448 epmntdrv - detected UnsignedFile.Multi.Generic (1)
16:23:39.0156 1448 ERSvc (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
16:23:39.0312 1448 ERSvc - ok
16:23:39.0343 1448 EuGdiDrv (1f2f4ab15ce03ecc257feb2f6dc5a013) C:\WINDOWS\system32\EuGdiDrv.sys
16:23:39.0375 1448 EuGdiDrv ( UnsignedFile.Multi.Generic ) - warning
16:23:39.0375 1448 EuGdiDrv - detected UnsignedFile.Multi.Generic (1)
16:23:39.0421 1448 Eventlog (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
16:23:39.0437 1448 Eventlog - ok
16:23:39.0484 1448 EventSystem (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\System32\es.dll
16:23:39.0515 1448 EventSystem - ok
16:23:39.0562 1448 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
16:23:39.0718 1448 Fastfat - ok
16:23:39.0765 1448 FastUserSwitchingCompatibility (40602ebfbe06aa075c8e4560743f6883) C:\WINDOWS\System32\shsvcs.dll
16:23:39.0906 1448 FastUserSwitchingCompatibility - ok
16:23:39.0921 1448 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
16:23:40.0078 1448 Fdc - ok
16:23:40.0109 1448 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
16:23:40.0281 1448 Fips - ok
16:23:40.0312 1448 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
16:23:40.0468 1448 Flpydisk - ok
16:23:40.0531 1448 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
16:23:40.0687 1448 FltMgr - ok
16:23:40.0828 1448 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
16:23:40.0859 1448 FontCache3.0.0.0 - ok
16:23:40.0921 1448 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
16:23:41.0109 1448 Fs_Rec - ok
16:23:41.0140 1448 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:23:41.0359 1448 Ftdisk - ok
16:23:41.0390 1448 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
16:23:41.0562 1448 Gpc - ok
16:23:41.0640 1448 helpsvc (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
16:23:41.0796 1448 helpsvc - ok
16:23:41.0812 1448 HidServ - ok
16:23:41.0843 1448 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
16:23:42.0000 1448 HidUsb - ok
16:23:42.0046 1448 hkmsvc (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
16:23:42.0218 1448 hkmsvc - ok
16:23:42.0250 1448 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\System32\DRIVERS\hpn.sys
16:23:42.0421 1448 hpn - ok
16:23:42.0500 1448 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
16:23:42.0562 1448 HTTP - ok
16:23:42.0578 1448 HTTPFilter (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
16:23:42.0750 1448 HTTPFilter - ok
16:23:42.0812 1448 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
16:23:42.0953 1448 i2omgmt - ok
16:23:43.0000 1448 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\System32\DRIVERS\i2omp.sys
16:23:43.0156 1448 i2omp - ok
16:23:43.0187 1448 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:23:43.0359 1448 i8042prt - ok
16:23:43.0453 1448 IDriverT (6f95324909b502e2651442c1548ab12f) C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
16:23:43.0546 1448 IDriverT ( UnsignedFile.Multi.Generic ) - warning
16:23:43.0546 1448 IDriverT - detected UnsignedFile.Multi.Generic (1)
16:23:43.0625 1448 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:23:43.0765 1448 idsvc - ok
16:23:43.0796 1448 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
16:23:43.0968 1448 Imapi - ok
16:23:44.0000 1448 ImapiService (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\System32\imapi.exe
16:23:44.0140 1448 ImapiService - ok
16:23:44.0171 1448 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\System32\DRIVERS\ini910u.sys
16:23:44.0359 1448 ini910u - ok
16:23:44.0406 1448 IntelIde (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\System32\DRIVERS\intelide.sys
16:23:44.0578 1448 IntelIde - ok
16:23:44.0609 1448 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
16:23:44.0765 1448 intelppm - ok
16:23:44.0812 1448 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
16:23:44.0984 1448 ip6fw - ok
16:23:45.0015 1448 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:23:45.0156 1448 IpFilterDriver - ok
16:23:45.0171 1448 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
16:23:45.0328 1448 IpInIp - ok
16:23:45.0375 1448 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
16:23:45.0515 1448 IpNat - ok
16:23:45.0546 1448 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
16:23:45.0718 1448 IPSec - ok
16:23:45.0750 1448 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
16:23:45.0906 1448 IRENUM - ok
16:23:45.0937 1448 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
16:23:46.0093 1448 isapnp - ok
16:23:46.0187 1448 JavaQuickStarterService (381b25dc8e958d905b33130d500bbf29) C:\Programme\Java\jre6\bin\jqs.exe
16:23:46.0218 1448 JavaQuickStarterService - ok
16:23:46.0250 1448 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:23:46.0406 1448 Kbdclass - ok
16:23:46.0437 1448 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
16:23:46.0593 1448 kmixer - ok
16:23:46.0640 1448 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
16:23:46.0750 1448 KSecDD - ok
16:23:46.0796 1448 lanmanserver (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
16:23:46.0859 1448 lanmanserver - ok
16:23:46.0890 1448 lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
16:23:46.0937 1448 lanmanworkstation - ok
16:23:46.0953 1448 lbrtfdc - ok
16:23:47.0000 1448 LmHosts (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
16:23:47.0140 1448 LmHosts - ok
16:23:47.0187 1448 MBAMProtector (fb097bbc1a18f044bd17bd2fccf97865) C:\WINDOWS\system32\drivers\mbam.sys
16:23:47.0218 1448 MBAMProtector - ok
16:23:47.0296 1448 MBAMService (ba400ed640bca1eae5c727ae17c10207) C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
16:23:47.0328 1448 MBAMService - ok
16:23:47.0421 1448 MDM (11f714f85530a2bd134074dc30e99fca) C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
16:23:47.0437 1448 MDM - ok
16:23:47.0453 1448 Messenger (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
16:23:47.0609 1448 Messenger - ok
16:23:47.0656 1448 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
16:23:47.0828 1448 mnmdd - ok
16:23:47.0875 1448 mnmsrvc (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\System32\mnmsrvc.exe
16:23:48.0046 1448 mnmsrvc - ok
16:23:48.0078 1448 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
16:23:48.0250 1448 Modem - ok
16:23:48.0281 1448 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
16:23:48.0453 1448 Mouclass - ok
16:23:48.0484 1448 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
16:23:48.0671 1448 mouhid - ok
16:23:48.0687 1448 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
16:23:48.0859 1448 MountMgr - ok
16:23:48.0906 1448 MozillaMaintenance (6380ff81dd4d78b23398752d2f46ea43) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
16:23:48.0984 1448 MozillaMaintenance - ok
16:23:49.0015 1448 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\System32\DRIVERS\mraid35x.sys
16:23:49.0203 1448 mraid35x - ok
16:23:49.0250 1448 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:23:49.0421 1448 MRxDAV - ok
16:23:49.0500 1448 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:23:49.0656 1448 MRxSmb - ok
16:23:49.0687 1448 MSDTC (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\System32\msdtc.exe
16:23:49.0843 1448 MSDTC - ok
16:23:49.0906 1448 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
16:23:50.0062 1448 Msfs - ok
16:23:50.0078 1448 MSIServer - ok
16:23:50.0109 1448 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
16:23:50.0281 1448 MSKSSRV - ok
16:23:50.0296 1448 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:23:50.0453 1448 MSPCLOCK - ok
16:23:50.0484 1448 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
16:23:50.0640 1448 MSPQM - ok
16:23:50.0687 1448 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:23:50.0828 1448 mssmbios - ok
16:23:50.0890 1448 MSSQL$SQLEXPRESS - ok
16:23:50.0937 1448 MSSQLServerADHelper (adaf062116b4e6d96e44d26486a87af6) C:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe
16:23:50.0968 1448 MSSQLServerADHelper - ok
16:23:51.0000 1448 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
16:23:51.0171 1448 Mup - ok
16:23:51.0218 1448 napagent (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
16:23:51.0437 1448 napagent - ok
16:23:51.0453 1448 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
16:23:51.0640 1448 NDIS - ok
16:23:51.0671 1448 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
16:23:51.0828 1448 NdisTapi - ok
16:23:51.0859 1448 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
16:23:52.0015 1448 Ndisuio - ok
16:23:52.0046 1448 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
16:23:52.0218 1448 NdisWan - ok
16:23:52.0265 1448 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
16:23:52.0359 1448 NDProxy - ok
16:23:52.0406 1448 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
16:23:52.0562 1448 NetBIOS - ok
16:23:52.0625 1448 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
16:23:52.0796 1448 NetBT - ok
16:23:52.0843 1448 NetDDE (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
16:23:53.0031 1448 NetDDE - ok
16:23:53.0031 1448 NetDDEdsdm (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
16:23:53.0171 1448 NetDDEdsdm - ok
16:23:53.0203 1448 Netlogon (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
16:23:53.0359 1448 Netlogon - ok
16:23:53.0406 1448 Netman (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
16:23:53.0546 1448 Netman - ok
16:23:53.0656 1448 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
16:23:53.0703 1448 NetTcpPortSharing - ok
16:23:53.0750 1448 Nla (acd8bd448a74f344d46fcaf21bab92af) C:\WINDOWS\System32\mswsock.dll
16:23:53.0812 1448 Nla - ok
16:23:53.0859 1448 NMSAccess (7aea4df1ca68fd45dd4bbe1f0243ce7f) C:\Programme\CDBurnerXP\NMSAccessU.exe
16:23:53.0875 1448 NMSAccess - ok
16:23:53.0921 1448 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
16:23:54.0093 1448 Npfs - ok
16:23:54.0156 1448 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
16:23:54.0406 1448 Ntfs - ok
16:23:54.0437 1448 NtLmSsp (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
16:23:54.0578 1448 NtLmSsp - ok
16:23:54.0640 1448 NtmsSvc (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
16:23:54.0859 1448 NtmsSvc - ok
16:23:54.0921 1448 ntrtscan (cec052d67b20f5be1d46cb73aa169b38) C:\Programme\Trend Micro\OfficeScan Client\ntrtscan.exe
16:23:54.0968 1448 ntrtscan ( UnsignedFile.Multi.Generic ) - warning
16:23:54.0968 1448 ntrtscan - detected UnsignedFile.Multi.Generic (1)
16:23:55.0031 1448 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
16:23:55.0218 1448 Null - ok
16:23:55.0234 1448 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
16:23:55.0421 1448 NwlnkFlt - ok
16:23:55.0421 1448 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
16:23:55.0609 1448 NwlnkFwd - ok
16:23:55.0671 1448 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
16:23:55.0718 1448 ose - ok
16:23:55.0968 1448 osppsvc (358a9cca612c68eb2f07ddad4ce1d8d7) C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
16:23:56.0375 1448 osppsvc - ok
16:23:56.0593 1448 P3 (a7af0c0860f1c43fc6581ba8a99eabef) C:\WINDOWS\system32\DRIVERS\p3.sys
16:23:56.0781 1448 P3 - ok
16:23:56.0828 1448 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
16:23:57.0000 1448 Parport - ok
16:23:57.0046 1448 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
16:23:57.0203 1448 PartMgr - ok
16:23:57.0234 1448 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
16:23:57.0390 1448 ParVdm - ok
16:23:57.0421 1448 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
16:23:57.0625 1448 PCI - ok
16:23:57.0625 1448 PCIDump - ok
16:23:57.0640 1448 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
16:23:57.0812 1448 PCIIde - ok
16:23:57.0859 1448 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
16:23:58.0046 1448 Pcmcia - ok
16:23:58.0062 1448 PDCOMP - ok
16:23:58.0078 1448 PDFRAME - ok
16:23:58.0093 1448 PDRELI - ok
16:23:58.0109 1448 PDRFRAME - ok
16:23:58.0140 1448 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\System32\DRIVERS\perc2.sys
16:23:58.0328 1448 perc2 - ok
16:23:58.0343 1448 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\System32\DRIVERS\perc2hib.sys
16:23:58.0515 1448 perc2hib - ok
16:23:58.0578 1448 PlugPlay (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
16:23:58.0593 1448 PlugPlay - ok
16:23:58.0625 1448 PolicyAgent (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
16:23:58.0765 1448 PolicyAgent - ok
16:23:58.0796 1448 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
16:23:58.0968 1448 PptpMiniport - ok
16:23:59.0000 1448 Processor (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys
16:23:59.0171 1448 Processor - ok
16:23:59.0187 1448 ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
16:23:59.0328 1448 ProtectedStorage - ok
16:23:59.0343 1448 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
16:23:59.0515 1448 PSched - ok
16:23:59.0578 1448 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
16:23:59.0718 1448 Ptilink - ok
16:23:59.0765 1448 PxHelp20 (1962166e0ceb740704f30fa55ad3d509) C:\WINDOWS\system32\Drivers\PxHelp20.sys
16:23:59.0812 1448 PxHelp20 ( UnsignedFile.Multi.Generic ) - warning
16:23:59.0812 1448 PxHelp20 - detected UnsignedFile.Multi.Generic (1)
16:23:59.0828 1448 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\System32\DRIVERS\ql1080.sys
16:24:00.0015 1448 ql1080 - ok
16:24:00.0031 1448 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\System32\DRIVERS\ql10wnt.sys
16:24:00.0203 1448 Ql10wnt - ok
16:24:00.0234 1448 ql12160 (c7fc707980dd382f92b6d88b2258a0dc) C:\WINDOWS\System32\DRIVERS\ql12160.sys
16:24:00.0328 1448 ql12160 - ok
16:24:00.0343 1448 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\System32\DRIVERS\ql1240.sys
16:24:00.0531 1448 ql1240 - ok
16:24:00.0562 1448 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\System32\DRIVERS\ql1280.sys
16:24:00.0734 1448 ql1280 - ok
16:24:00.0765 1448 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
16:24:00.0906 1448 RasAcd - ok
16:24:00.0953 1448 RasAuto (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
16:24:01.0125 1448 RasAuto - ok
16:24:01.0156 1448 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
16:24:01.0328 1448 Rasl2tp - ok
16:24:01.0375 1448 RasMan (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
16:24:01.0531 1448 RasMan - ok
16:24:01.0578 1448 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
16:24:01.0796 1448 RasPppoe - ok
16:24:01.0843 1448 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
16:24:02.0000 1448 Raspti - ok
16:24:02.0046 1448 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
16:24:02.0218 1448 Rdbss - ok
16:24:02.0265 1448 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:24:02.0421 1448 RDPCDD - ok
16:24:02.0484 1448 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
16:24:02.0656 1448 rdpdr - ok
16:24:02.0718 1448 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
16:24:02.0890 1448 RDPWD - ok
16:24:02.0921 1448 RDSessMgr (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
16:24:03.0125 1448 RDSessMgr - ok
16:24:03.0156 1448 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
16:24:03.0328 1448 redbook - ok
16:24:03.0359 1448 RemoteAccess (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
16:24:03.0531 1448 RemoteAccess - ok
16:24:03.0578 1448 RemoteRegistry (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll
16:24:03.0718 1448 RemoteRegistry - ok
16:24:03.0765 1448 RpcLocator (2a02e21867497df20b8fc95631395169) C:\WINDOWS\System32\locator.exe
16:24:03.0937 1448 RpcLocator - ok
16:24:04.0000 1448 RpcSs (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
16:24:04.0046 1448 RpcSs - ok
16:24:04.0109 1448 RSVP (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\System32\rsvp.exe
16:24:04.0281 1448 RSVP - ok
16:24:04.0390 1448 SageDeploymentService (c3b35487cfb25357d313625a691e1200) C:\Programme\Gemeinsame Dateien\Sage Software Shared\Deploymentservice.exe
16:24:04.0421 1448 SageDeploymentService - ok
16:24:04.0453 1448 SamSs (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
16:24:04.0593 1448 SamSs - ok
16:24:04.0640 1448 SCardSvr (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
16:24:04.0781 1448 SCardSvr - ok
16:24:04.0828 1448 Schedule (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
16:24:05.0015 1448 Schedule - ok
16:24:05.0093 1448 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
16:24:05.0250 1448 Secdrv - ok
16:24:05.0281 1448 seclogon (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
16:24:05.0437 1448 seclogon - ok
16:24:05.0453 1448 SENS (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
16:24:05.0593 1448 SENS - ok
16:24:05.0656 1448 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
16:24:05.0812 1448 serenum - ok
16:24:05.0859 1448 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
16:24:06.0031 1448 Serial - ok
16:24:06.0109 1448 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
16:24:06.0265 1448 Sfloppy - ok
16:24:06.0328 1448 SFUSVC (5944ecbcf555dedd7f48f9982d5ddff4) C:\Programme\Kyocera Mita\FileUtility\SFUSVC.exe
16:24:06.0328 1448 SFUSVC ( UnsignedFile.Multi.Generic ) - warning
16:24:06.0328 1448 SFUSVC - detected UnsignedFile.Multi.Generic (1)
16:24:06.0390 1448 SharedAccess (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
16:24:06.0562 1448 SharedAccess - ok
16:24:06.0609 1448 ShellHWDetection (40602ebfbe06aa075c8e4560743f6883) C:\WINDOWS\System32\shsvcs.dll
16:24:06.0750 1448 ShellHWDetection - ok
16:24:06.0765 1448 Simbad - ok
16:24:06.0828 1448 SiS315 (94f6eea8a688a37f71bf9c9aeaa42666) C:\WINDOWS\system32\DRIVERS\sisgrp.sys
16:24:07.0109 1448 SiS315 - ok
16:24:07.0140 1448 sisagp (61ca562def09a782d26b3e7edec5369a) C:\WINDOWS\system32\DRIVERS\SISAGPX.sys
16:24:07.0187 1448 sisagp - ok
16:24:07.0203 1448 SiSide (b4485881bd8aed9b157a2e6cf43c2d51) C:\WINDOWS\system32\DRIVERS\siside.sys
16:24:07.0265 1448 SiSide - ok
16:24:07.0296 1448 SiSkp (837d26f79a1647066d75c5c811887475) C:\WINDOWS\system32\DRIVERS\srvkp.sys
16:24:07.0328 1448 SiSkp - ok
16:24:07.0390 1448 snapman (90257773f4b4065bd0c6cc2164fd52e5) C:\WINDOWS\system32\DRIVERS\snapman.sys
16:24:07.0453 1448 snapman ( UnsignedFile.Multi.Generic ) - warning
16:24:07.0453 1448 snapman - detected UnsignedFile.Multi.Generic (1)
16:24:07.0500 1448 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\System32\DRIVERS\sparrow.sys
16:24:07.0593 1448 Sparrow - ok
16:24:07.0640 1448 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
16:24:07.0781 1448 splitter - ok
16:24:07.0828 1448 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
16:24:07.0906 1448 Spooler - ok
16:24:07.0984 1448 SQLBrowser (5673e79bbb62a4c35b10d821ff1b4aca) C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe
16:24:08.0015 1448 SQLBrowser - ok
16:24:08.0046 1448 SQLWriter (9263c8898732e2b890f7e954e7729ab7) C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
16:24:08.0093 1448 SQLWriter - ok
16:24:08.0125 1448 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
16:24:08.0296 1448 sr - ok
16:24:08.0359 1448 srservice (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\System32\srsvc.dll
16:24:08.0500 1448 srservice - ok
16:24:08.0546 1448 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
16:24:08.0656 1448 Srv - ok
16:24:08.0687 1448 SSDPSRV (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
16:24:08.0843 1448 SSDPSRV - ok
16:24:08.0875 1448 StarOpen (f92254b0bcfcd10caac7bccc7cb7f467) C:\WINDOWS\system32\drivers\StarOpen.sys
16:24:08.0906 1448 StarOpen ( UnsignedFile.Multi.Generic ) - warning
16:24:08.0906 1448 StarOpen - detected UnsignedFile.Multi.Generic (1)
16:24:08.0953 1448 StillCam (a2dbcc4c8860449df1ab758ea28b4de0) C:\WINDOWS\system32\DRIVERS\serscan.sys
16:24:09.0109 1448 StillCam - ok
16:24:09.0156 1448 stisvc (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
16:24:09.0328 1448 stisvc - ok
16:24:09.0359 1448 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
16:24:09.0515 1448 swenum - ok
16:24:09.0562 1448 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
16:24:09.0718 1448 swmidi - ok
16:24:09.0734 1448 SwPrv - ok
16:24:09.0781 1448 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\System32\DRIVERS\symc810.sys
16:24:09.0937 1448 symc810 - ok
16:24:09.0953 1448 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\System32\DRIVERS\symc8xx.sys
16:24:10.0140 1448 symc8xx - ok
16:24:10.0171 1448 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\System32\DRIVERS\sym_hi.sys
16:24:10.0343 1448 sym_hi - ok
16:24:10.0359 1448 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\System32\DRIVERS\sym_u3.sys
16:24:10.0531 1448 sym_u3 - ok
16:24:10.0578 1448 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
16:24:10.0765 1448 sysaudio - ok
16:24:10.0812 1448 SysmonLog (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
16:24:11.0000 1448 SysmonLog - ok
16:24:11.0046 1448 TapiSrv (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
16:24:11.0187 1448 TapiSrv - ok
16:24:11.0250 1448 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
16:24:11.0359 1448 Tcpip - ok
16:24:11.0390 1448 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
16:24:11.0546 1448 TDPIPE - ok
16:24:11.0578 1448 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
16:24:11.0734 1448 TDTCP - ok
16:24:11.0750 1448 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
16:24:11.0921 1448 TermDD - ok
16:24:11.0984 1448 TermService (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
16:24:12.0156 1448 TermService - ok
16:24:12.0187 1448 Themes (40602ebfbe06aa075c8e4560743f6883) C:\WINDOWS\System32\shsvcs.dll
16:24:12.0328 1448 Themes - ok
16:24:12.0375 1448 tifsfilter (7369f74dd9172c6527a8aceb010e28f1) C:\WINDOWS\system32\DRIVERS\tifsfilt.sys
16:24:12.0421 1448 tifsfilter ( UnsignedFile.Multi.Generic ) - warning
16:24:12.0421 1448 tifsfilter - detected UnsignedFile.Multi.Generic (1)
16:24:12.0437 1448 timounter (53fec95b844c46489f6683dc0a606e01) C:\WINDOWS\system32\DRIVERS\timntr.sys
16:24:12.0593 1448 timounter ( UnsignedFile.Multi.Generic ) - warning
16:24:12.0593 1448 timounter - detected UnsignedFile.Multi.Generic (1)
16:24:12.0625 1448 TlntSvr (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\System32\tlntsvr.exe
16:24:12.0812 1448 TlntSvr - ok
16:24:12.0906 1448 TmFilter (ac940a15959be57958b91cdb914aaa6c) C:\Programme\Trend Micro\OfficeScan Client\TmXPFlt.sys
16:24:12.0953 1448 TmFilter - ok
16:24:13.0000 1448 tmlisten (74efd08250cb5830e8acbd6eeae7418a) C:\Programme\Trend Micro\OfficeScan Client\tmlisten.exe
16:24:13.0046 1448 tmlisten ( UnsignedFile.Multi.Generic ) - warning
16:24:13.0046 1448 tmlisten - detected UnsignedFile.Multi.Generic (1)
16:24:13.0093 1448 TmPreFilter (8651a867c78bd2b69f1d5f982138a074) C:\Programme\Trend Micro\OfficeScan Client\TmPreFlt.sys
16:24:13.0125 1448 TmPreFilter - ok
16:24:13.0156 1448 TosIde (d213a9247dc347f305a2d4cc9b951487) C:\WINDOWS\System32\DRIVERS\toside.sys
16:24:13.0296 1448 TosIde - ok
16:24:13.0343 1448 TrkWks (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
16:24:13.0500 1448 TrkWks - ok
16:24:13.0578 1448 TuneUp.Defrag (6a29cd69d1128bdf49a705befc614a5b) C:\WINDOWS\System32\TuneUpDefragService.exe
16:24:13.0640 1448 TuneUp.Defrag - ok
16:24:13.0703 1448 TuneUp.ProgramStatisticsSvc (51ee2913ed525de18fda96dccbc5386a) C:\WINDOWS\System32\TUProgSt.exe
16:24:13.0734 1448 TuneUp.ProgramStatisticsSvc - ok
16:24:13.0781 1448 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
16:24:13.0953 1448 Udfs - ok
16:24:14.0000 1448 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\System32\DRIVERS\ultra.sys
16:24:14.0109 1448 ultra - ok
16:24:14.0156 1448 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
16:24:14.0375 1448 Update - ok
16:24:14.0421 1448 upnphost (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
16:24:14.0593 1448 upnphost - ok
16:24:14.0625 1448 UPS (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
16:24:14.0796 1448 UPS - ok
16:24:14.0828 1448 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:24:15.0000 1448 usbccgp - ok
16:24:15.0031 1448 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
16:24:15.0187 1448 usbehci - ok
16:24:15.0234 1448 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
16:24:15.0390 1448 usbhub - ok
16:24:15.0437 1448 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
16:24:15.0593 1448 usbohci - ok
16:24:15.0625 1448 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
16:24:15.0796 1448 usbscan - ok
16:24:15.0828 1448 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:24:16.0000 1448 USBSTOR - ok
16:24:16.0031 1448 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
16:24:16.0187 1448 usbuhci - ok
16:24:16.0234 1448 UxTuneUp (2e2e93041c8058bc7de6f0d743c4a0c6) C:\WINDOWS\System32\uxtuneup.dll
16:24:16.0265 1448 UxTuneUp - ok
16:24:16.0296 1448 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
16:24:16.0453 1448 VgaSave - ok
16:24:16.0484 1448 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
16:24:16.0640 1448 viaagp - ok
16:24:16.0671 1448 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\System32\DRIVERS\viaide.sys
16:24:16.0828 1448 ViaIde - ok
16:24:16.0843 1448 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
16:24:17.0031 1448 VolSnap - ok
16:24:17.0125 1448 VSApiNt (71a53597bfb4bad7218ad2beaba5c564) C:\Programme\Trend Micro\OfficeScan Client\VSApiNt.sys
16:24:17.0203 1448 VSApiNt - ok
16:24:17.0343 1448 VSS (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
16:24:17.0546 1448 VSS - ok
16:24:17.0609 1448 W32Time (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\System32\w32time.dll
16:24:17.0750 1448 W32Time - ok
16:24:17.0828 1448 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
16:24:18.0000 1448 Wanarp - ok
16:24:18.0000 1448 WDICA - ok
16:24:18.0046 1448 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
16:24:18.0218 1448 wdmaud - ok
16:24:18.0265 1448 WebClient (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
16:24:18.0406 1448 WebClient - ok
16:24:18.0484 1448 winmgmt (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
16:24:18.0625 1448 winmgmt - ok
16:24:18.0703 1448 winvnc (b84873b030e66ddf3964a31793bb4211) D:\Programme\RealVNC\WinVNC\WinVNC.exe
16:24:18.0750 1448 winvnc ( UnsignedFile.Multi.Generic ) - warning
16:24:18.0750 1448 winvnc - detected UnsignedFile.Multi.Generic (1)
16:24:18.0781 1448 WmdmPmSN (6e18978b749f0696a774de3f2cb142dd) C:\WINDOWS\system32\mspmsnsv.dll
16:24:18.0937 1448 WmdmPmSN - ok
16:24:19.0015 1448 Wmi (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll
16:24:19.0078 1448 Wmi - ok
16:24:19.0125 1448 WmiApSrv (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\System32\wbem\wmiapsrv.exe
16:24:19.0312 1448 WmiApSrv - ok
16:24:19.0468 1448 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
16:24:19.0578 1448 WPFFontCache_v0400 - ok
16:24:19.0625 1448 wscsvc (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
16:24:19.0796 1448 wscsvc - ok
16:24:19.0812 1448 wuauserv (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
16:24:19.0968 1448 wuauserv - ok
16:24:20.0031 1448 WZCSVC (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
16:24:20.0187 1448 WZCSVC - ok
16:24:20.0218 1448 xmlprov (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
16:24:20.0406 1448 xmlprov - ok
16:24:20.0421 1448 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
16:24:20.0921 1448 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
16:24:20.0921 1448 \Device\Harddisk0\DR0 - detected TDSS File System (1)
16:24:20.0921 1448 Boot (0x1200) (8fed00eaa87fc9a3d1c5a52232bb0ee8) \Device\Harddisk0\DR0\Partition0
16:24:20.0921 1448 \Device\Harddisk0\DR0\Partition0 - ok
16:24:20.0953 1448 Boot (0x1200) (1bbc1b3ed6fbfe61fa2ad89e49c32fac) \Device\Harddisk0\DR0\Partition1
16:24:20.0953 1448 \Device\Harddisk0\DR0\Partition1 - ok
16:24:20.0953 1448 ============================================================
16:24:20.0953 1448 Scan finished
16:24:20.0953 1448 ============================================================
16:24:21.0093 3396 Detected object count: 17
16:24:21.0093 3396 Actual detected object count: 17
16:25:03.0937 3396 ACPI ( Virus.Win32.Rloader.a ) - skipped by user
16:25:03.0937 3396 ACPI ( Virus.Win32.Rloader.a ) - User select action: Skip
16:25:03.0937 3396 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0937 3396 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0953 3396 bizVSerial ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0953 3396 bizVSerial ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0953 3396 cjpcsc ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0953 3396 cjpcsc ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0953 3396 epmntdrv ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0953 3396 epmntdrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0968 3396 EuGdiDrv ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0968 3396 EuGdiDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0968 3396 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0968 3396 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0984 3396 ntrtscan ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0984 3396 ntrtscan ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0984 3396 PxHelp20 ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0984 3396 PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:03.0984 3396 SFUSVC ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:03.0984 3396 SFUSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0000 3396 snapman ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:04.0000 3396 snapman ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0000 3396 StarOpen ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:04.0000 3396 StarOpen ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0000 3396 tifsfilter ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:04.0000 3396 tifsfilter ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0015 3396 timounter ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:04.0015 3396 timounter ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0015 3396 tmlisten ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:04.0015 3396 tmlisten ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0015 3396 winvnc ( UnsignedFile.Multi.Generic ) - skipped by user
16:25:04.0015 3396 winvnc ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:04.0031 3396 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
16:25:04.0031 3396 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip
OTL Logfile: Code:
ATTFilter OTL logfile created on: 14.06.2012 16:35:20 - Run 1 OTL by OldTimer - Version 3.2.48.0 Folder = C:\Dokumente und Einstellungen\npc18\Eigene Dateien\Downloads Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,97 Gb Total Physical Memory | 1,29 Gb Available Physical Memory | 65,58% Memory free 3,79 Gb Paging File | 3,24 Gb Available in Paging File | 85,57% Paging File free Paging file location(s): D:\pagefile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 47,21 Gb Total Space | 15,70 Gb Free Space | 33,26% Space Free | Partition Type: NTFS Drive D: | 27,31 Gb Total Space | 17,25 Gb Free Space | 63,17% Space Free | Partition Type: NTFS Drive F: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS Drive G: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS Drive M: | 31,48 Gb Total Space | 19,95 Gb Free Space | 63,38% Space Free | Partition Type: NTFS Drive W: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS Drive X: | 31,48 Gb Total Space | 19,95 Gb Free Space | 63,38% Space Free | Partition Type: NTFS Drive Z: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS Computer Name: NPC18 | User Name: npc18 | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\npc18\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Programme\Gemeinsame Dateien\Sage Software Shared\Deploymentservice.exe (Sage Software) PRC - C:\WINDOWS\system32\DWRCST.EXE (DameWare Development) PRC - C:\WINDOWS\system32\DWRCS.EXE (DameWare Development LLC) PRC - C:\Programme\CDBurnerXP\NMSAccessU.exe () PRC - C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe (Sony Corporation) PRC - C:\WINDOWS\system32\cjpcsc.exe (REINER SCT) PRC - C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe (Acronis) PRC - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis) PRC - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis) PRC - C:\Programme\Trend Micro\OfficeScan Client\PccNTMon.exe (Trend Micro Inc.) PRC - C:\Programme\Trend Micro\OfficeScan Client\OfcDog.exe (Trend Micro Inc.) PRC - C:\Programme\Trend Micro\OfficeScan Client\NTRtScan.exe (Trend Micro Inc.) PRC - C:\Programme\Trend Micro\OfficeScan Client\TmListen.exe (Trend Micro Inc.) PRC - C:\WINDOWS\system32\Keyhook.exe (Silicon Integrated Systems Corporation) PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) PRC - C:\Programme\Kyocera Mita\FileUtility\NsCatCom.exe (KYOCERA MITA) PRC - C:\Programme\Kyocera Mita\FileUtility\SFUSVC.exe (KYOCERA MITA CORPORATION) PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) PRC - D:\Programme\RealVNC\WinVNC\winvnc.exe (RealVNC Ltd.) PRC - C:\WINDOWS\system32\NILaunch.exe () ========== Modules (No Company Name) ========== MOD - C:\Programme\Mozilla Firefox\mozjs.dll () MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU () MOD - C:\Programme\FileZilla FTP Client\fzshellext.dll () MOD - C:\Programme\CDBurnerXP\NMSAccessU.exe () MOD - C:\Programme\Trend Micro\OfficeScan Client\TimeString.dll () MOD - D:\Programme\RealVNC\WinVNC\othread2.dll () MOD - C:\Programme\Kyocera Mita\FileUtility\HgTiff2Pdf.dll () MOD - C:\WINDOWS\system32\NILaunch.exe () MOD - C:\WINDOWS\system32\spool\prtprocs\w32x86\jDocPrc.dll () ========== Win32 Services (SafeList) ========== SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (SageDeploymentService) -- C:\Programme\Gemeinsame Dateien\Sage Software Shared\Deploymentservice.exe (Sage Software) SRV - (DWMRCS) -- C:\WINDOWS\system32\DWRCS.EXE (DameWare Development LLC) SRV - (NMSAccess) -- C:\Programme\CDBurnerXP\NMSAccessU.exe () SRV - (osppsvc) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (TuneUp.ProgramStatisticsSvc) -- C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software) SRV - (TuneUp.Defrag) -- C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software) SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software) SRV - (cjpcsc) -- C:\WINDOWS\system32\cjpcsc.exe (REINER SCT) SRV - (AcrSch2Svc) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis) SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (ntrtscan) -- C:\Programme\Trend Micro\OfficeScan Client\NTRtScan.exe (Trend Micro Inc.) SRV - (tmlisten) -- C:\Programme\Trend Micro\OfficeScan Client\TmListen.exe (Trend Micro Inc.) SRV - (SFUSVC) -- C:\Programme\Kyocera Mita\FileUtility\SFUSVC.exe (KYOCERA MITA CORPORATION) SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) SRV - (winvnc) -- D:\Programme\RealVNC\WinVNC\winvnc.exe (RealVNC Ltd.) ========== Driver Services (SafeList) ========== DRV - (WDICA) -- File not found DRV - (PDRFRAME) -- File not found DRV - (PDRELI) -- File not found DRV - (PDFRAME) -- File not found DRV - (PDCOMP) -- File not found DRV - (PCIDump) -- File not found DRV - (lbrtfdc) -- File not found DRV - (Changer) -- File not found DRV - (VSApiNt) -- C:\Programme\Trend Micro\OfficeScan Client\vsapint.sys (Trend Micro Inc.) DRV - (TmFilter) -- C:\Programme\Trend Micro\OfficeScan Client\tmxpflt.sys (Trend Micro Inc.) DRV - (TmPreFilter) -- C:\Programme\Trend Micro\OfficeScan Client\tmpreflt.sys (Trend Micro Inc.) DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation) DRV - (timounter) -- C:\WINDOWS\system32\drivers\timntr.sys (Acronis) DRV - (tifsfilter) -- C:\WINDOWS\system32\drivers\tifsfilt.sys (Acronis) DRV - (snapman) -- C:\WINDOWS\system32\drivers\snapman.sys (Acronis) DRV - (epmntdrv) -- C:\WINDOWS\system32\epmntdrv.sys () DRV - (EuGdiDrv) -- C:\WINDOWS\system32\EuGdiDrv.sys () DRV - (StarOpen) -- C:\WINDOWS\System32\drivers\StarOpen.sys () DRV - (dwvkbd) -- C:\WINDOWS\system32\drivers\dwvkbd.sys (DameWare) DRV - (DwMirror) -- C:\WINDOWS\system32\drivers\DamewareMini.sys (DameWare Development, LLC) DRV - (cjusb) -- C:\WINDOWS\system32\drivers\cjusb.sys (REINER SCT) DRV - (bizVSerial) -- C:\WINDOWS\system32\drivers\bizVSerialNT.sys (franson.biz) DRV - (SiSkp) -- C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation) DRV - (SiS315) -- C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation) DRV - (ALCXSENS) -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd) DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.) DRV - (sisagp) -- C:\WINDOWS\system32\drivers\SISAGPX.SYS (Silicon Integrated Systems Corporation) DRV - (SiSide) -- C:\WINDOWS\system32\drivers\siside.sys (Silicon Integrated Systems Corp.) DRV - (AN983) -- C:\WINDOWS\system32\drivers\an983.sys (ADMtek Incorporated.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\..\SearchScopes,DefaultScope = {4DFEA8C9-2FF7-467A-9DCA-68844DF1D641} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{4DFEA8C9-2FF7-467A-9DCA-68844DF1D641}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Yahoo" FF - prefs.js..browser.startup.homepage: "hxxp://www.vtl.de/route/vtlsdg/index.asp" FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.4: C:\Programme\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@adobe.com/Acrobat,version=5.1: C:\Programme\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.06.14 08:18:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.26 08:06:54 | 000,000,000 | ---D | M] [2011.09.27 14:34:25 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\npc18\Anwendungsdaten\Mozilla\Extensions [2012.06.14 16:06:29 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\npc18\Anwendungsdaten\Mozilla\Firefox\Profiles\fs5g9u5i.default\extensions [2011.09.27 14:34:29 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\npc18\Anwendungsdaten\Mozilla\Firefox\Profiles\fs5g9u5i.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2012.01.11 10:26:53 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.06.14 16:06:29 | 000,634,964 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\NPC18\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\FS5G9U5I.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2012.06.14 08:18:17 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2011.11.28 17:50:02 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll [2011.11.11 10:01:11 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.11.11 10:01:11 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2011.11.11 10:01:11 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2011.11.11 10:01:11 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2011.11.11 10:01:11 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2011.11.11 10:01:11 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2012.06.14 12:27:20 | 000,000,736 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis) O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [Net-It Launcher] C:\WINDOWS\system32\NILaunch.exe () O4 - HKLM..\Run: [OfficeScanNT Monitor] C:\Programme\Trend Micro\OfficeScan Client\pccntmon.exe (Trend Micro Inc.) O4 - HKLM..\Run: [SfWinStartInfo] C:\Programme\SFirm32\sfWinStartupInfo.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH) O4 - HKLM..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\Keyhook.exe (Silicon Integrated Systems Corporation) O4 - HKLM..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe (Silicon Integrated Systems Corp.) O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe (Acronis) O4 - HKLM..\Run: [WinVNC] D:\Programme\RealVNC\WinVNC\WinVNC.exe (RealVNC Ltd.) O4 - Startup: C:\Dokumente und Einstellungen\npc18\Startmenü\Programme\Autostart\Picture Motion Browser Medien-Prüfung.lnk = C:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe (Sony Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} hxxp://dialog.net-w.de/viewer/activeXViewer/activexviewer.cab (Crystal Report Smart Viewer 7) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = GerbethDomain.local O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0058D2A4-C4D4-4FE8-AE73-9F597B7A9B96}: NameServer = 8.8.8.8,101.0.0.9,101.0.0.250 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2003.04.08 11:35:38 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{0e0a8f3c-f3e0-11e0-b859-003005627a7f}\Shell - "" = AutoRun O33 - MountPoints2\{0e0a8f3c-f3e0-11e0-b859-003005627a7f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{0e0a8f3c-f3e0-11e0-b859-003005627a7f}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a O33 - MountPoints2\H\Shell - "" = AutoRun O33 - MountPoints2\H\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.06.14 16:22:30 | 000,000,000 | ---D | C] -- C:\tddsskiller [2012.06.14 12:34:59 | 000,200,976 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys [2012.06.13 17:37:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\npc18\Anwendungsdaten\Malwarebytes [2012.06.13 17:37:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2012.06.13 17:37:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2012.06.13 17:37:45 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2012.06.13 17:37:45 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2012.06.13 17:19:10 | 000,014,664 | ---- | C] (McAfee, Inc.) -- C:\WINDOWS\stinger.sys [2012.06.13 17:18:30 | 000,000,000 | ---D | C] -- C:\Programme\stinger [2012.06.13 17:06:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\npc18\Desktop\backups [2012.06.13 16:51:03 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\npc18\Desktop\HiJackThis204.exe [2012.06.13 16:22:10 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\npc18\Recent [2012.06.13 12:36:40 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy [2012.06.13 12:36:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy [2012.06.11 09:56:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\npc18\php [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\Dokumente und Einstellungen\npc18\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\npc18\Desktop\*.tmp -> ] [1 C:\Dokumente und Einstellungen\npc18\*.tmp files -> C:\Dokumente und Einstellungen\npc18\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.06.14 16:43:04 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{8BA56005-620F-4DA5-883B-32E1B8466A6C}.job [2012.06.14 16:43:04 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{668B4AD5-14D1-4536-984E-AF6082338C9D}.job [2012.06.14 16:42:00 | 000,000,434 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{764DBD1D-5439-4A7F-92DC-14B508F5DEBC}.job [2012.06.14 16:41:00 | 000,000,434 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{D4C8872C-3536-4E03-BFE5-033DEA1971A0}.job [2012.06.14 16:00:01 | 000,000,492 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job [2012.06.14 15:23:08 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012.06.14 15:10:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.06.14 15:07:50 | 000,303,967 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\census.cache [2012.06.14 15:07:48 | 000,179,666 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\ars.cache [2012.06.14 12:35:24 | 000,000,036 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache [2012.06.14 12:27:20 | 000,000,736 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2012.06.14 09:55:06 | 000,002,607 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\Desktop\Microsoft Office Outlook 2003.lnk [2012.06.14 08:03:02 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2012.06.13 17:37:48 | 000,000,762 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2012.06.13 17:19:10 | 000,014,664 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\stinger.sys [2012.06.13 17:06:51 | 000,000,734 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.newold [2012.06.13 16:14:31 | 000,102,400 | ---- | M] () -- C:\WINDOWS\RegBootClean.exe [2012.06.13 13:08:41 | 000,000,245 | RHS- | M] () -- C:\boot.ini [2012.06.13 12:47:42 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\npc18\Desktop\HiJackThis204.exe [2012.06.13 09:56:32 | 000,015,888 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\Desktop\Mimberg Kosten.123 [2012.06.11 09:58:01 | 000,000,761 | RHS- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.old [2012.06.11 09:56:23 | 000,000,002 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\uz.dat [2012.05.29 19:50:14 | 000,020,672 | ---- | M] () -- C:\Dokumente und Einstellungen\npc18\Eigene Dateien\Amex-Rg.lwp [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\Dokumente und Einstellungen\npc18\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\npc18\Desktop\*.tmp -> ] [1 C:\Dokumente und Einstellungen\npc18\*.tmp files -> C:\Dokumente und Einstellungen\npc18\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.06.13 17:37:48 | 000,000,762 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2012.06.13 16:13:38 | 000,102,400 | ---- | C] () -- C:\WINDOWS\RegBootClean.exe [2012.06.13 16:03:05 | 000,303,967 | ---- | C] () -- C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\census.cache [2012.06.13 16:02:52 | 000,179,666 | ---- | C] () -- C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\ars.cache [2012.06.13 13:22:03 | 000,000,036 | ---- | C] () -- C:\Dokumente und Einstellungen\npc18\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache [2012.06.11 09:56:23 | 000,000,002 | ---- | C] () -- C:\Dokumente und Einstellungen\npc18\uz.dat [2012.05.02 08:32:09 | 000,000,029 | ---- | C] () -- C:\WINDOWS\hbcikrnl.ini.lock [2012.05.02 08:31:10 | 000,000,103 | ---- | C] () -- C:\WINDOWS\Setup_tmp.ini [2011.10.10 11:16:29 | 002,469,760 | ---- | C] () -- C:\WINDOWS\System32\BootMan.exe [2011.10.10 11:16:29 | 000,019,840 | ---- | C] () -- C:\WINDOWS\System32\EuEpmGdi.dll [2011.10.10 11:16:28 | 000,086,408 | ---- | C] () -- C:\WINDOWS\System32\setupempdrv03.exe [2011.10.10 11:16:28 | 000,013,192 | ---- | C] () -- C:\WINDOWS\System32\epmntdrv.sys [2011.10.10 11:16:28 | 000,008,456 | ---- | C] () -- C:\WINDOWS\System32\EuGdiDrv.sys [2011.10.04 13:15:12 | 000,003,209 | ---- | C] () -- C:\WINDOWS\cfgrs.ini [2011.10.04 13:15:12 | 000,002,481 | ---- | C] () -- C:\WINDOWS\cfgrs_ex.ini [2011.09.26 13:09:35 | 000,000,024 | ---- | C] () -- C:\WINDOWS\pccntmon.INI [2011.01.25 12:51:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\0mandanten.ini [2010.10.19 09:53:23 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys < End of report > [/CODE] OTL EXTRA OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 14.06.2012 16:35:20 - Run 1
OTL by OldTimer - Version 3.2.48.0 Folder = C:\Dokumente und Einstellungen\npc18\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,97 Gb Total Physical Memory | 1,29 Gb Available Physical Memory | 65,58% Memory free
3,79 Gb Paging File | 3,24 Gb Available in Paging File | 85,57% Paging File free
Paging file location(s): D:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 47,21 Gb Total Space | 15,70 Gb Free Space | 33,26% Space Free | Partition Type: NTFS
Drive D: | 27,31 Gb Total Space | 17,25 Gb Free Space | 63,17% Space Free | Partition Type: NTFS
Drive F: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS
Drive G: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS
Drive M: | 31,48 Gb Total Space | 19,95 Gb Free Space | 63,38% Space Free | Partition Type: NTFS
Drive W: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS
Drive X: | 31,48 Gb Total Space | 19,95 Gb Free Space | 63,38% Space Free | Partition Type: NTFS
Drive Z: | 69,99 Gb Total Space | 22,39 Gb Free Space | 32,00% Space Free | Partition Type: NTFS
Computer Name: NPC18 | User Name: npc18 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"6129:TCP" = 6129:TCP:*:Enabled:DameWare Mini Remote Control Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\n.e.t.z\MULTI-TE\TermMan.exe" = C:\Programme\n.e.t.z\MULTI-TE\TermMan.exe:*:Disabled:Manager für die Terminalemulation -- (n.e.t.z software-partner gmbh)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00180407-78E1-11D2-B60F-006097C998E7}" = Microsoft Access 2000 SR-1 Runtime
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0EB1536E-1888-4330-95C9-F89135786CDD}" = COALA
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{20F1FFAF-1BFF-450C-A8C7-03D1BE24B950}" = Microsoft .NET Framework (German)
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{2DFB5485-A3EF-4298-9280-4AF80C9F4BE9}" = Microsoft SQL Server VSS Writer
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{359FCAA7-B544-4147-AE3B-8C8A526E2427}" = Sony Image Data Suite
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{547DCEC7-DD2A-47E9-82C7-5CF1EAB526DA}" = Microsoft SQL Server Native Client
"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009
"{61C79AE1-5403-4687-AC68-28BFA5EF3895}" = KyoceraMita Scanner File Utility
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{76D1AA2B-A434-4D63-BE2C-80286F23C223}" = Microsoft Interop Forms Redistributable Package 2.0a
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}" = Bonjour
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90140000-001C-0000-0000-0000000FF1CE}" = Microsoft Office Access Runtime 2010
"{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{FA978F90-F7AB-4CF6-BCF5-885CF559DE7C}" = Microsoft Access 2010 Runtime Service Pack 1 (SP1)
"{90140000-001C-0407-0000-0000000FF1CE}" = Microsoft Office Access Runtime MUI (German) 2010
"{90140000-001C-0407-0000-0000000FF1CE}_Office14.AccessRT_{264417E7-E622-456E-9666-3298344AF72C}" = Microsoft Access 2010 Runtime Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.AccessRT_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Access 2010 Runtime Service Pack 1 (SP1)
"{901C0407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Access 2003 Runtime
"{90840407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Excel Viewer 2003
"{90E00407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Outlook 2003
"{91110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A600A500-6AAC-48AB-B29C-145483B3A127}" = SFirm
"{A6473724-A851-11D5-986D-00500443CF9F}" = Moorhuhn 3
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{BAC94BFC-10E3-4094-855F-C9F92C8ED1F2}" = Personalwirtschaft
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CA83357B-931E-44DC-AD43-9996FEEB8116}" = Acronis*True*Image
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF78AB2B-1CA0-42D2-A2F1-FDEBC7876EF0}" = Microsoft SQL Server 2005 (SQLEXPRESS)
"{D5068583-D569-468B-9755-5FBF5848F46F}" = Sony Picture Utility
"{D5945672-BA86-4095-865F-58E9C8A48205}" = Lotus Notes 6.0.3 de
"{EA2D9BC0-75E9-4975-9A0A-DD82198DDC53}" = MSXML 6.0 Parser
"{F958CA02-BB40-4007-894B-258729456EE4}" = QuickTime
"{FC338210-F594-11D3-BA24-00001C3AB4DF}" = cyberJack Base Components
"{FF4E0135-C210-4E21-9C24-496DFDF956FD}" = Microsoft SQL Server 2008 R2 Native Client
"{FF748561-FFFE-11D3-A06B-00E02939A7B1}" = dakota.ag
"7-Zip" = 7-Zip 4.42
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"CCleaner" = CCleaner
"Delphi5" = Borland Delphi 5
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 9.1.0 Home Edition
"FastImageResizer" = FastImageResizer (remove only)
"FileZilla Client" = FileZilla Client 3.5.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Informix Client SDK" = Informix Client SDK
"InstallShield_{BAC94BFC-10E3-4094-855F-C9F92C8ED1F2}" = Sage Personalwirtschaft 2012.1+
"InstallShield_{BFF9FC50-EDAE-4D81-BB5B-7F73C2ACF3A1}" = Hotfix 004 PW 2008.1+
"InstallShield_{DB3DC857-9EBD-43C5-8C7A-999617A2A87E}" = Masterpatch 2005.1+
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework Full v1.0.3705 (1031)" = Microsoft .NET Framework (German) v1.0.3705
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Moorhuhn" = Moorhuhn
"Mozilla Firefox 13.0 (x86 de)" = Mozilla Firefox 13.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Office14.AccessRT" = Microsoft Access Runtime 2010
"OfficeScanNT" = Trend Micro OfficeScan Client
"SiS VGA Utilities" = SiS VGA Utilities
"SmartSuite V99.0" = Lotus SmartSuite Version 9.5
"VLC media player" = VLC media player 1.1.4
"Winmail Opener" = Winmail Opener 1.4
"WinVNC_is1" = VNC 3.3.7
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 14.06.2012 03:54:45 | Computer Name = NPC18 | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
Error - 14.06.2012 06:03:01 | Computer Name = NPC18 | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
Error - 14.06.2012 06:03:16 | Computer Name = NPC18 | Source = AutoEnrollment | ID = 15
Description = Die automatische Zertifikatregistrierung für "lokaler Computer" konnte
keine Verbindung zum Active Directory (0x8007054b) herstellen. Die angegebene Domäne
ist nicht vorhanden oder es konnte keine Verbindung hergestellt werden. Die Registrierung
wird nicht durchgeführt.
Error - 14.06.2012 06:03:31 | Computer Name = NPC18 | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
Error - 14.06.2012 06:31:37 | Computer Name = NPC18 | Source = Userenv | ID = 1053
Description = Der Benutzer oder der Computername kann nicht ermittelt werden. (Der
RPC-Server ist nicht verfügbar. ). Die Verarbeitung der Gruppenrichtlinie wurde
abgebrochen.
Error - 14.06.2012 06:32:56 | Computer Name = NPC18 | Source = Userenv | ID = 1053
Description = Der Benutzer oder der Computername kann nicht ermittelt werden. (Der
RPC-Server ist nicht verfügbar. ). Die Verarbeitung der Gruppenrichtlinie wurde
abgebrochen.
Error - 14.06.2012 09:10:42 | Computer Name = NPC18 | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
Error - 14.06.2012 09:10:43 | Computer Name = NPC18 | Source = AutoEnrollment | ID = 15
Description = Die automatische Zertifikatregistrierung für "lokaler Computer" konnte
keine Verbindung zum Active Directory (0x8007054b) herstellen. Die angegebene Domäne
ist nicht vorhanden oder es konnte keine Verbindung hergestellt werden. Die Registrierung
wird nicht durchgeführt.
Error - 14.06.2012 09:10:58 | Computer Name = NPC18 | Source = Userenv | ID = 1054
Description = Der Domänencontrollername für das Computernetzwerk konnte nicht ermittelt
werden. (Die angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung
hergestellt werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
Error - 14.06.2012 09:23:03 | Computer Name = NPC18 | Source = Userenv | ID = 1053
Description = Der Benutzer oder der Computername kann nicht ermittelt werden. (Die
angegebene Domäne ist nicht vorhanden oder es konnte keine Verbindung hergestellt
werden. ). Die Verarbeitung der Gruppenrichtlinie wurde abgebrochen.
[ System Events ]
Error - 13.06.2012 07:14:51 | Computer Name = NPC18 | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne GERBETHDOMAIN aus folgendem
Grund zur Verfügung: %%1311. Stellen Sie sicher, dass der Computer mit dem Netzwerk
verbunden ist, und versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
wenn das Problem weiterhin besteht.
Error - 13.06.2012 07:14:51 | Computer Name = NPC18 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 13.06.2012 07:14:51 | Computer Name = NPC18 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 15 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 13.06.2012 07:16:00 | Computer Name = NPC18 | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne GERBETHDOMAIN aus folgendem
Grund zur Verfügung: %%1722. Stellen Sie sicher, dass der Computer mit dem Netzwerk
verbunden ist, und versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
wenn das Problem weiterhin besteht.
Error - 13.06.2012 11:16:15 | Computer Name = NPC18 | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne GERBETHDOMAIN aus folgendem
Grund zur Verfügung: %%1311. Stellen Sie sicher, dass der Computer mit dem Netzwerk
verbunden ist, und versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
wenn das Problem weiterhin besteht.
Error - 14.06.2012 04:46:15 | Computer Name = NPC18 | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne GERBETHDOMAIN aus folgendem
Grund zur Verfügung: %%1311. Stellen Sie sicher, dass der Computer mit dem Netzwerk
verbunden ist, und versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
wenn das Problem weiterhin besteht.
Error - 14.06.2012 05:39:53 | Computer Name = NPC18 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 119 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 14.06.2012 06:02:46 | Computer Name = NPC18 | Source = NETLOGON | ID = 5719
Description = Es steht kein Domänencontroller für die Domäne GERBETHDOMAIN aus folgendem
Grund zur Verfügung: %%1311. Stellen Sie sicher, dass der Computer mit dem Netzwerk
verbunden ist, und versuchen Sie es erneut. Wenden Sie sich an den Domänenadministrator,
wenn das Problem weiterhin besteht.
Error - 14.06.2012 06:02:50 | Computer Name = NPC18 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 14.06.2012 06:03:05 | Computer Name = NPC18 | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
[ TuneUp Events ]
Error - 14.06.2012 02:18:57 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 08:18:57', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbam.exe','3772',0)
Error - 14.06.2012 02:19:17 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 08:19:17', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbam.exe','3888',0)
Error - 14.06.2012 03:54:10 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 09:54:10', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamservice.exe','1884',0)
Error - 14.06.2012 03:55:21 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 09:55:21', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamgui.exe','3140',0)
Error - 14.06.2012 05:57:16 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 11:57:16', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbam.exe','2912',0)
Error - 14.06.2012 06:02:37 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 12:02:37', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamservice.exe','1900',0)
Error - 14.06.2012 06:03:53 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 12:03:53', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamgui.exe','3320',0)
Error - 14.06.2012 09:10:33 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 15:10:33', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamservice.exe','1948',0)
Error - 14.06.2012 09:11:33 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 15:11:33', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamgui.exe','2972',0)
Error - 14.06.2012 09:23:27 | Computer Name = NPC18 | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-06-14 15:23:27', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamgui.exe','2612',0)
< End of report >
Geändert von stefgig12 (14.06.2012 um 15:42 Uhr) Grund: Code noch gesetzt |
|
15.06.2012, 06:59
| #4 |
| | Google leitet mich auf werbeseiten um Hi, wie erwartet TDDS-Rootkit... Lade Combo Fix von http://download.bleepingcomputer.com/sUBs/ComboFix.exe und speichert es auf den Desktop, noch nicht starten! Der Treiber "ACPI.sys" ist infiziert, neuer Lauf vom Killer und nur den Anhacken und bereinigen (Cure) lassen. Alle anderen Meldungen beziehen sich auf nicht signierte Treiber (das kommt öfter vor). Code:
ATTFilter 16:23:25.0515 1448 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ACPI.sys. Real md5: 95cdd68b6dca09f581b043734854c87d, Fake md5: ac407f1a62c3a300b4f2b5a9f1d55b2c
16:23:25.0515 1448 ACPI ( Virus.Win32.Rloader.a ) - infected
16:23:25.0515 1448 ACPI - detected Virus.Win32.Rloader.a (0)
Combofix Achtung: In einigen wenigen Fällen kann es vorkommen, das der Rechner nicht mehr booten kann und Neuaufgesetzt werden muß! Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter. Der Scan mit Combofix kann einige Zeit in Anspruch nehmen, also habe etwas Geduld. Während des Scans bitte nichts am Rechner unternehmen Es kann möglich sein, dass der Rechner zwischendurch neu gestartet wird. Nach Scanende wird ein Report (ComboFix.txt) angezeigt, den bitte kopieren und in deinem Thread einfuegen. Das Log solltest Du unter C:\ComboFix.txt finden... Beide Logs nach dem Reboot (Killer und CF) posten. chris
__________________  Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden  ) |
|
15.06.2012, 08:47
| #5 |
| | Google leitet mich auf werbeseiten um hier nun die logfile von TDSS ROOTKIT Code:
ATTFilter 08:34:14.0031 2144 TDSS rootkit removing tool 2.7.39.0 Jun 14 2012 08:11:46
08:34:14.0156 2144 ============================================================
08:34:14.0156 2144 Current date / time: 2012/06/15 08:34:14.0156
08:34:14.0156 2144 SystemInfo:
08:34:14.0156 2144
08:34:14.0156 2144 OS Version: 5.1.2600 ServicePack: 3.0
08:34:14.0156 2144 Product type: Workstation
08:34:14.0156 2144 ComputerName: NPC18
08:34:14.0156 2144 UserName: npc18
08:34:14.0156 2144 Windows directory: C:\WINDOWS
08:34:14.0156 2144 System windows directory: C:\WINDOWS
08:34:14.0156 2144 Processor architecture: Intel x86
08:34:14.0156 2144 Number of processors: 2
08:34:14.0156 2144 Page size: 0x1000
08:34:14.0156 2144 Boot type: Normal boot
08:34:14.0156 2144 ============================================================
08:34:15.0953 2144 Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
08:34:15.0953 2144 ============================================================
08:34:15.0953 2144 \Device\Harddisk0\DR0:
08:34:15.0953 2144 MBR partitions:
08:34:15.0953 2144 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x5E6C014
08:34:15.0953 2144 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x5E6FF0E, BlocksNum 0x369E5B3
08:34:15.0953 2144 ============================================================
08:34:16.0031 2144 D: <-> \Device\Harddisk0\DR0\Partition1
08:34:16.0078 2144 C: <-> \Device\Harddisk0\DR0\Partition0
08:34:16.0078 2144 ============================================================
08:34:16.0078 2144 Initialize success
08:34:16.0078 2144 ============================================================
08:36:49.0015 3332 ============================================================
08:36:49.0015 3332 Scan started
08:36:49.0015 3332 Mode: Manual; SigCheck; TDLFS;
08:36:49.0015 3332 ============================================================
08:36:49.0484 3332 Abiosdsk - ok
08:36:49.0515 3332 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS
08:36:50.0421 3332 abp480n5 - ok
08:36:50.0484 3332 ACPI (95cdd68b6dca09f581b043734854c87d) C:\WINDOWS\system32\DRIVERS\ACPI.sys
08:36:50.0484 3332 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ACPI.sys. Real md5: 95cdd68b6dca09f581b043734854c87d, Fake md5: ac407f1a62c3a300b4f2b5a9f1d55b2c
08:36:50.0484 3332 ACPI ( Virus.Win32.Rloader.a ) - infected
08:36:50.0484 3332 ACPI - detected Virus.Win32.Rloader.a (0)
08:36:50.0515 3332 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
08:36:50.0671 3332 ACPIEC - ok
08:36:50.0765 3332 AcrSch2Svc (1b77cac441b53553db0122468926ad73) C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
08:36:50.0781 3332 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - warning
08:36:50.0781 3332 AcrSch2Svc - detected UnsignedFile.Multi.Generic (1)
08:36:50.0812 3332 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\System32\DRIVERS\adpu160m.sys
08:36:50.0968 3332 adpu160m - ok
08:36:51.0015 3332 adpu320 (5e30228eaebf369c24cd0b87a93a2a4a) C:\WINDOWS\System32\DRIVERS\adpu320.sys
08:36:51.0078 3332 adpu320 - ok
08:36:51.0109 3332 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
08:36:51.0265 3332 aec - ok
08:36:51.0296 3332 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
08:36:51.0359 3332 AFD - ok
08:36:51.0390 3332 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
08:36:51.0562 3332 agp440 - ok
08:36:51.0593 3332 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\System32\DRIVERS\agpCPQ.sys
08:36:51.0734 3332 agpCPQ - ok
08:36:51.0765 3332 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\System32\DRIVERS\aha154x.sys
08:36:51.0843 3332 Aha154x - ok
08:36:51.0875 3332 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\System32\DRIVERS\aic78u2.sys
08:36:52.0046 3332 aic78u2 - ok
08:36:52.0078 3332 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\System32\DRIVERS\aic78xx.sys
08:36:52.0265 3332 aic78xx - ok
08:36:52.0328 3332 ALCXSENS (d3fb0a70fa3e3a62f1b2faa88daabae8) C:\WINDOWS\system32\drivers\ALCXSENS.SYS
08:36:52.0437 3332 ALCXSENS - ok
08:36:52.0515 3332 ALCXWDM (36585ee98345223e2963c8edd27fc40d) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
08:36:52.0609 3332 ALCXWDM - ok
08:36:52.0640 3332 Alerter (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
08:36:52.0812 3332 Alerter - ok
08:36:52.0843 3332 ALG (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
08:36:53.0000 3332 ALG - ok
08:36:53.0031 3332 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\System32\DRIVERS\aliide.sys
08:36:53.0218 3332 AliIde - ok
08:36:53.0234 3332 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\System32\DRIVERS\alim1541.sys
08:36:53.0406 3332 alim1541 - ok
08:36:53.0453 3332 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
08:36:53.0609 3332 amdagp - ok
08:36:53.0640 3332 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\System32\DRIVERS\amsint.sys
08:36:53.0734 3332 amsint - ok
08:36:53.0765 3332 AN983 (e2ad6cc7d407f2b5cb2899775cf84f51) C:\WINDOWS\system32\DRIVERS\AN983.sys
08:36:53.0812 3332 AN983 - ok
08:36:53.0843 3332 AppMgmt (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll
08:36:54.0000 3332 AppMgmt - ok
08:36:54.0031 3332 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\System32\DRIVERS\asc.sys
08:36:54.0234 3332 asc - ok
08:36:54.0250 3332 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\System32\DRIVERS\asc3350p.sys
08:36:54.0328 3332 asc3350p - ok
08:36:54.0359 3332 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\System32\DRIVERS\asc3550.sys
08:36:54.0531 3332 asc3550 - ok
08:36:54.0656 3332 aspnet_state (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
08:36:54.0703 3332 aspnet_state - ok
08:36:54.0734 3332 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
08:36:54.0875 3332 AsyncMac - ok
08:36:54.0906 3332 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
08:36:55.0046 3332 atapi - ok
08:36:55.0062 3332 Atdisk - ok
08:36:55.0078 3332 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
08:36:55.0234 3332 Atmarpc - ok
08:36:55.0281 3332 AudioSrv (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
08:36:55.0421 3332 AudioSrv - ok
08:36:55.0468 3332 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
08:36:55.0656 3332 audstub - ok
08:36:55.0687 3332 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
08:36:55.0875 3332 Beep - ok
08:36:56.0234 3332 BITS (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
08:36:56.0500 3332 BITS - ok
08:36:56.0562 3332 bizVSerial (66f655b08eed3230e059d197c8a1969b) C:\WINDOWS\system32\drivers\bizVSerialNT.sys
08:36:56.0625 3332 bizVSerial ( UnsignedFile.Multi.Generic ) - warning
08:36:56.0625 3332 bizVSerial - detected UnsignedFile.Multi.Generic (1)
08:36:56.0984 3332 Bonjour Service (9efe4236f8670846b6e7c5b0eff6e715) C:\Programme\Bonjour\mDNSResponder.exe
08:36:57.0000 3332 Bonjour Service - ok
08:36:57.0046 3332 Browser (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
08:36:57.0203 3332 Browser - ok
08:36:57.0234 3332 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\System32\DRIVERS\cbidf2k.sys
08:36:57.0421 3332 cbidf - ok
08:36:57.0437 3332 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
08:36:57.0593 3332 cbidf2k - ok
08:36:57.0609 3332 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\System32\DRIVERS\cd20xrnt.sys
08:36:57.0703 3332 cd20xrnt - ok
08:36:57.0734 3332 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
08:36:57.0906 3332 Cdaudio - ok
08:36:57.0953 3332 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
08:36:58.0109 3332 Cdfs - ok
08:36:58.0125 3332 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
08:36:58.0281 3332 Cdrom - ok
08:36:58.0281 3332 Changer - ok
08:36:58.0328 3332 CiSvc (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
08:36:58.0484 3332 CiSvc - ok
08:36:58.0546 3332 cjpcsc (cf5cf5aa461883812c1ee234f01779d8) C:\WINDOWS\system32\cjpcsc.exe
08:36:58.0625 3332 cjpcsc ( UnsignedFile.Multi.Generic ) - warning
08:36:58.0625 3332 cjpcsc - detected UnsignedFile.Multi.Generic (1)
08:36:58.0671 3332 cjusb (466d2beca5f06145a3cb2bbe14ace79d) C:\WINDOWS\system32\DRIVERS\cjusb.sys
08:36:58.0703 3332 cjusb - ok
08:36:58.0734 3332 ClipSrv (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
08:36:58.0890 3332 ClipSrv - ok
08:36:59.0015 3332 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
08:36:59.0062 3332 clr_optimization_v2.0.50727_32 - ok
08:36:59.0156 3332 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
08:36:59.0203 3332 clr_optimization_v4.0.30319_32 - ok
08:36:59.0234 3332 CmdIde (c687f81290303d90099b027a6474f99f) C:\WINDOWS\System32\DRIVERS\cmdide.sys
08:36:59.0406 3332 CmdIde - ok
08:36:59.0421 3332 COMSysApp - ok
08:36:59.0437 3332 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\System32\DRIVERS\cpqarray.sys
08:36:59.0609 3332 Cpqarray - ok
08:36:59.0640 3332 CryptSvc (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
08:36:59.0781 3332 CryptSvc - ok
08:36:59.0812 3332 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\System32\DRIVERS\dac2w2k.sys
08:36:59.0984 3332 dac2w2k - ok
08:37:00.0000 3332 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\System32\DRIVERS\dac960nt.sys
08:37:00.0156 3332 dac960nt - ok
08:37:00.0234 3332 DcomLaunch (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
08:37:00.0281 3332 DcomLaunch - ok
08:37:00.0328 3332 Dhcp (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
08:37:00.0468 3332 Dhcp - ok
08:37:00.0500 3332 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
08:37:00.0625 3332 Disk - ok
08:37:00.0640 3332 dmadmin - ok
08:37:00.0703 3332 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
08:37:00.0921 3332 dmboot - ok
08:37:00.0968 3332 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
08:37:01.0125 3332 dmio - ok
08:37:01.0140 3332 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
08:37:01.0312 3332 dmload - ok
08:37:01.0359 3332 dmserver (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
08:37:01.0500 3332 dmserver - ok
08:37:01.0515 3332 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
08:37:01.0671 3332 DMusic - ok
08:37:01.0718 3332 Dnscache (8c9ed3b2834aae63081ab2da831c6fe9) C:\WINDOWS\System32\dnsrslvr.dll
08:37:01.0859 3332 Dnscache - ok
08:37:01.0906 3332 Dot3svc (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
08:37:02.0046 3332 Dot3svc - ok
08:37:02.0078 3332 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\System32\DRIVERS\dpti2o.sys
08:37:02.0250 3332 dpti2o - ok
08:37:02.0296 3332 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
08:37:02.0437 3332 drmkaud - ok
08:37:02.0500 3332 DwMirror (383182215a2c238e76b86e3b5ede40eb) C:\WINDOWS\system32\DRIVERS\DamewareMini.sys
08:37:02.0531 3332 DwMirror - ok
08:37:02.0531 3332 DWMRCS - ok
08:37:02.0578 3332 dwvkbd (5a402c57f621114c99f813c6ae7bc37a) C:\WINDOWS\system32\DRIVERS\dwvkbd.sys
08:37:02.0640 3332 dwvkbd - ok
08:37:02.0671 3332 E100B (a6de5342417fec3c0aa8efebb899c431) C:\WINDOWS\system32\DRIVERS\e100b325.sys
08:37:02.0843 3332 E100B - ok
08:37:02.0875 3332 EapHost (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
08:37:03.0031 3332 EapHost - ok
08:37:03.0062 3332 epmntdrv (f07ba56b0235f15eff8f10dc6389c42e) C:\WINDOWS\system32\epmntdrv.sys
08:37:03.0343 3332 epmntdrv ( UnsignedFile.Multi.Generic ) - warning
08:37:03.0343 3332 epmntdrv - detected UnsignedFile.Multi.Generic (1)
08:37:03.0375 3332 ERSvc (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
08:37:03.0546 3332 ERSvc - ok
08:37:03.0562 3332 EuGdiDrv (1f2f4ab15ce03ecc257feb2f6dc5a013) C:\WINDOWS\system32\EuGdiDrv.sys
08:37:03.0578 3332 EuGdiDrv ( UnsignedFile.Multi.Generic ) - warning
08:37:03.0578 3332 EuGdiDrv - detected UnsignedFile.Multi.Generic (1)
08:37:03.0625 3332 Eventlog (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
08:37:03.0656 3332 Eventlog - ok
08:37:03.0703 3332 EventSystem (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\System32\es.dll
08:37:03.0734 3332 EventSystem - ok
08:37:03.0781 3332 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
08:37:03.0921 3332 Fastfat - ok
08:37:03.0953 3332 FastUserSwitchingCompatibility (40602ebfbe06aa075c8e4560743f6883) C:\WINDOWS\System32\shsvcs.dll
08:37:04.0125 3332 FastUserSwitchingCompatibility - ok
08:37:04.0156 3332 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
08:37:04.0296 3332 Fdc - ok
08:37:04.0328 3332 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
08:37:04.0515 3332 Fips - ok
08:37:04.0546 3332 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
08:37:04.0703 3332 Flpydisk - ok
08:37:04.0750 3332 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
08:37:04.0906 3332 FltMgr - ok
08:37:05.0046 3332 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
08:37:05.0078 3332 FontCache3.0.0.0 - ok
08:37:05.0125 3332 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
08:37:05.0296 3332 Fs_Rec - ok
08:37:05.0312 3332 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
08:37:05.0484 3332 Ftdisk - ok
08:37:05.0531 3332 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
08:37:05.0687 3332 Gpc - ok
08:37:05.0765 3332 helpsvc (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
08:37:05.0937 3332 helpsvc - ok
08:37:05.0953 3332 HidServ - ok
08:37:05.0984 3332 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
08:37:06.0140 3332 HidUsb - ok
08:37:06.0171 3332 hkmsvc (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
08:37:06.0343 3332 hkmsvc - ok
08:37:06.0359 3332 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\System32\DRIVERS\hpn.sys
08:37:06.0515 3332 hpn - ok
08:37:06.0578 3332 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
08:37:06.0625 3332 HTTP - ok
08:37:06.0656 3332 HTTPFilter (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
08:37:06.0812 3332 HTTPFilter - ok
08:37:06.0843 3332 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
08:37:06.0984 3332 i2omgmt - ok
08:37:07.0015 3332 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\System32\DRIVERS\i2omp.sys
08:37:07.0156 3332 i2omp - ok
08:37:07.0187 3332 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
08:37:07.0343 3332 i8042prt - ok
08:37:07.0421 3332 IDriverT (6f95324909b502e2651442c1548ab12f) C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
08:37:07.0500 3332 IDriverT ( UnsignedFile.Multi.Generic ) - warning
08:37:07.0500 3332 IDriverT - detected UnsignedFile.Multi.Generic (1)
08:37:07.0593 3332 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
08:37:07.0734 3332 idsvc - ok
08:37:07.0765 3332 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
08:37:07.0906 3332 Imapi - ok
08:37:07.0937 3332 ImapiService (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\System32\imapi.exe
08:37:08.0078 3332 ImapiService - ok
08:37:08.0125 3332 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\System32\DRIVERS\ini910u.sys
08:37:08.0312 3332 ini910u - ok
08:37:08.0328 3332 IntelIde (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\System32\DRIVERS\intelide.sys
08:37:08.0484 3332 IntelIde - ok
08:37:08.0531 3332 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
08:37:08.0687 3332 intelppm - ok
08:37:08.0734 3332 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
08:37:08.0875 3332 ip6fw - ok
08:37:08.0906 3332 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
08:37:09.0046 3332 IpFilterDriver - ok
08:37:09.0078 3332 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
08:37:09.0218 3332 IpInIp - ok
08:37:09.0265 3332 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
08:37:09.0406 3332 IpNat - ok
08:37:09.0437 3332 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
08:37:09.0578 3332 IPSec - ok
08:37:09.0609 3332 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
08:37:09.0750 3332 IRENUM - ok
08:37:09.0796 3332 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
08:37:09.0937 3332 isapnp - ok
08:37:10.0046 3332 JavaQuickStarterService (381b25dc8e958d905b33130d500bbf29) C:\Programme\Java\jre6\bin\jqs.exe
08:37:10.0062 3332 JavaQuickStarterService - ok
08:37:10.0093 3332 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
08:37:10.0234 3332 Kbdclass - ok
08:37:10.0265 3332 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
08:37:10.0500 3332 kmixer - ok
08:37:10.0546 3332 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
08:37:10.0593 3332 KSecDD - ok
08:37:10.0656 3332 lanmanserver (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
08:37:10.0687 3332 lanmanserver - ok
08:37:10.0734 3332 lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
08:37:10.0765 3332 lanmanworkstation - ok
08:37:10.0781 3332 lbrtfdc - ok
08:37:10.0828 3332 LmHosts (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
08:37:10.0968 3332 LmHosts - ok
08:37:11.0000 3332 MBAMProtector (fb097bbc1a18f044bd17bd2fccf97865) C:\WINDOWS\system32\drivers\mbam.sys
08:37:11.0015 3332 MBAMProtector - ok
08:37:11.0109 3332 MBAMService (ba400ed640bca1eae5c727ae17c10207) C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
08:37:11.0156 3332 MBAMService - ok
08:37:11.0234 3332 MDM (11f714f85530a2bd134074dc30e99fca) C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
08:37:11.0250 3332 MDM - ok
08:37:11.0281 3332 Messenger (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
08:37:11.0421 3332 Messenger - ok
08:37:11.0453 3332 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
08:37:11.0609 3332 mnmdd - ok
08:37:11.0640 3332 mnmsrvc (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\System32\mnmsrvc.exe
08:37:11.0796 3332 mnmsrvc - ok
08:37:11.0828 3332 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
08:37:11.0968 3332 Modem - ok
08:37:11.0984 3332 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
08:37:12.0125 3332 Mouclass - ok
08:37:12.0375 3332 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
08:37:12.0562 3332 mouhid - ok
08:37:12.0593 3332 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
08:37:12.0890 3332 MountMgr - ok
08:37:12.0953 3332 MozillaMaintenance (6380ff81dd4d78b23398752d2f46ea43) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
08:37:13.0015 3332 MozillaMaintenance - ok
08:37:13.0046 3332 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\System32\DRIVERS\mraid35x.sys
08:37:13.0203 3332 mraid35x - ok
08:37:13.0234 3332 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
08:37:13.0375 3332 MRxDAV - ok
08:37:13.0437 3332 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
08:37:13.0500 3332 MRxSmb - ok
08:37:13.0546 3332 MSDTC (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\System32\msdtc.exe
08:37:13.0703 3332 MSDTC - ok
08:37:13.0750 3332 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
08:37:13.0921 3332 Msfs - ok
08:37:13.0937 3332 MSIServer - ok
08:37:13.0968 3332 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
08:37:14.0125 3332 MSKSSRV - ok
08:37:14.0140 3332 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
08:37:14.0296 3332 MSPCLOCK - ok
08:37:14.0312 3332 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
08:37:14.0484 3332 MSPQM - ok
08:37:14.0515 3332 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
08:37:14.0656 3332 mssmbios - ok
08:37:14.0718 3332 MSSQL$SQLEXPRESS - ok
08:37:14.0765 3332 MSSQLServerADHelper (adaf062116b4e6d96e44d26486a87af6) C:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe
08:37:14.0796 3332 MSSQLServerADHelper - ok
08:37:14.0843 3332 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
08:37:14.0984 3332 Mup - ok
08:37:15.0031 3332 napagent (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
08:37:15.0203 3332 napagent - ok
08:37:15.0234 3332 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
08:37:15.0390 3332 NDIS - ok
08:37:15.0421 3332 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
08:37:15.0562 3332 NdisTapi - ok
08:37:15.0593 3332 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
08:37:15.0734 3332 Ndisuio - ok
08:37:15.0750 3332 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
08:37:15.0937 3332 NdisWan - ok
08:37:15.0984 3332 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
08:37:16.0046 3332 NDProxy - ok
08:37:16.0109 3332 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
08:37:16.0250 3332 NetBIOS - ok
08:37:16.0296 3332 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
08:37:16.0437 3332 NetBT - ok
08:37:16.0468 3332 NetDDE (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
08:37:16.0625 3332 NetDDE - ok
08:37:16.0625 3332 NetDDEdsdm (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
08:37:16.0765 3332 NetDDEdsdm - ok
08:37:16.0796 3332 Netlogon (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
08:37:16.0953 3332 Netlogon - ok
08:37:16.0984 3332 Netman (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
08:37:17.0140 3332 Netman - ok
08:37:17.0265 3332 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
08:37:17.0312 3332 NetTcpPortSharing - ok
08:37:17.0359 3332 Nla (acd8bd448a74f344d46fcaf21bab92af) C:\WINDOWS\System32\mswsock.dll
08:37:17.0390 3332 Nla - ok
08:37:17.0453 3332 NMSAccess (7aea4df1ca68fd45dd4bbe1f0243ce7f) C:\Programme\CDBurnerXP\NMSAccessU.exe
08:37:17.0468 3332 NMSAccess - ok
08:37:17.0500 3332 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
08:37:17.0640 3332 Npfs - ok
08:37:17.0687 3332 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
08:37:17.0875 3332 Ntfs - ok
08:37:17.0921 3332 NtLmSsp (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
08:37:18.0046 3332 NtLmSsp - ok
08:37:18.0093 3332 NtmsSvc (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
08:37:18.0281 3332 NtmsSvc - ok
08:37:18.0328 3332 ntrtscan (cec052d67b20f5be1d46cb73aa169b38) C:\Programme\Trend Micro\OfficeScan Client\ntrtscan.exe
08:37:18.0421 3332 ntrtscan ( UnsignedFile.Multi.Generic ) - warning
08:37:18.0421 3332 ntrtscan - detected UnsignedFile.Multi.Generic (1)
08:37:18.0484 3332 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
08:37:18.0734 3332 Null - ok
08:37:18.0750 3332 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
08:37:19.0000 3332 NwlnkFlt - ok
08:37:19.0000 3332 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
08:37:19.0281 3332 NwlnkFwd - ok
08:37:19.0343 3332 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
08:37:19.0421 3332 ose - ok
08:37:19.0781 3332 osppsvc (358a9cca612c68eb2f07ddad4ce1d8d7) C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
08:37:20.0218 3332 osppsvc - ok
08:37:20.0437 3332 P3 (a7af0c0860f1c43fc6581ba8a99eabef) C:\WINDOWS\system32\DRIVERS\p3.sys
08:37:20.0640 3332 P3 - ok
08:37:20.0687 3332 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
08:37:20.0875 3332 Parport - ok
08:37:20.0906 3332 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
08:37:21.0046 3332 PartMgr - ok
08:37:21.0093 3332 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
08:37:21.0234 3332 ParVdm - ok
08:37:21.0250 3332 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
08:37:21.0406 3332 PCI - ok
08:37:21.0421 3332 PCIDump - ok
08:37:21.0421 3332 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
08:37:21.0578 3332 PCIIde - ok
08:37:21.0593 3332 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
08:37:21.0750 3332 Pcmcia - ok
08:37:21.0750 3332 PDCOMP - ok
08:37:21.0765 3332 PDFRAME - ok
08:37:21.0765 3332 PDRELI - ok
08:37:21.0781 3332 PDRFRAME - ok
08:37:21.0812 3332 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\System32\DRIVERS\perc2.sys
08:37:21.0968 3332 perc2 - ok
08:37:21.0968 3332 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\System32\DRIVERS\perc2hib.sys
08:37:22.0125 3332 perc2hib - ok
08:37:22.0171 3332 PlugPlay (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
08:37:22.0187 3332 PlugPlay - ok
08:37:22.0203 3332 PolicyAgent (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
08:37:22.0343 3332 PolicyAgent - ok
08:37:22.0375 3332 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
08:37:22.0531 3332 PptpMiniport - ok
08:37:22.0546 3332 Processor (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys
08:37:22.0687 3332 Processor - ok
08:37:22.0703 3332 ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
08:37:22.0828 3332 ProtectedStorage - ok
08:37:22.0843 3332 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
08:37:23.0000 3332 PSched - ok
08:37:23.0046 3332 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
08:37:23.0187 3332 Ptilink - ok
08:37:23.0218 3332 PxHelp20 (1962166e0ceb740704f30fa55ad3d509) C:\WINDOWS\system32\Drivers\PxHelp20.sys
08:37:23.0234 3332 PxHelp20 ( UnsignedFile.Multi.Generic ) - warning
08:37:23.0234 3332 PxHelp20 - detected UnsignedFile.Multi.Generic (1)
08:37:23.0265 3332 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\System32\DRIVERS\ql1080.sys
08:37:23.0406 3332 ql1080 - ok
08:37:23.0421 3332 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\System32\DRIVERS\ql10wnt.sys
08:37:23.0562 3332 Ql10wnt - ok
08:37:23.0578 3332 ql12160 (c7fc707980dd382f92b6d88b2258a0dc) C:\WINDOWS\System32\DRIVERS\ql12160.sys
08:37:23.0625 3332 ql12160 - ok
08:37:23.0625 3332 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\System32\DRIVERS\ql1240.sys
08:37:23.0765 3332 ql1240 - ok
08:37:23.0796 3332 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\System32\DRIVERS\ql1280.sys
08:37:23.0921 3332 ql1280 - ok
08:37:23.0953 3332 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
08:37:24.0093 3332 RasAcd - ok
08:37:24.0125 3332 RasAuto (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
08:37:24.0265 3332 RasAuto - ok
08:37:24.0296 3332 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
08:37:24.0437 3332 Rasl2tp - ok
08:37:24.0484 3332 RasMan (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
08:37:24.0656 3332 RasMan - ok
08:37:24.0671 3332 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
08:37:24.0812 3332 RasPppoe - ok
08:37:24.0843 3332 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
08:37:24.0984 3332 Raspti - ok
08:37:25.0015 3332 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
08:37:25.0171 3332 Rdbss - ok
08:37:25.0218 3332 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
08:37:25.0359 3332 RDPCDD - ok
08:37:25.0421 3332 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
08:37:25.0593 3332 rdpdr - ok
08:37:25.0734 3332 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
08:37:26.0156 3332 RDPWD - ok
08:37:26.0203 3332 RDSessMgr (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
08:37:26.0484 3332 RDSessMgr - ok
08:37:26.0531 3332 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
08:37:26.0781 3332 redbook - ok
08:37:26.0812 3332 RemoteAccess (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
08:37:27.0046 3332 RemoteAccess - ok
08:37:27.0078 3332 RemoteRegistry (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll
08:37:27.0234 3332 RemoteRegistry - ok
08:37:27.0265 3332 RpcLocator (2a02e21867497df20b8fc95631395169) C:\WINDOWS\System32\locator.exe
08:37:27.0421 3332 RpcLocator - ok
08:37:27.0765 3332 RpcSs (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
08:37:27.0796 3332 RpcSs - ok
08:37:27.0953 3332 RSVP (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\System32\rsvp.exe
08:37:28.0250 3332 RSVP - ok
08:37:28.0562 3332 SageDeploymentService (c3b35487cfb25357d313625a691e1200) C:\Programme\Gemeinsame Dateien\Sage Software Shared\Deploymentservice.exe
08:37:28.0671 3332 SageDeploymentService - ok
08:37:28.0718 3332 SamSs (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
08:37:28.0937 3332 SamSs - ok
08:37:28.0984 3332 SCardSvr (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
08:37:29.0296 3332 SCardSvr - ok
08:37:29.0421 3332 Schedule (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
08:37:29.0578 3332 Schedule - ok
08:37:29.0671 3332 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
08:37:29.0796 3332 Secdrv - ok
08:37:29.0828 3332 seclogon (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
08:37:29.0953 3332 seclogon - ok
08:37:29.0968 3332 SENS (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
08:37:30.0125 3332 SENS - ok
08:37:30.0156 3332 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
08:37:30.0296 3332 serenum - ok
08:37:30.0328 3332 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
08:37:30.0468 3332 Serial - ok
08:37:30.0546 3332 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
08:37:30.0687 3332 Sfloppy - ok
08:37:30.0750 3332 SFUSVC (5944ecbcf555dedd7f48f9982d5ddff4) C:\Programme\Kyocera Mita\FileUtility\SFUSVC.exe
08:37:30.0750 3332 SFUSVC ( UnsignedFile.Multi.Generic ) - warning
08:37:30.0750 3332 SFUSVC - detected UnsignedFile.Multi.Generic (1)
08:37:30.0812 3332 SharedAccess (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
08:37:31.0000 3332 SharedAccess - ok
08:37:31.0031 3332 ShellHWDetection (40602ebfbe06aa075c8e4560743f6883) C:\WINDOWS\System32\shsvcs.dll
08:37:31.0171 3332 ShellHWDetection - ok
08:37:31.0171 3332 Simbad - ok
08:37:31.0250 3332 SiS315 (94f6eea8a688a37f71bf9c9aeaa42666) C:\WINDOWS\system32\DRIVERS\sisgrp.sys
08:37:31.0328 3332 SiS315 - ok
08:37:31.0359 3332 sisagp (61ca562def09a782d26b3e7edec5369a) C:\WINDOWS\system32\DRIVERS\SISAGPX.sys
08:37:31.0390 3332 sisagp - ok
08:37:31.0406 3332 SiSide (b4485881bd8aed9b157a2e6cf43c2d51) C:\WINDOWS\system32\DRIVERS\siside.sys
08:37:31.0437 3332 SiSide - ok
08:37:31.0468 3332 SiSkp (837d26f79a1647066d75c5c811887475) C:\WINDOWS\system32\DRIVERS\srvkp.sys
08:37:31.0484 3332 SiSkp - ok
08:37:31.0562 3332 snapman (90257773f4b4065bd0c6cc2164fd52e5) C:\WINDOWS\system32\DRIVERS\snapman.sys
08:37:31.0609 3332 snapman ( UnsignedFile.Multi.Generic ) - warning
08:37:31.0609 3332 snapman - detected UnsignedFile.Multi.Generic (1)
08:37:31.0640 3332 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\System32\DRIVERS\sparrow.sys
08:37:31.0734 3332 Sparrow - ok
08:37:31.0765 3332 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
08:37:31.0890 3332 splitter - ok
08:37:31.0937 3332 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
08:37:31.0984 3332 Spooler - ok
08:37:32.0062 3332 SQLBrowser (5673e79bbb62a4c35b10d821ff1b4aca) C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe
08:37:32.0078 3332 SQLBrowser - ok
08:37:32.0093 3332 SQLWriter (9263c8898732e2b890f7e954e7729ab7) C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
08:37:32.0140 3332 SQLWriter - ok
08:37:32.0171 3332 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
08:37:32.0328 3332 sr - ok
08:37:32.0375 3332 srservice (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\System32\srsvc.dll
08:37:32.0515 3332 srservice - ok
08:37:32.0578 3332 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
08:37:32.0609 3332 Srv - ok
08:37:32.0656 3332 SSDPSRV (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
08:37:32.0796 3332 SSDPSRV - ok
08:37:32.0828 3332 StarOpen (f92254b0bcfcd10caac7bccc7cb7f467) C:\WINDOWS\system32\drivers\StarOpen.sys
08:37:32.0843 3332 StarOpen ( UnsignedFile.Multi.Generic ) - warning
08:37:32.0843 3332 StarOpen - detected UnsignedFile.Multi.Generic (1)
08:37:32.0890 3332 StillCam (a2dbcc4c8860449df1ab758ea28b4de0) C:\WINDOWS\system32\DRIVERS\serscan.sys
08:37:33.0031 3332 StillCam - ok
08:37:33.0093 3332 stisvc (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
08:37:33.0281 3332 stisvc - ok
08:37:33.0328 3332 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
08:37:33.0453 3332 swenum - ok
08:37:33.0734 3332 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
08:37:33.0890 3332 swmidi - ok
08:37:33.0890 3332 SwPrv - ok
08:37:33.0937 3332 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\System32\DRIVERS\symc810.sys
08:37:34.0078 3332 symc810 - ok
08:37:34.0093 3332 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\System32\DRIVERS\symc8xx.sys
08:37:34.0250 3332 symc8xx - ok
08:37:34.0281 3332 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\System32\DRIVERS\sym_hi.sys
08:37:34.0437 3332 sym_hi - ok
08:37:34.0453 3332 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\System32\DRIVERS\sym_u3.sys
08:37:34.0609 3332 sym_u3 - ok
08:37:34.0640 3332 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
08:37:34.0796 3332 sysaudio - ok
08:37:34.0843 3332 SysmonLog (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
08:37:35.0000 3332 SysmonLog - ok
08:37:35.0046 3332 TapiSrv (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
08:37:35.0187 3332 TapiSrv - ok
08:37:35.0234 3332 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
08:37:35.0359 3332 Tcpip - ok
08:37:35.0421 3332 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
08:37:35.0546 3332 TDPIPE - ok
08:37:35.0578 3332 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
08:37:35.0718 3332 TDTCP - ok
08:37:35.0734 3332 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
08:37:35.0875 3332 TermDD - ok
08:37:35.0921 3332 TermService (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
08:37:36.0078 3332 TermService - ok
08:37:36.0109 3332 Themes (40602ebfbe06aa075c8e4560743f6883) C:\WINDOWS\System32\shsvcs.dll
08:37:36.0250 3332 Themes - ok
08:37:36.0312 3332 tifsfilter (7369f74dd9172c6527a8aceb010e28f1) C:\WINDOWS\system32\DRIVERS\tifsfilt.sys
08:37:36.0343 3332 tifsfilter ( UnsignedFile.Multi.Generic ) - warning
08:37:36.0343 3332 tifsfilter - detected UnsignedFile.Multi.Generic (1)
08:37:36.0406 3332 timounter (53fec95b844c46489f6683dc0a606e01) C:\WINDOWS\system32\DRIVERS\timntr.sys
08:37:36.0421 3332 timounter ( UnsignedFile.Multi.Generic ) - warning
08:37:36.0421 3332 timounter - detected UnsignedFile.Multi.Generic (1)
08:37:36.0468 3332 TlntSvr (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\System32\tlntsvr.exe
08:37:36.0609 3332 TlntSvr - ok
08:37:36.0703 3332 TmFilter (ac940a15959be57958b91cdb914aaa6c) C:\Programme\Trend Micro\OfficeScan Client\TmXPFlt.sys
08:37:36.0750 3332 TmFilter - ok
08:37:36.0796 3332 tmlisten (74efd08250cb5830e8acbd6eeae7418a) C:\Programme\Trend Micro\OfficeScan Client\tmlisten.exe
08:37:36.0859 3332 tmlisten ( UnsignedFile.Multi.Generic ) - warning
08:37:36.0859 3332 tmlisten - detected UnsignedFile.Multi.Generic (1)
08:37:36.0906 3332 TmPreFilter (8651a867c78bd2b69f1d5f982138a074) C:\Programme\Trend Micro\OfficeScan Client\TmPreFlt.sys
08:37:36.0921 3332 TmPreFilter - ok
08:37:36.0968 3332 TosIde (d213a9247dc347f305a2d4cc9b951487) C:\WINDOWS\System32\DRIVERS\toside.sys
08:37:37.0093 3332 TosIde - ok
08:37:37.0125 3332 TrkWks (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
08:37:37.0281 3332 TrkWks - ok
08:37:37.0359 3332 TuneUp.Defrag (6a29cd69d1128bdf49a705befc614a5b) C:\WINDOWS\System32\TuneUpDefragService.exe
08:37:37.0375 3332 TuneUp.Defrag - ok
08:37:37.0453 3332 TuneUp.ProgramStatisticsSvc (51ee2913ed525de18fda96dccbc5386a) C:\WINDOWS\System32\TUProgSt.exe
08:37:37.0500 3332 TuneUp.ProgramStatisticsSvc - ok
08:37:37.0546 3332 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
08:37:37.0703 3332 Udfs - ok
08:37:37.0734 3332 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\System32\DRIVERS\ultra.sys
08:37:37.0812 3332 ultra - ok
08:37:37.0875 3332 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
08:37:38.0046 3332 Update - ok
08:37:38.0093 3332 upnphost (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
08:37:38.0234 3332 upnphost - ok
08:37:38.0343 3332 UPS (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
08:37:38.0484 3332 UPS - ok
08:37:38.0531 3332 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
08:37:38.0671 3332 usbccgp - ok
08:37:38.0703 3332 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
08:37:38.0843 3332 usbehci - ok
08:37:38.0890 3332 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
08:37:39.0046 3332 usbhub - ok
08:37:39.0078 3332 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
08:37:39.0218 3332 usbohci - ok
08:37:39.0234 3332 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
08:37:39.0421 3332 usbscan - ok
08:37:39.0453 3332 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
08:37:39.0609 3332 USBSTOR - ok
08:37:39.0640 3332 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
08:37:39.0781 3332 usbuhci - ok
08:37:39.0812 3332 UxTuneUp (2e2e93041c8058bc7de6f0d743c4a0c6) C:\WINDOWS\System32\uxtuneup.dll
08:37:39.0828 3332 UxTuneUp - ok
08:37:39.0859 3332 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
08:37:40.0000 3332 VgaSave - ok
08:37:40.0046 3332 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
08:37:40.0187 3332 viaagp - ok
08:37:40.0218 3332 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\System32\DRIVERS\viaide.sys
08:37:40.0359 3332 ViaIde - ok
08:37:40.0375 3332 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
08:37:40.0546 3332 VolSnap - ok
08:37:40.0656 3332 VSApiNt (71a53597bfb4bad7218ad2beaba5c564) C:\Programme\Trend Micro\OfficeScan Client\VSApiNt.sys
08:37:40.0812 3332 VSApiNt - ok
08:37:40.0953 3332 VSS (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
08:37:41.0109 3332 VSS - ok
08:37:41.0156 3332 W32Time (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\System32\w32time.dll
08:37:41.0312 3332 W32Time - ok
08:37:41.0406 3332 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
08:37:41.0546 3332 Wanarp - ok
08:37:41.0562 3332 WDICA - ok
08:37:41.0593 3332 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
08:37:41.0750 3332 wdmaud - ok
08:37:41.0796 3332 WebClient (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
08:37:41.0953 3332 WebClient - ok
08:37:42.0046 3332 winmgmt (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
08:37:42.0187 3332 winmgmt - ok
08:37:42.0312 3332 winvnc (b84873b030e66ddf3964a31793bb4211) D:\Programme\RealVNC\WinVNC\WinVNC.exe
08:37:42.0375 3332 winvnc ( UnsignedFile.Multi.Generic ) - warning
08:37:42.0375 3332 winvnc - detected UnsignedFile.Multi.Generic (1)
08:37:42.0406 3332 WmdmPmSN (6e18978b749f0696a774de3f2cb142dd) C:\WINDOWS\system32\mspmsnsv.dll
08:37:42.0546 3332 WmdmPmSN - ok
08:37:42.0609 3332 Wmi (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll
08:37:42.0671 3332 Wmi - ok
08:37:42.0718 3332 WmiApSrv (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\System32\wbem\wmiapsrv.exe
08:37:42.0890 3332 WmiApSrv - ok
08:37:43.0062 3332 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
08:37:43.0156 3332 WPFFontCache_v0400 - ok
08:37:43.0187 3332 wscsvc (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
08:37:43.0343 3332 wscsvc - ok
08:37:43.0359 3332 wuauserv (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
08:37:43.0515 3332 wuauserv - ok
08:37:43.0562 3332 WZCSVC (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
08:37:43.0734 3332 WZCSVC - ok
08:37:43.0781 3332 xmlprov (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
08:37:43.0921 3332 xmlprov - ok
08:37:43.0953 3332 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
08:37:44.0421 3332 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
08:37:44.0421 3332 \Device\Harddisk0\DR0 - detected TDSS File System (1)
08:37:44.0437 3332 Boot (0x1200) (8fed00eaa87fc9a3d1c5a52232bb0ee8) \Device\Harddisk0\DR0\Partition0
08:37:44.0437 3332 \Device\Harddisk0\DR0\Partition0 - ok
08:37:44.0468 3332 Boot (0x1200) (1bbc1b3ed6fbfe61fa2ad89e49c32fac) \Device\Harddisk0\DR0\Partition1
08:37:44.0468 3332 \Device\Harddisk0\DR0\Partition1 - ok
08:37:44.0468 3332 ============================================================
08:37:44.0468 3332 Scan finished
08:37:44.0468 3332 ============================================================
08:37:44.0593 3232 Detected object count: 17
08:37:44.0593 3232 Actual detected object count: 17
08:38:54.0546 3232 C:\WINDOWS\system32\DRIVERS\ACPI.sys - copied to quarantine
08:38:54.0953 3232 Backup copy found, using it..
08:38:55.0000 3232 C:\WINDOWS\system32\DRIVERS\ACPI.sys - will be cured on reboot
08:38:55.0000 3232 ACPI ( Virus.Win32.Rloader.a ) - User select action: Cure
08:38:55.0015 3232 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0015 3232 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0015 3232 bizVSerial ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0015 3232 bizVSerial ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0015 3232 cjpcsc ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0015 3232 cjpcsc ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0031 3232 epmntdrv ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0031 3232 epmntdrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0031 3232 EuGdiDrv ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0031 3232 EuGdiDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0031 3232 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0031 3232 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0046 3232 ntrtscan ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0046 3232 ntrtscan ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0046 3232 PxHelp20 ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0046 3232 PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0062 3232 SFUSVC ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0062 3232 SFUSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0062 3232 snapman ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0062 3232 snapman ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0062 3232 StarOpen ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0062 3232 StarOpen ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0078 3232 tifsfilter ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0078 3232 tifsfilter ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0078 3232 timounter ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0078 3232 timounter ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0078 3232 tmlisten ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0078 3232 tmlisten ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0093 3232 winvnc ( UnsignedFile.Multi.Generic ) - skipped by user
08:38:55.0093 3232 winvnc ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:38:55.0093 3232 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
08:38:55.0093 3232 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip
Beim Combofix gab es Probleme da keine Wiederherstellungskonsole installiert war. Ich mußte das Netzwerkkabel wieder anstecken.. Hab Sie dann nach installiert. Ich hoffe das hat das Ergebnis nicht beeinflusst Code:
ATTFilter Combofix Logfile: |
|
15.06.2012, 21:23
| #6 |
| | Google leitet mich auf werbeseiten um Hi, Scan mit SystemLook Lade SystemLook von einem der folgenden Links und speichere das Tool auf dem Desktop. 32Bit 64Bit
Code:
ATTFilter
:filefind
FM20ENU.DLL
Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert. Malwarebytes Antimalware (MAM) Anleitung&Download hier: http://www.trojaner-board.de/51187-m...i-malware.html Falls der Download nicht klappt, bitte hierüber eine generische Version runterladen: http://filepony.de/download-chameleon/ Danach bitte update der Signaturdateien (Reiter "Aktualisierungen" -> Suche nach Aktualisierungen") Fullscan und alles bereinigen lassen! Log posten. chris
__________________ --> Google leitet mich auf werbeseiten um |
|
16.06.2012, 19:36
| #7 |
| | Google leitet mich auf werbeseiten um Hi, kann erst am Montag weitermachen Danke schonmal vg |
|
18.06.2012, 07:13
| #8 |
| | Google leitet mich auf werbeseiten um SystemLook 30.07.11 by jpshortstuff Log created at 08:15 on 18/06/2012 by npc18 Administrator - Elevation successful No Context: FM20ENU.DLL -= EOF =- |
|
18.06.2012, 07:38
| #9 |
| | Google leitet mich auf werbeseiten um Hi, die Anweisung ":Filefind" hattest Du mit in die Box kopiert? Sind noch Umleitungen im Browser vorhanden? chris
__________________ Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) |
|
18.06.2012, 08:59
| #10 |
| | Google leitet mich auf werbeseiten um Hallo, nein hatte ich nicht.. hier nochmal zu deiner Frage konnte jetzt keine Umleitungen mehr feststellen Was ist jetzt mit dieser dll Datei? SystemLook 30.07.11 by jpshortstuff Log created at 09:57 on 18/06/2012 by npc18 Administrator - Elevation successful ========== filefind ========== Searching for "FM20ENU.DLL" C:\WINDOWS\system32\FM20ENU.DLL --a---- 31616 bytes [16:20 20/02/2010] [16:20 20/02/2010] 361D4D77411D2FBA1DE48C9A6B913CAC -= EOF =- hier noch malwarbyte Report vor den Filefind Malwarebytes Anti-Malware (Test) 1.61.0.1400 www.malwarebytes.org Datenbank Version: v2012.06.18.03 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 npc18 :: NPC18 [Administrator] Schutz: Aktiviert 18.06.2012 08:17:08 mbam-log-2012-06-18 (08-17-08).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 379755 Laufzeit: 1 Stunde(n), 13 Minute(n), 47 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Geändert von stefgig12 (18.06.2012 um 09:00 Uhr) Grund: Ergänzung |
|
18.06.2012, 09:19
| #11 |
| | Google leitet mich auf werbeseiten um Hi, ist ok, dann wären wir erstmal durch... chris
__________________ Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) |
|
18.06.2012, 09:35
| #12 |
| | Google leitet mich auf werbeseiten um Super Danke euch allen für die tolle Hilfe  |
|
20.06.2012, 08:29
| #13 |
| | Google leitet mich auf werbeseiten um Ich muß mich hier nochmals melden. Habe nun nach der Bekämpfung Probleme mit dem Benutzer. Irgendwie glaube ich ist das Profil defekt. Der User hat keine Rechte mehr auf die SQL-Datenbank Als Admin klappt es ohne Probleme mit dem Rechner. Desweiteren ist unter Systemsteuerung die Verwaltung komplett leer VG Stef |
|
20.06.2012, 08:45
| #14 |
| | Google leitet mich auf werbeseiten um Hi, am besten einen neuen Benutzer anlegen/einrichten... Prüfe mal ob es dann klappt... chris
__________________ Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) |
|
| Themen zu Google leitet mich auf werbeseiten um |
| bereits, fehler, gefunde, google, hoffe, housecall, kleines, kurzer, leitet, link, nicht mehr, problem, rechts, suche, sucht, unternehmen, versuch, versucht, werbeseite, werbeseiten |
Linear-Darstellung
