Kaspersky startet nicht

Tina666 · 10.11.2012, 21:22

Hallo,

Kasperky öffntet sich nicht. Es ist die Firewall aktiv, aber der Virenschutz ist nicht vorhanden.
habe alles deinstalliert und neu aufgezogen, aber es tut sich nichts.

Dieses Problem begann mit dem Bereinigen des PC's. Es kam schleichend, d. h. Anfangs ist er vielleicht bei jedem 5. hochfahren nicht gestartet, und nun gar nicht mehr.

Kann es sein, daß ich noch i-wo vom Bereinigen was habe, was da evtl. kollidiert?

Tina

Tina666 · 11.11.2012, 21:28

Nun habe ich selber etwas gestöbert. E ist ja auch Steganos live encyption engine 17 drauf. K. A., wo das herkommt.
Nun habe ich das hier gefunden:

Steganos Security Suite Boot-Patch

Was haltet ihr davon? soll ich das mal versuchen?

stefanbecker · 11.11.2012, 21:43

Da ist garantiert irgendwas aktiv, was nicht will, dass der Scanner aktiviert wird.

Du stocherst doch im Trüben. Ich würde neu installieren, danach hat man wieder einen vertrauenswürdigen Zustand.

Tina666 · 11.11.2012, 21:52

Hi,

ich hab Kasperky deinstalliert und neu installiert. Geht trotzdem nicht.

Tina

stefanbecker · 12.11.2012, 00:34

Ich meinte auch Windows und nicht Kaspersky.

Tina666 · 12.11.2012, 01:00

Windows neu installieren????

stefanbecker · 12.11.2012, 06:05

Ich zähle 1 und zusammen. Der Rechner war infiziert und wurde augenscheinlich bereinigt.

Wenn AV oder Firewall sich nicht aktivieren lassen, sind das Indizien dafür, das im Hintergrund noch was werkelt, das die Aktivierung nicht zulässt. Das wurde nicht entdeckt (habe deinen Thread mal gelesen). Und das ist bestimmt nicht OTL oder Eset Online.

Fazit: Platte+MBR platt machen, Windows neu installieren. Dann geht es wieder.

Anders kriegst du so was nicht in einen vertrauenswürdigen Zustand.

Tina666 · 12.11.2012, 23:32

Hi,

anders kann man es nicht machen? Das, was Du vorschlägt, ist mehr als eine Nummer zu groß für mich, das kann ich nicht, hab da viel zu viel Angst, daß da was passiert.

Tina

cosinus · 13.11.2012, 09:20

Hallo,

Stefan hat zwar Recht, dass man nur 100% sicher sein kann wenn man neu aufsetzt, aber das Problem muss nicht unbedingt durch noch schlummernde Malware verursacht werden.

Zitat:

Zitat von stefanbecker

Fazit: Platte+MBR platt machen, Windows neu installieren. Dann geht es wieder.

@Stefan:
wer garantiert dir das? Vllt ist es ja ein anderer Fehler in Kaspersky, der NICHT durch eine komplettte Neuinstallation behoben wird

@Tina:
Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.

Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.
Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.
Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!
Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!
Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.

1. aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehlalarm!

Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

2. TDSS-Killer

Download TDSS-Killer auf Desktop siehe => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

Tina666 · 13.11.2012, 23:14

Hallo Cosinus,

danke erstmal für Deine Mühe. Hier ist der erste Code:

Code:

ATTFilter

aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-13 22:09:47
-----------------------------
22:09:47.687    OS Version: Windows 5.1.2600 Service Pack 3
22:09:47.687    Number of processors: 2 586 0x605
22:09:47.687    ComputerName: MOTIONSIGN  UserName: Hartmann
22:09:48.625    Initialize success
22:17:30.250    AVAST engine defs: 12111301
22:17:50.750    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-f
22:17:50.750    Disk 0 Vendor: SAMSUNG_HD501LJ CR100-13 Size: 476940MB BusType: 3
22:17:50.750    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T1L0-17
22:17:50.750    Disk 1 Vendor: SAMSUNG_HD642JJ 1AA01118 Size: 610480MB BusType: 3
22:17:50.781    Disk 0 MBR read successfully
22:17:50.781    Disk 0 MBR scan
22:17:50.812    Disk 0 Windows XP default MBR code
22:17:50.828    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       476937 MB offset 63
22:17:50.843    Disk 0 scanning sectors +976768065
22:17:50.906    Disk 0 scanning C:\WINDOWS\system32\drivers
22:18:06.421    Service scanning
22:18:27.468    Modules scanning
22:18:33.078    Disk 0 trace - called modules:
22:18:33.640    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys atapi.sys pciide.sys PCIIDEX.SYS 
22:18:33.640    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8abb5ab8]
22:18:33.656    3 CLASSPNP.SYS[f7667fd7] -> nt!IofCallDriver -> \Device\00000080[0x8ac59f18]
22:18:33.656    5 ACPI.sys[f75ad620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-f[0x8ac16d98]
22:18:33.656    \Driver\atapi[0x8ac592f8] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> sfsync02.sys[0xf76388b4]
22:18:34.593    AVAST engine scan C:\WINDOWS
22:18:58.281    AVAST engine scan C:\WINDOWS\system32
22:23:20.859    AVAST engine scan C:\WINDOWS\system32\drivers
22:23:53.187    AVAST engine scan C:\Dokumente und Einstellungen\Hartmann
22:57:04.765    AVAST engine scan C:\Dokumente und Einstellungen\All Users
23:10:54.500    Scan finished successfully
23:12:29.234    Disk 0 MBR has been saved successfully to "C:\Bereinigung\MBR.dat"
23:12:29.234    The log file has been saved successfully to "C:\Bereinigung\aswMBR.txt"

Und hier TDSS:

Code:

ATTFilter

23:16:37.0906 0692  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
23:16:38.0375 0692  ============================================================
23:16:38.0375 0692  Current date / time: 2012/11/13 23:16:38.0375
23:16:38.0375 0692  SystemInfo:
23:16:38.0375 0692  
23:16:38.0375 0692  OS Version: 5.1.2600 ServicePack: 3.0
23:16:38.0375 0692  Product type: Workstation
23:16:38.0375 0692  ComputerName: MOTIONSIGN
23:16:38.0375 0692  UserName: Hartmann
23:16:38.0375 0692  Windows directory: C:\WINDOWS
23:16:38.0375 0692  System windows directory: C:\WINDOWS
23:16:38.0375 0692  Processor architecture: Intel x86
23:16:38.0375 0692  Number of processors: 2
23:16:38.0375 0692  Page size: 0x1000
23:16:38.0375 0692  Boot type: Normal boot
23:16:38.0375 0692  ============================================================
23:16:39.0562 0692  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
23:16:39.0578 0692  Drive \Device\Harddisk1\DR1 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
23:16:39.0578 0692  ============================================================
23:16:39.0578 0692  \Device\Harddisk0\DR0:
23:16:39.0578 0692  MBR partitions:
23:16:39.0578 0692  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A384C02
23:16:39.0578 0692  \Device\Harddisk1\DR1:
23:16:39.0578 0692  MBR partitions:
23:16:39.0578 0692  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4A852FC1
23:16:39.0578 0692  ============================================================
23:16:39.0609 0692  C: <-> \Device\Harddisk0\DR0\Partition1
23:16:39.0625 0692  D: <-> \Device\Harddisk1\DR1\Partition1
23:16:39.0625 0692  ============================================================
23:16:39.0625 0692  Initialize success
23:16:39.0625 0692  ============================================================
23:17:55.0687 2416  ============================================================
23:17:55.0687 2416  Scan started
23:17:55.0687 2416  Mode: Manual; SigCheck; TDLFS; 
23:17:55.0687 2416  ============================================================
23:17:57.0156 2416  ================ Scan system memory ========================
23:17:57.0171 2416  System memory - ok
23:17:57.0171 2416  ================ Scan services =============================
23:17:57.0265 2416  Abiosdsk - ok
23:17:57.0281 2416  abp480n5 - ok
23:17:57.0312 2416  [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI            C:\WINDOWS\system32\DRIVERS\ACPI.sys
23:17:57.0656 2416  ACPI - ok
23:17:57.0734 2416  [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC          C:\WINDOWS\system32\drivers\ACPIEC.sys
23:17:57.0859 2416  ACPIEC - ok
23:17:57.0906 2416  [ 0CB0AA071C7B86A64F361DCFDF357329 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
23:17:57.0921 2416  AdobeFlashPlayerUpdateSvc - ok
23:17:57.0937 2416  adpu160m - ok
23:17:57.0968 2416  [ 8BED39E3C35D6A489438B8141717A557 ] aec             C:\WINDOWS\system32\drivers\aec.sys
23:17:58.0109 2416  aec - ok
23:17:58.0203 2416  [ A7B8A3A79D35215D798A300DF49ED23F ] Afc             C:\WINDOWS\system32\drivers\Afc.sys
23:17:58.0218 2416  Afc ( UnsignedFile.Multi.Generic ) - warning
23:17:58.0218 2416  Afc - detected UnsignedFile.Multi.Generic (1)
23:17:58.0250 2416  [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD             C:\WINDOWS\System32\drivers\afd.sys
23:17:58.0296 2416  AFD - ok
23:17:58.0296 2416  Aha154x - ok
23:17:58.0296 2416  aic78u2 - ok
23:17:58.0312 2416  aic78xx - ok
23:17:58.0390 2416  [ 4E0ACA5290B2966F24C45250A56C2DA1 ] ALCXWDM         C:\WINDOWS\system32\drivers\ALCXWDM.SYS
23:17:58.0578 2416  ALCXWDM - ok
23:17:58.0625 2416  [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter         C:\WINDOWS\system32\alrsvc.dll
23:17:58.0750 2416  Alerter - ok
23:17:58.0796 2416  [ 190CD73D4984F94D823F9444980513E5 ] ALG             C:\WINDOWS\System32\alg.exe
23:17:58.0875 2416  ALG - ok
23:17:58.0875 2416  AliIde - ok
23:17:58.0937 2416  [ 267FC636801EDC5AB28E14036349E3BE ] Ambfilt         C:\WINDOWS\system32\drivers\Ambfilt.sys
23:17:59.0031 2416  Ambfilt - ok
23:17:59.0062 2416  [ E6A2299284013EC4DE3419481A62069F ] AmdK8           C:\WINDOWS\system32\DRIVERS\AmdK8.sys
23:17:59.0140 2416  AmdK8 - ok
23:17:59.0140 2416  amsint - ok
23:17:59.0140 2416  AppMgmt - ok
23:17:59.0171 2416  [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394         C:\WINDOWS\system32\DRIVERS\arp1394.sys
23:17:59.0296 2416  Arp1394 - ok
23:17:59.0359 2416  [ 875F9079CABEE679D34B49E466B61701 ] ASAPIW2K        C:\WINDOWS\system32\Drivers\ASAPIW2K.sys
23:17:59.0375 2416  ASAPIW2K ( UnsignedFile.Multi.Generic ) - warning
23:17:59.0375 2416  ASAPIW2K - detected UnsignedFile.Multi.Generic (1)
23:17:59.0375 2416  asc - ok
23:17:59.0375 2416  asc3350p - ok
23:17:59.0375 2416  asc3550 - ok
23:17:59.0421 2416  [ EB62FA6D7DA4E774E47D376E4D19CA5F ] Aspi32          C:\WINDOWS\system32\drivers\aspi32.sys
23:17:59.0453 2416  Aspi32 ( UnsignedFile.Multi.Generic ) - warning
23:17:59.0453 2416  Aspi32 - detected UnsignedFile.Multi.Generic (1)
23:17:59.0531 2416  [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
23:17:59.0562 2416  aspnet_state - ok
23:17:59.0593 2416  [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac        C:\WINDOWS\system32\DRIVERS\asyncmac.sys
23:17:59.0718 2416  AsyncMac - ok
23:17:59.0796 2416  [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi           C:\WINDOWS\system32\DRIVERS\atapi.sys
23:17:59.0921 2416  atapi - ok
23:17:59.0921 2416  Atdisk - ok
23:18:00.0000 2416  [ ECA673779ECD27D674953D692FE070F6 ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe
23:18:00.0109 2416  Ati HotKey Poller - ok
23:18:00.0140 2416  [ 1428C586BB318E1404575834E428ADDD ] ATI Smart       C:\WINDOWS\system32\ati2sgag.exe
23:18:00.0171 2416  ATI Smart ( UnsignedFile.Multi.Generic ) - warning
23:18:00.0171 2416  ATI Smart - detected UnsignedFile.Multi.Generic (1)
23:18:00.0265 2416  [ 15B2FE76E2ECEB98C49ED52311A6F26F ] ati2mtag        C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
23:18:00.0406 2416  ati2mtag - ok
23:18:00.0468 2416  [ 9916C1225104BA14794209CFA8012159 ] Atmarpc         C:\WINDOWS\system32\DRIVERS\atmarpc.sys
23:18:00.0578 2416  Atmarpc - ok
23:18:00.0625 2416  [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv        C:\WINDOWS\System32\audiosrv.dll
23:18:00.0750 2416  AudioSrv - ok
23:18:00.0781 2416  [ D9F724AA26C010A217C97606B160ED68 ] audstub         C:\WINDOWS\system32\DRIVERS\audstub.sys
23:18:00.0890 2416  audstub - ok
23:18:00.0906 2416  AVFSFilter - ok
23:18:01.0000 2416  [ 2718DC27571BD1E37813F5759D2DC118 ] AVP             C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
23:18:01.0015 2416  AVP - ok
23:18:01.0062 2416  [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep            C:\WINDOWS\system32\drivers\Beep.sys
23:18:01.0187 2416  Beep - ok
23:18:01.0250 2416  [ D6F603772A789BB3228F310D650B8BD1 ] BITS            C:\WINDOWS\system32\qmgr.dll
23:18:01.0609 2416  BITS - ok
23:18:01.0625 2416  [ B71549F23736ADF83A571061C47777FD ] Browser         C:\WINDOWS\System32\browser.dll
23:18:01.0703 2416  Browser - ok
23:18:01.0703 2416  btaudio - ok
23:18:01.0718 2416  BTDriver - ok
23:18:01.0718 2416  BTKRNL - ok
23:18:01.0718 2416  BTWDNDIS - ok
23:18:01.0734 2416  BTWUSB - ok
23:18:01.0812 2416  [ A8EAE8E358DE3A21E6EB54F4FC7F65EC ] Ca533av         C:\WINDOWS\system32\Drivers\Ca533av.sys
23:18:02.0140 2416  Ca533av - ok
23:18:02.0187 2416  [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k         C:\WINDOWS\system32\drivers\cbidf2k.sys
23:18:02.0328 2416  cbidf2k - ok
23:18:02.0437 2416  [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE        C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
23:18:02.0578 2416  CCDECODE - ok
23:18:02.0593 2416  cd20xrnt - ok
23:18:02.0656 2416  [ C1B486A7658353D33A10CC15211A873B ] Cdaudio         C:\WINDOWS\system32\drivers\Cdaudio.sys
23:18:02.0796 2416  Cdaudio - ok
23:18:02.0875 2416  [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs            C:\WINDOWS\system32\drivers\Cdfs.sys
23:18:03.0000 2416  Cdfs - ok
23:18:03.0031 2416  [ BF79E659C506674C0497CC9C61F1A165 ] Cdr4_xp         C:\WINDOWS\system32\drivers\Cdr4_xp.sys
23:18:03.0046 2416  Cdr4_xp ( UnsignedFile.Multi.Generic ) - warning
23:18:03.0046 2416  Cdr4_xp - detected UnsignedFile.Multi.Generic (1)
23:18:03.0046 2416  [ 2C41CD49D82D5FD85C72D57B6CA25471 ] Cdralw2k        C:\WINDOWS\system32\drivers\Cdralw2k.sys
23:18:03.0062 2416  Cdralw2k ( UnsignedFile.Multi.Generic ) - warning
23:18:03.0062 2416  Cdralw2k - detected UnsignedFile.Multi.Generic (1)
23:18:03.0062 2416  [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom           C:\WINDOWS\system32\DRIVERS\cdrom.sys
23:18:03.0187 2416  Cdrom - ok
23:18:03.0203 2416  Changer - ok
23:18:03.0250 2416  [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc           C:\WINDOWS\system32\cisvc.exe
23:18:03.0375 2416  CiSvc - ok
23:18:03.0390 2416  [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv         C:\WINDOWS\system32\clipsrv.exe
23:18:03.0515 2416  ClipSrv - ok
23:18:03.0546 2416  [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
23:18:03.0625 2416  clr_optimization_v2.0.50727_32 - ok
23:18:03.0687 2416  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
23:18:03.0718 2416  clr_optimization_v4.0.30319_32 - ok
23:18:03.0718 2416  CmdIde - ok
23:18:03.0718 2416  COMSysApp - ok
23:18:03.0734 2416  Cpqarray - ok
23:18:03.0765 2416  [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc        C:\WINDOWS\System32\cryptsvc.dll
23:18:03.0875 2416  CryptSvc - ok
23:18:03.0890 2416  dac2w2k - ok
23:18:03.0890 2416  dac960nt - ok
23:18:03.0953 2416  [ B7EF38C2C22A7805DE919CFF5E16A372 ] dc3d            C:\WINDOWS\system32\DRIVERS\dc3d.sys
23:18:03.0984 2416  dc3d - ok
23:18:04.0015 2416  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch      C:\WINDOWS\system32\rpcss.dll
23:18:04.0078 2416  DcomLaunch - ok
23:18:04.0109 2416  [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp            C:\WINDOWS\System32\dhcpcsvc.dll
23:18:04.0218 2416  Dhcp - ok
23:18:04.0234 2416  [ 044452051F3E02E7963599FC8F4F3E25 ] Disk            C:\WINDOWS\system32\DRIVERS\disk.sys
23:18:04.0359 2416  Disk - ok
23:18:04.0359 2416  dmadmin - ok
23:18:04.0406 2416  [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot          C:\WINDOWS\system32\drivers\dmboot.sys
23:18:04.0531 2416  dmboot - ok
23:18:04.0609 2416  [ 53720AB12B48719D00E327DA470A619A ] dmio            C:\WINDOWS\system32\drivers\dmio.sys
23:18:04.0734 2416  dmio - ok
23:18:04.0796 2416  [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload          C:\WINDOWS\system32\drivers\dmload.sys
23:18:04.0906 2416  dmload - ok
23:18:05.0000 2416  [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver        C:\WINDOWS\System32\dmserver.dll
23:18:05.0109 2416  dmserver - ok
23:18:05.0171 2416  [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic          C:\WINDOWS\system32\drivers\DMusic.sys
23:18:05.0312 2416  DMusic - ok
23:18:05.0375 2416  [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache        C:\WINDOWS\System32\dnsrslvr.dll
23:18:05.0484 2416  Dnscache - ok
23:18:05.0515 2416  [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc         C:\WINDOWS\System32\dot3svc.dll
23:18:05.0656 2416  Dot3svc - ok
23:18:05.0656 2416  dpti2o - ok
23:18:05.0750 2416  [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud         C:\WINDOWS\system32\drivers\drmkaud.sys
23:18:05.0875 2416  drmkaud - ok
23:18:05.0937 2416  [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost         C:\WINDOWS\System32\eapsvc.dll
23:18:06.0046 2416  EapHost - ok
23:18:06.0125 2416  [ 877C18558D70587AA7823A1A308AC96B ] ERSvc           C:\WINDOWS\System32\ersvc.dll
23:18:06.0234 2416  ERSvc - ok
23:18:06.0265 2416  [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog        C:\WINDOWS\system32\services.exe
23:18:06.0296 2416  Eventlog - ok
23:18:06.0328 2416  [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem     C:\WINDOWS\system32\es.dll
23:18:06.0390 2416  EventSystem - ok
23:18:06.0406 2416  [ 38D332A6D56AF32635675F132548343E ] Fastfat         C:\WINDOWS\system32\drivers\Fastfat.sys
23:18:06.0531 2416  Fastfat - ok
23:18:06.0625 2416  [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
23:18:06.0671 2416  FastUserSwitchingCompatibility - ok
23:18:06.0687 2416  [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc             C:\WINDOWS\system32\DRIVERS\fdc.sys
23:18:06.0796 2416  Fdc - ok
23:18:06.0875 2416  [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips            C:\WINDOWS\system32\drivers\Fips.sys
23:18:07.0000 2416  Fips - ok
23:18:07.0046 2416  [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk        C:\WINDOWS\system32\DRIVERS\flpydisk.sys
23:18:07.0156 2416  Flpydisk - ok
23:18:07.0171 2416  [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr          C:\WINDOWS\system32\drivers\fltmgr.sys
23:18:07.0281 2416  FltMgr - ok
23:18:07.0437 2416  [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
23:18:07.0453 2416  FontCache3.0.0.0 - ok
23:18:07.0484 2416  [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec          C:\WINDOWS\system32\drivers\Fs_Rec.sys
23:18:07.0609 2416  Fs_Rec - ok
23:18:07.0609 2416  FTD2XX - ok
23:18:07.0625 2416  [ 8F1955CE42E1484714B542F341647778 ] Ftdisk          C:\WINDOWS\system32\DRIVERS\ftdisk.sys
23:18:07.0750 2416  Ftdisk - ok
23:18:07.0781 2416  [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM     C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
23:18:07.0796 2416  GEARAspiWDM - ok
23:18:07.0843 2416  [ 69F8F310654D699C7E5BD5C67279980F ] GenericMount    C:\WINDOWS\system32\DRIVERS\GenericMount.sys
23:18:07.0859 2416  GenericMount - ok
23:18:07.0953 2416  [ 5F0F786D91087C0A76C3EF689A51CA48 ] GenericMount Helper Service C:\Programme\Norton Ghost\Shared\Drivers\GenericMountHelper.exe
23:18:08.0015 2416  GenericMount Helper Service - ok
23:18:08.0046 2416  [ 93CA4D9A0433BE0EDD0B9F2F26D5E54C ] ggflt           C:\WINDOWS\system32\DRIVERS\ggflt.sys
23:18:08.0062 2416  ggflt - ok
23:18:08.0078 2416  [ 17E678AAB82CCDFB80E7614504933895 ] ggsemc          C:\WINDOWS\system32\DRIVERS\ggsemc.sys
23:18:08.0593 2416  ggsemc - ok
23:18:08.0593 2416  GMSIPCI - ok
23:18:08.0640 2416  [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc             C:\WINDOWS\system32\DRIVERS\msgpc.sys
23:18:08.0765 2416  Gpc - ok
23:18:08.0812 2416  [ 4A2102DDF08472527B4872FA68EE87D1 ] GT680x          C:\WINDOWS\system32\Drivers\gt680x.sys
23:18:08.0828 2416  GT680x ( UnsignedFile.Multi.Generic ) - warning
23:18:08.0828 2416  GT680x - detected UnsignedFile.Multi.Generic (1)
23:18:08.0906 2416  [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate         C:\Programme\Google\Update\GoogleUpdate.exe
23:18:08.0921 2416  gupdate - ok
23:18:08.0921 2416  [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem        C:\Programme\Google\Update\GoogleUpdate.exe
23:18:08.0953 2416  gupdatem - ok
23:18:08.0984 2416  [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc           C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
23:18:09.0015 2416  gusvc - ok
23:18:09.0062 2416  [ ED32D389F8B0E74E400932E020BCFBDF ] Hardlock        C:\WINDOWS\system32\drivers\hardlock.sys
23:18:09.0109 2416  Hardlock - ok
23:18:09.0171 2416  [ 2DD25F060DC9F79B5CDF33D90ED93669 ] Haspnt          C:\WINDOWS\system32\drivers\Haspnt.sys
23:18:09.0187 2416  Haspnt ( UnsignedFile.Multi.Generic ) - warning
23:18:09.0187 2416  Haspnt - detected UnsignedFile.Multi.Generic (1)
23:18:09.0218 2416  [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus        C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
23:18:09.0343 2416  HDAudBus - ok
23:18:09.0421 2416  [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc         C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
23:18:09.0531 2416  helpsvc - ok
23:18:09.0625 2416  [ B35DA85E60C0103F2E4104532DA2F12B ] HidServ         C:\WINDOWS\System32\hidserv.dll
23:18:09.0750 2416  HidServ - ok
23:18:09.0765 2416  [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb          C:\WINDOWS\system32\DRIVERS\hidusb.sys
23:18:09.0890 2416  hidusb - ok
23:18:09.0937 2416  [ ED29F14101523A6E0E808107405D452C ] hkmsvc          C:\WINDOWS\System32\kmsvc.dll
23:18:10.0046 2416  hkmsvc - ok
23:18:10.0062 2416  hpn - ok
23:18:10.0125 2416  [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP            C:\WINDOWS\system32\Drivers\HTTP.sys
23:18:10.0171 2416  HTTP - ok
23:18:10.0187 2416  [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter      C:\WINDOWS\System32\w3ssl.dll
23:18:10.0296 2416  HTTPFilter - ok
23:18:10.0312 2416  i2omgmt - ok
23:18:10.0312 2416  i2omp - ok
23:18:10.0359 2416  [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt        C:\WINDOWS\system32\DRIVERS\i8042prt.sys
23:18:10.0484 2416  i8042prt - ok
23:18:10.0593 2416  [ 696A461DD24EA039E0521877CB944BE3 ] ialm            C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
23:18:10.0703 2416  ialm - ok
23:18:10.0828 2416  [ 6F95324909B502E2651442C1548AB12F ] IDriverT        c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
23:18:10.0843 2416  IDriverT ( UnsignedFile.Multi.Generic ) - warning
23:18:10.0843 2416  IDriverT - detected UnsignedFile.Multi.Generic (1)
23:18:10.0906 2416  [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc           c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
23:18:10.0953 2416  idsvc - ok
23:18:10.0968 2416  [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi           C:\WINDOWS\system32\DRIVERS\imapi.sys
23:18:11.0078 2416  Imapi - ok
23:18:11.0109 2416  [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService    C:\WINDOWS\system32\imapi.exe
23:18:11.0250 2416  ImapiService - ok
23:18:11.0250 2416  ini910u - ok
23:18:11.0406 2416  [ 9D04EE981B9F2AD4AFEDD5CF376F3148 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys
23:18:11.0609 2416  IntcAzAudAddService - ok
23:18:11.0625 2416  IntelIde - ok
23:18:11.0656 2416  [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm        C:\WINDOWS\system32\DRIVERS\intelppm.sys
23:18:11.0781 2416  intelppm - ok
23:18:11.0859 2416  [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw           C:\WINDOWS\system32\drivers\ip6fw.sys
23:18:11.0984 2416  Ip6Fw - ok
23:18:12.0015 2416  [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver  C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
23:18:12.0140 2416  IpFilterDriver - ok
23:18:12.0156 2416  [ B87AB476DCF76E72010632B5550955F5 ] IpInIp          C:\WINDOWS\system32\DRIVERS\ipinip.sys
23:18:12.0265 2416  IpInIp - ok
23:18:12.0312 2416  [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat           C:\WINDOWS\system32\DRIVERS\ipnat.sys
23:18:12.0437 2416  IpNat - ok
23:18:12.0484 2416  [ 23C74D75E36E7158768DD63D92789A91 ] IPSec           C:\WINDOWS\system32\DRIVERS\ipsec.sys
23:18:12.0609 2416  IPSec - ok
23:18:12.0687 2416  [ ACA5E7B54409F9CB5EED97ED0C81120E ] irda            C:\WINDOWS\system32\DRIVERS\irda.sys
23:18:12.0750 2416  irda - ok
23:18:12.0781 2416  [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM          C:\WINDOWS\system32\DRIVERS\irenum.sys
23:18:12.0843 2416  IRENUM - ok
23:18:12.0875 2416  [ 2EFE1DB1EC58A26B0C14BFDA122E246F ] Irmon           C:\WINDOWS\System32\irmon.dll
23:18:12.0953 2416  Irmon - ok
23:18:12.0968 2416  [ 6DFB88F64135C525433E87648BDA30DE ] isapnp          C:\WINDOWS\system32\DRIVERS\isapnp.sys
23:18:13.0093 2416  isapnp - ok
23:18:13.0171 2416  [ B591E761161D1EF547D76EF236EAA6A5 ] JavaQuickStarterService C:\Programme\Java\jre7\bin\jqs.exe
23:18:13.0187 2416  JavaQuickStarterService - ok
23:18:13.0218 2416  [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass        C:\WINDOWS\system32\DRIVERS\kbdclass.sys
23:18:13.0328 2416  Kbdclass - ok
23:18:13.0343 2416  [ B6D6C117D771C98130497265F26D1882 ] kbdhid          C:\WINDOWS\system32\DRIVERS\kbdhid.sys
23:18:13.0468 2416  kbdhid - ok
23:18:13.0484 2416  [ 186B54479D98E48AEE0E9ADA4B3C4D31 ] KL1             C:\WINDOWS\system32\DRIVERS\kl1.sys
23:18:13.0500 2416  KL1 - ok
23:18:13.0515 2416  [ BF485BFBA13C0AB116701FD9C55324D0 ] kl2             C:\WINDOWS\system32\DRIVERS\kl2.sys
23:18:13.0531 2416  kl2 - ok
23:18:13.0562 2416  [ 5D92A03045A6A98708975B3D77B39A36 ] KLIF            C:\WINDOWS\system32\DRIVERS\klif.sys
23:18:13.0593 2416  KLIF - ok
23:18:13.0640 2416  [ 96A7EC308A93DA26DFE481308BAAC2A2 ] klim5           C:\WINDOWS\system32\DRIVERS\klim5.sys
23:18:13.0656 2416  klim5 - ok
23:18:13.0671 2416  [ 3959530F69E19DA56F1F24F2C89F1E2C ] klmouflt        C:\WINDOWS\system32\DRIVERS\klmouflt.sys
23:18:13.0703 2416  klmouflt - ok
23:18:13.0703 2416  [ 692BCF44383D056AED41B045A323D378 ] kmixer          C:\WINDOWS\system32\drivers\kmixer.sys
23:18:13.0812 2416  kmixer - ok
23:18:13.0859 2416  [ B467646C54CC746128904E1654C750C1 ] KSecDD          C:\WINDOWS\system32\drivers\KSecDD.sys
23:18:13.0953 2416  KSecDD - ok
23:18:13.0968 2416  [ 0A2E5A1963708AEE3BEE39D17726D736 ] L1c             C:\WINDOWS\system32\DRIVERS\l1c51x86.sys
23:18:14.0000 2416  L1c - ok
23:18:14.0031 2416  [ FD1D572C705BD70953621DA8334F5A5C ] L8042mou        C:\WINDOWS\system32\DRIVERS\L8042mou.Sys
23:18:14.0109 2416  L8042mou - ok
23:18:14.0140 2416  [ 2BBDCB79900990F0716DFCB714E72DE7 ] lanmanserver    C:\WINDOWS\System32\srvsvc.dll
23:18:14.0218 2416  lanmanserver - ok
23:18:14.0265 2416  [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
23:18:14.0312 2416  lanmanworkstation - ok
23:18:14.0328 2416  lbrtfdc - ok
23:18:14.0343 2416  [ 6F6FED015CD3D33A048F9FC40F42E076 ] LHidKe          C:\WINDOWS\system32\DRIVERS\LHidKE.Sys
23:18:14.0375 2416  LHidKe - ok
23:18:14.0375 2416  [ C9FEEB4604C303CBD68E0A6780B5F50C ] LHidUsbK        C:\WINDOWS\system32\Drivers\LHidUsbK.Sys
23:18:14.0437 2416  LHidUsbK - ok
23:18:14.0468 2416  [ 636714B7D43C8D0C80449123FD266920 ] LmHosts         C:\WINDOWS\System32\lmhsvc.dll
23:18:14.0578 2416  LmHosts - ok
23:18:14.0593 2416  [ E424EB5F4FCF486490A17BEA3DFC64A9 ] LMouKE          C:\WINDOWS\system32\DRIVERS\LMouKE.Sys
23:18:14.0609 2416  LMouKE - ok
23:18:14.0609 2416  lxbx_device - ok
23:18:14.0656 2416  [ D57A920490362C89A0EF2A61FE249AFA ] MA-620          C:\WINDOWS\system32\DRIVERS\MA-620.sys
23:18:14.0671 2416  MA-620 ( UnsignedFile.Multi.Generic ) - warning
23:18:14.0671 2416  MA-620 - detected UnsignedFile.Multi.Generic (1)
23:18:14.0703 2416  [ B7550A7107281D170CE85524B1488C98 ] Messenger       C:\WINDOWS\System32\msgsvc.dll
23:18:14.0812 2416  Messenger - ok
23:18:14.0859 2416  [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd           C:\WINDOWS\system32\drivers\mnmdd.sys
23:18:14.0968 2416  mnmdd - ok
23:18:15.0046 2416  [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc         C:\WINDOWS\system32\mnmsrvc.exe
23:18:15.0156 2416  mnmsrvc - ok
23:18:15.0250 2416  [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem           C:\WINDOWS\system32\drivers\Modem.sys
23:18:15.0375 2416  Modem - ok
23:18:15.0453 2416  [ C7D9F9717916B34C1B00DD4834AF485C ] Monfilt         C:\WINDOWS\system32\drivers\Monfilt.sys
23:18:15.0500 2416  Monfilt - ok
23:18:15.0515 2416  [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass        C:\WINDOWS\system32\DRIVERS\mouclass.sys
23:18:15.0625 2416  Mouclass - ok
23:18:15.0625 2416  [ 66A6F73C74E1791464160A7065CE711A ] mouhid          C:\WINDOWS\system32\DRIVERS\mouhid.sys
23:18:15.0750 2416  mouhid - ok
23:18:15.0796 2416  [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr        C:\WINDOWS\system32\drivers\MountMgr.sys
23:18:15.0906 2416  MountMgr - ok
23:18:16.0000 2416  [ 8BE15F71DE6FF33FC56DCDE7B2B9EFE8 ] MozillaMaintenance C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
23:18:16.0031 2416  MozillaMaintenance - ok
23:18:16.0031 2416  mraid35x - ok
23:18:16.0046 2416  [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV          C:\WINDOWS\system32\DRIVERS\mrxdav.sys
23:18:16.0156 2416  MRxDAV - ok
23:18:16.0250 2416  [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb          C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
23:18:16.0296 2416  MRxSmb - ok
23:18:16.0343 2416  [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC           C:\WINDOWS\system32\msdtc.exe
23:18:16.0437 2416  MSDTC - ok
23:18:16.0484 2416  [ C941EA2454BA8350021D774DAF0F1027 ] Msfs            C:\WINDOWS\system32\drivers\Msfs.sys
23:18:16.0593 2416  Msfs - ok
23:18:16.0671 2416  [ 95C6432151CCFF8617352F8E616A1AA4 ] MSIRCOMM        C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
23:18:16.0750 2416  MSIRCOMM - ok
23:18:16.0750 2416  MSIServer - ok
23:18:16.0765 2416  [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV         C:\WINDOWS\system32\drivers\MSKSSRV.sys
23:18:16.0859 2416  MSKSSRV - ok
23:18:16.0906 2416  [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK        C:\WINDOWS\system32\drivers\MSPCLOCK.sys
23:18:17.0015 2416  MSPCLOCK - ok
23:18:17.0015 2416  [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM           C:\WINDOWS\system32\drivers\MSPQM.sys
23:18:17.0156 2416  MSPQM - ok
23:18:17.0234 2416  [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios        C:\WINDOWS\system32\DRIVERS\mssmbios.sys
23:18:17.0343 2416  mssmbios - ok
23:18:17.0406 2416  MSSQL$SQLEXPRESS - ok
23:18:17.0484 2416  [ F1761C8FB2B25A32C6D63E36BB88C3AE ] MSSQLServerADHelper100 c:\Programme\Microsoft SQL Server\100\Shared\SQLADHLP.EXE
23:18:17.0500 2416  MSSQLServerADHelper100 - ok
23:18:17.0515 2416  [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE           C:\WINDOWS\system32\drivers\MSTEE.sys
23:18:17.0640 2416  MSTEE - ok
23:18:17.0656 2416  [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup             C:\WINDOWS\system32\drivers\Mup.sys
23:18:17.0687 2416  Mup - ok
23:18:17.0734 2416  [ FC3EB08186946EB22370DE70F778DF08 ] MVDCODEC        C:\WINDOWS\system32\DRIVERS\ativmdcd.sys
23:18:17.0859 2416  MVDCODEC - ok
23:18:17.0921 2416  [ E91FC8B52D21E38317DC61A3C7CCFA4B ] MxlW2k          C:\WINDOWS\system32\drivers\MxlW2k.sys
23:18:17.0953 2416  MxlW2k ( UnsignedFile.Multi.Generic ) - warning
23:18:17.0953 2416  MxlW2k - detected UnsignedFile.Multi.Generic (1)
23:18:17.0968 2416  [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC        C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
23:18:18.0078 2416  NABTSFEC - ok
23:18:18.0171 2416  [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent        C:\WINDOWS\System32\qagentrt.dll
23:18:18.0328 2416  napagent - ok
23:18:18.0328 2416  [ 1DF7F42665C94B825322FAE71721130D ] NDIS            C:\WINDOWS\system32\drivers\NDIS.sys
23:18:18.0453 2416  NDIS - ok
23:18:18.0531 2416  [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP          C:\WINDOWS\system32\DRIVERS\NdisIP.sys
23:18:18.0640 2416  NdisIP - ok
23:18:18.0671 2416  [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi        C:\WINDOWS\system32\DRIVERS\ndistapi.sys
23:18:18.0703 2416  NdisTapi - ok
23:18:18.0718 2416  [ F927A4434C5028758A842943EF1A3849 ] Ndisuio         C:\WINDOWS\system32\DRIVERS\ndisuio.sys
23:18:18.0828 2416  Ndisuio - ok
23:18:18.0843 2416  [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan         C:\WINDOWS\system32\DRIVERS\ndiswan.sys
23:18:18.0937 2416  NdisWan - ok
23:18:18.0984 2416  [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy         C:\WINDOWS\system32\drivers\NDProxy.sys
23:18:19.0046 2416  NDProxy - ok
23:18:19.0062 2416  [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS         C:\WINDOWS\system32\DRIVERS\netbios.sys
23:18:19.0171 2416  NetBIOS - ok
23:18:19.0203 2416  [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT           C:\WINDOWS\system32\DRIVERS\netbt.sys
23:18:19.0312 2416  NetBT - ok
23:18:19.0375 2416  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE          C:\WINDOWS\system32\netdde.exe
23:18:19.0500 2416  NetDDE - ok
23:18:19.0750 2416  [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm      C:\WINDOWS\system32\netdde.exe
23:18:19.0859 2416  NetDDEdsdm - ok
23:18:19.0937 2416  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon        C:\WINDOWS\system32\lsass.exe
23:18:20.0046 2416  Netlogon - ok
23:18:20.0125 2416  [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman          C:\WINDOWS\System32\netman.dll
23:18:20.0234 2416  Netman - ok
23:18:20.0312 2416  [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
23:18:20.0343 2416  NetTcpPortSharing - ok
23:18:20.0375 2416  [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394         C:\WINDOWS\system32\DRIVERS\nic1394.sys
23:18:20.0484 2416  NIC1394 - ok
23:18:20.0562 2416  [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla             C:\WINDOWS\System32\mswsock.dll
23:18:20.0593 2416  Nla - ok
23:18:20.0718 2416  [ A1787754952A0B700E386DC7C5FA5726 ] Norton Ghost    C:\Programme\Norton Ghost\Agent\VProSvc.exe
23:18:20.0859 2416  Norton Ghost - ok
23:18:20.0890 2416  [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs            C:\WINDOWS\system32\drivers\Npfs.sys
23:18:21.0000 2416  Npfs - ok
23:18:21.0046 2416  [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs            C:\WINDOWS\system32\drivers\Ntfs.sys
23:18:21.0171 2416  Ntfs - ok
23:18:21.0234 2416  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp         C:\WINDOWS\system32\lsass.exe
23:18:21.0343 2416  NtLmSsp - ok
23:18:21.0390 2416  [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc         C:\WINDOWS\system32\ntmssvc.dll
23:18:21.0531 2416  NtmsSvc - ok
23:18:21.0593 2416  [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null            C:\WINDOWS\system32\drivers\Null.sys
23:18:21.0703 2416  Null - ok
23:18:21.0718 2416  [ E4F1F95A6BBBFBBFF9A713C6063AA2CB ] nvatabus        C:\WINDOWS\system32\DRIVERS\nvatabus.sys
23:18:21.0750 2416  nvatabus - ok
23:18:21.0781 2416  [ 812F45DA883BDB87C5960B25295A7E9C ] NVENETFD        C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
23:18:21.0812 2416  NVENETFD - ok
23:18:21.0843 2416  [ 507B332B431392ED37C23B7CFB66DCF7 ] nvnetbus        C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
23:18:21.0890 2416  nvnetbus - ok
23:18:21.0921 2416  [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt        C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
23:18:22.0046 2416  NwlnkFlt - ok
23:18:22.0046 2416  [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd        C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
23:18:22.0156 2416  NwlnkFwd - ok
23:18:22.0265 2416  [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv          C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
23:18:22.0296 2416  odserv - ok
23:18:22.0328 2416  [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394        C:\WINDOWS\system32\DRIVERS\ohci1394.sys
23:18:22.0437 2416  ohci1394 - ok
23:18:22.0484 2416  [ 5A432A042DAE460ABE7199B758E8606C ] ose             C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
23:18:22.0500 2416  ose - ok
23:18:22.0562 2416  [ 4A410C7AEA51123519C20D43A20BCE96 ] PAC207          C:\WINDOWS\system32\DRIVERS\PFC027.SYS
23:18:22.0625 2416  PAC207 - ok
23:18:22.0656 2416  [ F84785660305B9B903FB3BCA8BA29837 ] Parport         C:\WINDOWS\system32\DRIVERS\parport.sys
23:18:22.0781 2416  Parport - ok
23:18:22.0781 2416  [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr         C:\WINDOWS\system32\drivers\PartMgr.sys
23:18:22.0890 2416  PartMgr - ok
23:18:22.0921 2416  [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm          C:\WINDOWS\system32\drivers\ParVdm.sys
23:18:23.0031 2416  ParVdm - ok
23:18:23.0109 2416  [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI             C:\WINDOWS\system32\DRIVERS\pci.sys
23:18:23.0218 2416  PCI - ok
23:18:23.0218 2416  PCIDump - ok
23:18:23.0234 2416  [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde          C:\WINDOWS\system32\DRIVERS\pciide.sys
23:18:23.0359 2416  PCIIde - ok
23:18:23.0390 2416  [ 1BEBE7DE8508A02650CDCE45C664C2A2 ] PCLEPCI         C:\WINDOWS\system32\drivers\pclepci.sys
23:18:23.0406 2416  PCLEPCI ( UnsignedFile.Multi.Generic ) - warning
23:18:23.0406 2416  PCLEPCI - detected UnsignedFile.Multi.Generic (1)
23:18:23.0421 2416  [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia          C:\WINDOWS\system32\drivers\Pcmcia.sys
23:18:23.0531 2416  Pcmcia - ok
23:18:23.0531 2416  PDCOMP - ok
23:18:23.0531 2416  PDFRAME - ok
23:18:23.0546 2416  PDRELI - ok
23:18:23.0546 2416  PDRFRAME - ok
23:18:23.0546 2416  perc2 - ok
23:18:23.0546 2416  perc2hib - ok
23:18:23.0609 2416  [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay        C:\WINDOWS\system32\services.exe
23:18:23.0640 2416  PlugPlay - ok
23:18:23.0671 2416  [ 3ABDF04C0137F45568D5E960E7D5D73A ] PMUSB2G         C:\WINDOWS\system32\Drivers\PMUSB.sys
23:18:23.0687 2416  PMUSB2G ( UnsignedFile.Multi.Generic ) - warning
23:18:23.0687 2416  PMUSB2G - detected UnsignedFile.Multi.Generic (1)
23:18:23.0718 2416  [ A1D7A9214B71EBBB6F31CB84AAC15525 ] Pnp680r         C:\WINDOWS\system32\DRIVERS\pnp680r.sys
23:18:23.0781 2416  Pnp680r - ok
23:18:23.0812 2416  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent     C:\WINDOWS\system32\lsass.exe
23:18:23.0906 2416  PolicyAgent - ok
23:18:23.0953 2416  [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport    C:\WINDOWS\system32\DRIVERS\raspptp.sys
23:18:24.0078 2416  PptpMiniport - ok
23:18:24.0109 2416  [ 2CB55427C58679F49AD600FCCBA76360 ] Processor       C:\WINDOWS\system32\DRIVERS\processr.sys
23:18:24.0218 2416  Processor - ok
23:18:24.0234 2416  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
23:18:24.0328 2416  ProtectedStorage - ok
23:18:24.0359 2416  [ 09298EC810B07E5D582CB3A3F9255424 ] PSched          C:\WINDOWS\system32\DRIVERS\psched.sys
23:18:24.0500 2416  PSched - ok
23:18:24.0515 2416  [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink         C:\WINDOWS\system32\DRIVERS\ptilink.sys
23:18:24.0625 2416  Ptilink - ok
23:18:24.0671 2416  [ 681AE4F1927FE0FDEEE2863F1684088D ] pwdrvio         C:\WINDOWS\system32\pwdrvio.sys
23:18:24.0703 2416  pwdrvio - ok
23:18:24.0750 2416  [ BC60895CE021309EBD887D2F22055654 ] pwdspio         C:\WINDOWS\system32\pwdspio.sys
23:18:24.0765 2416  pwdspio - ok
23:18:24.0781 2416  [ 49452BFCEC22F36A7A9B9C2181BC3042 ] PxHelp20        C:\WINDOWS\system32\Drivers\PxHelp20.sys
23:18:24.0812 2416  PxHelp20 - ok
23:18:24.0812 2416  ql1080 - ok
23:18:24.0812 2416  Ql10wnt - ok
23:18:24.0828 2416  ql12160 - ok
23:18:24.0828 2416  ql1240 - ok
23:18:24.0828 2416  ql1280 - ok
23:18:24.0859 2416  [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd          C:\WINDOWS\system32\DRIVERS\rasacd.sys
23:18:24.0984 2416  RasAcd - ok
23:18:25.0000 2416  [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto         C:\WINDOWS\System32\rasauto.dll
23:18:25.0109 2416  RasAuto - ok
23:18:25.0171 2416  [ 0207D26DDF796A193CCD9F83047BB5FC ] Rasirda         C:\WINDOWS\system32\DRIVERS\rasirda.sys
23:18:25.0250 2416  Rasirda - ok
23:18:25.0265 2416  [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp         C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
23:18:25.0375 2416  Rasl2tp - ok
23:18:25.0421 2416  [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan          C:\WINDOWS\System32\rasmans.dll
23:18:25.0546 2416  RasMan - ok
23:18:25.0546 2416  [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe        C:\WINDOWS\system32\DRIVERS\raspppoe.sys
23:18:25.0656 2416  RasPppoe - ok
23:18:25.0671 2416  [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti          C:\WINDOWS\system32\DRIVERS\raspti.sys
23:18:25.0765 2416  Raspti - ok
23:18:25.0796 2416  [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss           C:\WINDOWS\system32\DRIVERS\rdbss.sys
23:18:25.0921 2416  Rdbss - ok
23:18:25.0968 2416  [ 4912D5B403614CE99C28420F75353332 ] RDPCDD          C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
23:18:26.0078 2416  RDPCDD - ok
23:18:26.0125 2416  [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD           C:\WINDOWS\system32\drivers\RDPWD.sys
23:18:26.0187 2416  RDPWD - ok
23:18:26.0218 2416  [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr       C:\WINDOWS\system32\sessmgr.exe
23:18:26.0343 2416  RDSessMgr - ok
23:18:26.0375 2416  [ ED761D453856F795A7FE056E42C36365 ] redbook         C:\WINDOWS\system32\DRIVERS\redbook.sys
23:18:26.0484 2416  redbook - ok
23:18:26.0531 2416  [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess    C:\WINDOWS\System32\mprdim.dll
23:18:26.0656 2416  RemoteAccess - ok
23:18:26.0671 2416  [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator      C:\WINDOWS\system32\locator.exe
23:18:26.0781 2416  RpcLocator - ok
23:18:26.0859 2416  [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs           C:\WINDOWS\System32\rpcss.dll
23:18:26.0890 2416  RpcSs - ok
23:18:26.0921 2416  [ FEDD2710B75BE3ECF078ADACE790C423 ] RsFx0102        C:\WINDOWS\system32\DRIVERS\RsFx0102.sys
23:18:26.0937 2416  RsFx0102 - ok
23:18:26.0968 2416  [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP            C:\WINDOWS\system32\rsvp.exe
23:18:27.0078 2416  RSVP - ok
23:18:27.0109 2416  [ 59509AD6CBC28F2C73056268985B3E48 ] s0016bus        C:\WINDOWS\system32\DRIVERS\s0016bus.sys
23:18:27.0140 2416  s0016bus - ok
23:18:27.0187 2416  [ B98C3A6F91F4FBA285AF9606A240C6B4 ] s0016mdfl       C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys
23:18:27.0203 2416  s0016mdfl - ok
23:18:27.0250 2416  [ 8A83426F4FB7B5212825D9DE76368B1A ] s0016mdm        C:\WINDOWS\system32\DRIVERS\s0016mdm.sys
23:18:27.0265 2416  s0016mdm - ok
23:18:27.0296 2416  [ 7A78BBA97FEB5E6D24C49E93A3BF7287 ] s0016mgmt       C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys
23:18:27.0312 2416  s0016mgmt - ok
23:18:27.0343 2416  [ 34EF7B5F611957B73E7219DD5A222AD1 ] s0016nd5        C:\WINDOWS\system32\DRIVERS\s0016nd5.sys
23:18:27.0359 2416  s0016nd5 - ok
23:18:27.0406 2416  [ 36792935847143E4A3CDA0DC87248487 ] s0016obex       C:\WINDOWS\system32\DRIVERS\s0016obex.sys
23:18:27.0421 2416  s0016obex - ok
23:18:27.0453 2416  [ 927208754FB27FC3E7A659E77500C5D1 ] s0016unic       C:\WINDOWS\system32\DRIVERS\s0016unic.sys
23:18:27.0468 2416  s0016unic - ok
23:18:27.0500 2416  [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs           C:\WINDOWS\system32\lsass.exe
23:18:27.0609 2416  SamSs - ok
23:18:27.0625 2416  [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr        C:\WINDOWS\System32\SCardSvr.exe
23:18:27.0750 2416  SCardSvr - ok
23:18:27.0781 2416  [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule        C:\WINDOWS\system32\schedsvc.dll
23:18:27.0906 2416  Schedule - ok
23:18:28.0031 2416  [ 0F4A80438E7286A0E623582F5F2395BD ] SearchAnonymizer C:\Dokumente und Einstellungen\Hartmann\Anwendungsdaten\OCS\SM\SearchAnonymizerHelper.exe
23:18:28.0046 2416  SearchAnonymizer ( UnsignedFile.Multi.Generic ) - warning
23:18:28.0046 2416  SearchAnonymizer - detected UnsignedFile.Multi.Generic (1)
23:18:28.0078 2416  [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv          C:\WINDOWS\system32\DRIVERS\secdrv.sys
23:18:28.0140 2416  Secdrv - ok
23:18:28.0171 2416  [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon        C:\WINDOWS\System32\seclogon.dll
23:18:28.0296 2416  seclogon - ok
23:18:28.0359 2416  [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS            C:\WINDOWS\system32\sens.dll
23:18:28.0468 2416  SENS - ok
23:18:28.0562 2416  [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum         C:\WINDOWS\system32\DRIVERS\serenum.sys
23:18:28.0687 2416  serenum - ok
23:18:28.0734 2416  [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial          C:\WINDOWS\system32\DRIVERS\serial.sys
23:18:28.0859 2416  Serial - ok
23:18:28.0968 2416  [ 0B179A959FF6B6CA5927D4F255AB9F90 ] sfdrv01         C:\WINDOWS\system32\drivers\sfdrv01.sys
23:18:28.0984 2416  sfdrv01 ( UnsignedFile.Multi.Generic ) - warning
23:18:28.0984 2416  sfdrv01 - detected UnsignedFile.Multi.Generic (1)
23:18:29.0000 2416  [ 15BE2B5E4DC5B8623CF167720682ABC9 ] sfhlp02         C:\WINDOWS\system32\drivers\sfhlp02.sys
23:18:29.0000 2416  sfhlp02 ( UnsignedFile.Multi.Generic ) - warning
23:18:29.0000 2416  sfhlp02 - detected UnsignedFile.Multi.Generic (1)
23:18:29.0031 2416  [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy         C:\WINDOWS\system32\drivers\Sfloppy.sys
23:18:29.0125 2416  Sfloppy - ok
23:18:29.0156 2416  [ A62EFE6AA55C6A599DDBB6BD00E8FB9C ] sfsync02        C:\WINDOWS\system32\drivers\sfsync02.sys
23:18:29.0171 2416  sfsync02 ( UnsignedFile.Multi.Generic ) - warning
23:18:29.0171 2416  sfsync02 - detected UnsignedFile.Multi.Generic (1)
23:18:29.0203 2416  [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess    C:\WINDOWS\System32\ipnathlp.dll
23:18:29.0312 2416  SharedAccess - ok
23:18:29.0359 2416  [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
23:18:29.0390 2416  ShellHWDetection - ok
23:18:29.0406 2416  [ 09889D435EDC82435B18C7C311FE5721 ] Si3114r5        C:\WINDOWS\system32\DRIVERS\Si3114r5.sys
23:18:29.0437 2416  Si3114r5 - ok
23:18:29.0453 2416  [ 46B92189FE4DB53A09E3A0099AA3084C ] SiFilter        C:\WINDOWS\system32\DRIVERS\SiWinAcc.sys
23:18:29.0468 2416  SiFilter - ok
23:18:29.0468 2416  Simbad - ok
23:18:29.0484 2416  [ B688378D258D1ECCE4768CDB55D48D92 ] SiRemFil        C:\WINDOWS\system32\DRIVERS\SiRemFil.sys
23:18:29.0500 2416  SiRemFil - ok
23:18:29.0531 2416  [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate     C:\Programme\Skype\Updater\Updater.exe
23:18:29.0546 2416  SkypeUpdate - ok
23:18:29.0562 2416  [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP            C:\WINDOWS\system32\DRIVERS\SLIP.sys
23:18:29.0671 2416  SLIP - ok
23:18:29.0796 2416  [ 5177D14A78E60FD61DCFC6B388E7E971 ] Sony PC Companion C:\Programme\Sony\Sony PC Companion\PCCService.exe
23:18:29.0812 2416  Sony PC Companion - ok
23:18:29.0828 2416  Sparrow - ok
23:18:29.0859 2416  [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter        C:\WINDOWS\system32\drivers\splitter.sys
23:18:29.0968 2416  splitter - ok
23:18:30.0000 2416  [ 60784F891563FB1B767F70117FC2428F ] Spooler         C:\WINDOWS\system32\spoolsv.exe
23:18:30.0062 2416  Spooler - ok
23:18:30.0109 2416  [ EB2FD937449B7ACEB39372F875EB8E78 ] SQLAgent$SQLEXPRESS c:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE
23:18:30.0156 2416  SQLAgent$SQLEXPRESS - ok
23:18:30.0218 2416  [ 99DE6ACFA5CA83FAD6A765C81C6F129F ] SQLBrowser      c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe
23:18:30.0250 2416  SQLBrowser - ok
23:18:30.0250 2416  [ 637A0F23F9012358E92E6F99835494D1 ] SQLWriter       c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
23:18:30.0281 2416  SQLWriter - ok
23:18:30.0281 2416  [ 50FA898F8C032796D3B1B9951BB5A90F ] sr              C:\WINDOWS\system32\DRIVERS\sr.sys
23:18:30.0359 2416  sr - ok
23:18:30.0390 2416  [ FE77A85495065F3AD59C5C65B6C54182 ] srservice       C:\WINDOWS\system32\srsvc.dll
23:18:30.0453 2416  srservice - ok
23:18:30.0484 2416  [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv             C:\WINDOWS\system32\DRIVERS\srv.sys
23:18:30.0531 2416  Srv - ok
23:18:30.0562 2416  [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV         C:\WINDOWS\System32\ssdpsrv.dll
23:18:30.0640 2416  SSDPSRV - ok
23:18:30.0656 2416  [ BC2C5985611C5356B24AEB370953DED9 ] stisvc          C:\WINDOWS\system32\wiaservc.dll
23:18:30.0765 2416  stisvc - ok
23:18:30.0812 2416  [ 77813007BA6265C4B6098187E6ED79D2 ] streamip        C:\WINDOWS\system32\DRIVERS\StreamIP.sys
23:18:30.0921 2416  streamip - ok
23:18:30.0984 2416  [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum          C:\WINDOWS\system32\DRIVERS\swenum.sys
23:18:31.0093 2416  swenum - ok
23:18:31.0171 2416  [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi          C:\WINDOWS\system32\drivers\swmidi.sys
23:18:31.0281 2416  swmidi - ok
23:18:31.0281 2416  SwPrv - ok
23:18:31.0296 2416  Symantec SymSnap VSS Provider - ok
23:18:31.0296 2416  symc810 - ok
23:18:31.0296 2416  symc8xx - ok
23:18:31.0359 2416  [ 5220576EE29BEA7C18DFF9ECABF18BBC ] symlcbrd        C:\WINDOWS\system32\drivers\symlcbrd.sys
23:18:31.0359 2416  symlcbrd ( UnsignedFile.Multi.Generic ) - warning
23:18:31.0359 2416  symlcbrd - detected UnsignedFile.Multi.Generic (1)
23:18:31.0390 2416  [ A5CF31080E99718949BCC38C83F13452 ] symsnap         C:\WINDOWS\system32\DRIVERS\symsnap.sys
23:18:31.0406 2416  symsnap - ok
23:18:31.0468 2416  [ 21FF886E6F679FC1EB352F231E846357 ] SymSnapService  C:\Programme\Norton Ghost\Shared\Drivers\SymSnapService.exe
23:18:31.0546 2416  SymSnapService - ok
23:18:31.0546 2416  sym_hi - ok
23:18:31.0546 2416  sym_u3 - ok
23:18:31.0609 2416  [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio        C:\WINDOWS\system32\drivers\sysaudio.sys
23:18:31.0703 2416  sysaudio - ok
23:18:31.0718 2416  [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog       C:\WINDOWS\system32\smlogsvc.exe
23:18:31.0843 2416  SysmonLog - ok
23:18:31.0875 2416  [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv         C:\WINDOWS\System32\tapisrv.dll
23:18:31.0984 2416  TapiSrv - ok
23:18:32.0015 2416  [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip           C:\WINDOWS\system32\DRIVERS\tcpip.sys
23:18:32.0046 2416  Tcpip - ok
23:18:32.0062 2416  [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE          C:\WINDOWS\system32\drivers\TDPIPE.sys
23:18:32.0187 2416  TDPIPE - ok
23:18:32.0187 2416  [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP           C:\WINDOWS\system32\drivers\TDTCP.sys
23:18:32.0296 2416  TDTCP - ok
23:18:32.0359 2416  [ 88155247177638048422893737429D9E ] TermDD          C:\WINDOWS\system32\DRIVERS\termdd.sys
23:18:32.0468 2416  TermDD - ok
23:18:32.0500 2416  [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService     C:\WINDOWS\System32\termsrv.dll
23:18:32.0625 2416  TermService - ok
23:18:32.0671 2416  [ 2DB7D303C36DDD055215052F118E8E75 ] Themes          C:\WINDOWS\System32\shsvcs.dll
23:18:32.0687 2416  Themes - ok
23:18:32.0703 2416  TosIde - ok
23:18:32.0718 2416  [ 626504572B175867F30F3215C04B3E2F ] TrkWks          C:\WINDOWS\system32\trkwks.dll
23:18:32.0828 2416  TrkWks - ok
23:18:32.0859 2416  [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs            C:\WINDOWS\system32\drivers\Udfs.sys
23:18:32.0984 2416  Udfs - ok
23:18:32.0984 2416  ultra - ok
23:18:33.0078 2416  [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update          C:\WINDOWS\system32\DRIVERS\update.sys
23:18:33.0203 2416  Update - ok
23:18:33.0218 2416  [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost        C:\WINDOWS\System32\upnphost.dll
23:18:33.0281 2416  upnphost - ok
23:18:33.0312 2416  [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS             C:\WINDOWS\System32\ups.exe
23:18:33.0406 2416  UPS - ok
23:18:33.0468 2416  [ E919708DB44ED8543A7C017953148330 ] usbaudio        C:\WINDOWS\system32\drivers\usbaudio.sys
23:18:33.0578 2416  usbaudio - ok
23:18:33.0609 2416  [ 0C28DD9EC68CCB6E95D49BFD24FD2C11 ] USBCamera       C:\WINDOWS\system32\Drivers\Bulk533.sys
23:18:33.0625 2416  USBCamera - ok
23:18:33.0640 2416  [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp         C:\WINDOWS\system32\DRIVERS\usbccgp.sys
23:18:33.0750 2416  usbccgp - ok
23:18:33.0765 2416  [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci         C:\WINDOWS\system32\DRIVERS\usbehci.sys
23:18:33.0859 2416  usbehci - ok
23:18:33.0921 2416  [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub          C:\WINDOWS\system32\DRIVERS\usbhub.sys
23:18:34.0031 2416  usbhub - ok
23:18:34.0046 2416  [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci         C:\WINDOWS\system32\DRIVERS\usbohci.sys
23:18:34.0140 2416  usbohci - ok
23:18:34.0171 2416  [ A717C8721046828520C9EDF31288FC00 ] usbprint        C:\WINDOWS\system32\DRIVERS\usbprint.sys
23:18:34.0296 2416  usbprint - ok
23:18:34.0343 2416  [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan         C:\WINDOWS\system32\DRIVERS\usbscan.sys
23:18:34.0453 2416  usbscan - ok
23:18:34.0468 2416  [ 1C888B000C2F9492F4B15B5B6B84873E ] usbser          C:\WINDOWS\system32\DRIVERS\usbser.sys
23:18:34.0578 2416  usbser - ok
23:18:34.0593 2416  [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR         C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
23:18:34.0687 2416  USBSTOR - ok
23:18:34.0718 2416  [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci         C:\WINDOWS\system32\DRIVERS\usbuhci.sys
23:18:34.0828 2416  usbuhci - ok
23:18:34.0843 2416  [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave         C:\WINDOWS\System32\drivers\vga.sys
23:18:34.0953 2416  VgaSave - ok
23:18:34.0953 2416  ViaIde - ok
23:18:34.0984 2416  [ A5A712F4E880874A477AF790B5186E1D ] VolSnap         C:\WINDOWS\system32\drivers\VolSnap.sys
23:18:35.0109 2416  VolSnap - ok
23:18:35.0171 2416  [ EF3506B04EB9124240B35148EAACBAA5 ] VProEventMonitor C:\WINDOWS\system32\DRIVERS\vproeventmonitor.sys
23:18:35.0187 2416  VProEventMonitor - ok
23:18:35.0203 2416  [ 68F106273BE29E7B7EF8266977268E78 ] VSS             C:\WINDOWS\System32\vssvc.exe
23:18:35.0281 2416  VSS - ok
23:18:35.0296 2416  [ 7B353059E665F8B7AD2BBEAEF597CF45 ] W32Time         C:\WINDOWS\system32\w32time.dll
23:18:35.0406 2416  W32Time - ok
23:18:35.0453 2416  [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp          C:\WINDOWS\system32\DRIVERS\wanarp.sys
23:18:35.0546 2416  Wanarp - ok
23:18:35.0625 2416  [ D918617B46457B9AC28027722E30F647 ] Wdf01000        C:\WINDOWS\system32\Drivers\wdf01000.sys
23:18:35.0656 2416  Wdf01000 - ok
23:18:35.0671 2416  WDICA - ok
23:18:35.0703 2416  [ 6768ACF64B18196494413695F0C3A00F ] wdmaud          C:\WINDOWS\system32\drivers\wdmaud.sys
23:18:35.0828 2416  wdmaud - ok
23:18:35.0828 2416  [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient       C:\WINDOWS\System32\webclnt.dll
23:18:35.0937 2416  WebClient - ok
23:18:35.0984 2416  [ 090A2B8F055343815556A01F725F6C35 ] WimFltr         C:\WINDOWS\system32\DRIVERS\wimfltr.sys
23:18:36.0000 2416  WimFltr - ok
23:18:36.0062 2416  [ 6F3F3973D97714CC5F906A19FE883729 ] winmgmt         C:\WINDOWS\system32\wbem\WMIsvc.dll
23:18:36.0187 2416  winmgmt - ok
23:18:36.0265 2416  [ F10075C2EC96D2EB118012E78ECE2FC2 ] WinRM           C:\WINDOWS\system32\WsmSvc.dll
23:18:36.0359 2416  WinRM - ok
23:18:36.0453 2416  [ 671DB6A9B772B807721147C28FAF760F ] WmBEnum         C:\WINDOWS\system32\drivers\WmBEnum.sys
23:18:36.0500 2416  WmBEnum - ok
23:18:36.0515 2416  [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN        C:\WINDOWS\system32\MsPMSNSv.dll
23:18:36.0578 2416  WmdmPmSN - ok
23:18:36.0609 2416  [ CFFE18DB8140B00335221907A694DD01 ] WmFilter        C:\WINDOWS\system32\drivers\WmFilter.sys
23:18:36.0640 2416  WmFilter - ok
23:18:36.0671 2416  [ 93908111BA57A6E60EC2FA2DE202105C ] WmiApSrv        C:\WINDOWS\system32\wbem\wmiapsrv.exe
23:18:36.0781 2416  WmiApSrv - ok
23:18:36.0890 2416  [ BF05650BB7DF5E9EBDD25974E22403BB ] WMPNetworkSvc   C:\Programme\Windows Media Player\WMPNetwk.exe
23:18:36.0937 2416  WMPNetworkSvc - ok
23:18:36.0984 2416  [ 2E17EA3B132963E3C07D50D68D2DF54E ] WmVirHid        C:\WINDOWS\system32\drivers\WmVirHid.sys
23:18:37.0000 2416  WmVirHid - ok
23:18:37.0015 2416  [ 0ECE3BB49EB9EE42C411A0F1EC39DDA9 ] WmXlCore        C:\WINDOWS\system32\drivers\WmXlCore.sys
23:18:37.0046 2416  WmXlCore - ok
23:18:37.0078 2416  [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb          C:\WINDOWS\system32\DRIVERS\wpdusb.sys
23:18:37.0093 2416  WpdUsb - ok
23:18:37.0234 2416  [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
23:18:37.0281 2416  WPFFontCache_v0400 - ok
23:18:37.0343 2416  [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc          C:\WINDOWS\system32\wscsvc.dll
23:18:37.0453 2416  wscsvc - ok
23:18:37.0453 2416  WSearch - ok
23:18:37.0468 2416  [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC        C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
23:18:37.0593 2416  WSTCODEC - ok
23:18:37.0687 2416  [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv        C:\WINDOWS\system32\wuauserv.dll
23:18:37.0812 2416  wuauserv - ok
23:18:37.0859 2416  [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf          C:\WINDOWS\system32\DRIVERS\WudfPf.sys
23:18:37.0921 2416  WudfPf - ok
23:18:37.0937 2416  [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd          C:\WINDOWS\system32\DRIVERS\wudfrd.sys
23:18:37.0968 2416  WudfRd - ok
23:18:38.0000 2416  [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc         C:\WINDOWS\System32\WUDFSvc.dll
23:18:38.0046 2416  WudfSvc - ok
23:18:38.0078 2416  [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC          C:\WINDOWS\System32\wzcsvc.dll
23:18:38.0218 2416  WZCSVC - ok
23:18:38.0296 2416  [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov         C:\WINDOWS\System32\xmlprov.dll
23:18:38.0406 2416  xmlprov - ok
23:18:38.0484 2416  [ 4322C32CED8C4772E039616DCBF01D3F ] yukonwxp        C:\WINDOWS\system32\DRIVERS\yk51x86.sys
23:18:38.0546 2416  yukonwxp - ok
23:18:38.0562 2416  ================ Scan global ===============================
23:18:38.0593 2416  [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll
23:18:38.0609 2416  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
23:18:38.0625 2416  [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
23:18:38.0656 2416  [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe
23:18:38.0656 2416  [Global] - ok
23:18:38.0656 2416  ================ Scan MBR ==================================
23:18:38.0671 2416  [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk0\DR0
23:18:39.0578 2416  \Device\Harddisk0\DR0 - ok
23:18:39.0578 2416  [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk1\DR1
23:18:39.0890 2416  \Device\Harddisk1\DR1 - ok
23:18:39.0890 2416  ================ Scan VBR ==================================
23:18:39.0890 2416  [ 43E89A61C3AF49F8D624AA2DE4002AED ] \Device\Harddisk0\DR0\Partition1
23:18:39.0890 2416  \Device\Harddisk0\DR0\Partition1 - ok
23:18:39.0906 2416  [ 889D8DC8733C621E99545E859CABB2A9 ] \Device\Harddisk1\DR1\Partition1
23:18:39.0906 2416  \Device\Harddisk1\DR1\Partition1 - ok
23:18:39.0906 2416  ============================================================
23:18:39.0906 2416  Scan finished
23:18:39.0906 2416  ============================================================
23:18:40.0015 1976  Detected object count: 18
23:18:40.0015 1976  Actual detected object count: 18
23:19:47.0203 1976  Afc ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0203 1976  Afc ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0203 1976  ASAPIW2K ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0203 1976  ASAPIW2K ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0218 1976  Aspi32 ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0218 1976  Aspi32 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0218 1976  ATI Smart ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0218 1976  ATI Smart ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0218 1976  Cdr4_xp ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0218 1976  Cdr4_xp ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0218 1976  Cdralw2k ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0218 1976  Cdralw2k ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0218 1976  GT680x ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0218 1976  GT680x ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0218 1976  Haspnt ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0218 1976  Haspnt ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0218 1976  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0218 1976  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0218 1976  MA-620 ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0218 1976  MA-620 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0218 1976  MxlW2k ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0218 1976  MxlW2k ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0218 1976  PCLEPCI ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0218 1976  PCLEPCI ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0218 1976  PMUSB2G ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0218 1976  PMUSB2G ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0218 1976  SearchAnonymizer ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0218 1976  SearchAnonymizer ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0234 1976  sfdrv01 ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0234 1976  sfdrv01 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0234 1976  sfhlp02 ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0234 1976  sfhlp02 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0234 1976  sfsync02 ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0234 1976  sfsync02 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
23:19:47.0234 1976  symlcbrd ( UnsignedFile.Multi.Generic ) - skipped by user
23:19:47.0234 1976  symlcbrd ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus · 13.11.2012, 23:32

Die Logs bitte in CODE-Tags posten!

Ich hab es mal korrigiert, aber halte dich bitte bei den nächsten Logs auch daran!

Die LOgs sehen ok aus probier bitte auch ein Log mit GMER zu erstellen

Edit: Bitte auch FSS probieren, egal ob das mit GMER hinhaut oder nicht

Downloade dir bitte Farbar's Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
- SecurityCenter / ActionCenter
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

Tina666 · 14.11.2012, 13:51

Wie geht das in Code Tags? Was muß ich da beim Antworten beachten?

Tina

cosinus · 14.11.2012, 13:52

Wurde doch in meinen Hinweisen erklärt bzw. verlinkt => http://www.trojaner-board.de/misc.php?do=bbcode#code

Die Logs bitte NICHT anhängen!!

Sie müssen nur dann in den Anhang (als eine ZIP-Datei mit allen Logdateien), wenn sie zu groß sind um direkt gepostet zu werden!

Ansonsten bitte alles nach Möglichkeit hier in CODE-Tags posten. Das ist einfacher, übersichtlicher und man spart sich ne Menge Rumklickerei!

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

Tina666 · 15.11.2012, 01:27

GMER nun endlich beendet. Hat ja Stunden gedauert....

[code]

GMER Logfile:

Code:

ATTFilter

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-11-15 01:25:52
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-f SAMSUNG_HD501LJ rev.CR100-13
Running: vjp1wcni.exe; Driver: c:\temp\fxtiypob.sys


---- System - GMER 1.0.15 ----

SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwAdjustPrivilegesToken [0xACF74FBA]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwClose [0xACF758B4]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwConnectPort [0xACF8EAEE]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwCreateEvent [0xACF75E26]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwCreateMutant [0xACF75D14]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwCreatePort [0xACF8EE06]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwCreateProcess [0xACF76056]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwCreateProcessEx [0xACF7621E]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwCreateSection [0xACF74D76]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwCreateSemaphore [0xACF75F3E]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwCreateThread [0xACF755E6]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwCreateWaitablePort [0xACF8EECE]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwDebugActiveProcess [0xACF7653C]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwDeleteKey [0xACF89084]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwDeleteValueKey [0xACF8A88E]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwDeviceIoControlFile [0xACF758F6]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwDuplicateObject [0xACF7753C]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwEnumerateKey [0xACF8A088]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwEnumerateValueKey [0xACF8AA38]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwLoadDriver [0xACF7662E]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwLoadKey [0xACF89BC0]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwLoadKey2 [0xACF89E1C]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwMapViewOfSection [0xACF76B9A]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwNotifyChangeKey [0xACF8D30A]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwOpenEvent [0xACF75EB8]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwOpenMutant [0xACF75DA0]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwOpenProcess [0xACF751F4]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwOpenSection [0xACF7697E]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwOpenSemaphore [0xACF75FD0]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwOpenThread [0xACF750E8]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwQueryKey [0xACF88EB8]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwQueryMultipleValueKey [0xACF8A698]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwQueryObject [0xACF8D500]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwQuerySection [0xACF76EC0]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwQueryValueKey [0xACF8A488]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwQueueApcThread [0xACF767CE]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwRenameKey [0xACF89198]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwReplaceKey [0xACF8980C]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwReplyPort [0xACF8F048]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwReplyWaitReceivePort [0xACF8EF96]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwRequestWaitReplyPort [0xACF8F0B4]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwRestoreKey [0xACF89A14]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwResumeThread [0xACF773DE]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwSaveKey [0xACF8933E]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwSaveKeyEx [0xACF894D4]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwSaveMergedKeys [0xACF89670]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwSecureConnectPort [0xACF8EC76]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwSetContextThread [0xACF75756]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwSetInformationToken [0xACF763E8]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwSetSystemInformation [0xACF77010]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwSetValueKey [0xACF8A248]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwSuspendProcess [0xACF77104]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwSuspendThread [0xACF7723E]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwSystemDebugControl [0xACF7645E]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwTerminateProcess [0xACF75392]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwTerminateThread [0xACF752EA]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwUnmapViewOfSection [0xACF76D78]
SSDT                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        ZwWriteVirtualMemory [0xACF7547C]

INT 0x06                                                                                                                              \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems)                                                                              BA19316D
INT 0x0E                                                                                                                              \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems)                                                                              BA192FC2

Code                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        FsRtlCheckLockForReadAccess
Code                                                                                                                                  \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                                                                        IoIsOperationSynchronous

---- Kernel code sections - GMER 1.0.15 ----

.text                                                                                                                                 ntoskrnl.exe!ZwYieldExecution + F2                                                                                                                                                           804E494C 4 Bytes  [EE, EA, F8, AC]
.text                                                                                                                                 ntoskrnl.exe!ZwYieldExecution + 12E                                                                                                                                                          804E4988 12 Bytes  [06, EE, F8, AC, 56, 60, F7, ...]
.text                                                                                                                                 ntoskrnl.exe!ZwYieldExecution + 1FA                                                                                                                                                          804E4A54 12 Bytes  [2E, 66, F7, AC, C0, 9B, F8, ...] {IMUL WORD CS:[EAX+EAX*8+0x1cacf89b]; SAHF ; CLC ; LODSB }
.text                                                                                                                                 ntoskrnl.exe!ZwYieldExecution + 276                                                                                                                                                          804E4AD0 4 Bytes  [E8, 50, F7, AC]
.text                                                                                                                                 ntoskrnl.exe!ZwYieldExecution + 376                                                                                                                                                          804E4BD0 16 Bytes  [98, 91, F8, AC, 0C, 98, F8, ...]
.text                                                                                                                                 ...                                                                                                                                                                                          
.text                                                                                                                                 ntoskrnl.exe!IoIsOperationSynchronous                                                                                                                                                        804EAFAE 5 Bytes  JMP ACF67DCC \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
.text                                                                                                                                 ntoskrnl.exe!FsRtlCheckLockForReadAccess                                                                                                                                                     804F9B24 5 Bytes  JMP ACF679F0 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
.text                                                                                                                                 C:\WINDOWS\system32\DRIVERS\ati2mtag.sys                                                                                                                                                     section is writeable [0xB9A8A000, 0x1B601E, 0xE8000020]
.text                                                                                                                                 C:\WINDOWS\system32\drivers\hardlock.sys                                                                                                                                                     section is writeable [0xAA01E400, 0x82482, 0xE8000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xAA0BE420]  C:\WINDOWS\system32\drivers\hardlock.sys                                                                                                                                                     entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xAA0BE420]
.protectÿÿÿÿhardlockunknown last code section [0xAA0BE200, 0x5105, 0xE0000020]                                                        C:\WINDOWS\system32\drivers\hardlock.sys                                                                                                                                                     unknown last code section [0xAA0BE200, 0x5105, 0xE0000020]

---- User code sections - GMER 1.0.15 ----

.text                                                                                                                                 C:\WINDOWS\system32\SearchIndexer.exe[2360] kernel32.dll!WriteFile                                                                                                                           7C810E27 7 Bytes  JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text                                                                                                                                 C:\Programme\Mozilla Firefox\firefox.exe[2716] ntdll.dll!LdrLoadDll                                                                                                                          7C92632D 5 Bytes  JMP 01445B00 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text                                                                                                                                 C:\Programme\Mozilla Firefox\firefox.exe[2716] kernel32.dll!lstrlenW + 43                                                                                                                    7C809AEC 7 Bytes  JMP 01687B58 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text                                                                                                                                 C:\Programme\Mozilla Firefox\firefox.exe[2716] kernel32.dll!MapViewOfFileEx + 6A                                                                                                             7C80B9A0 1 Byte  [E9]
.text                                                                                                                                 C:\Programme\Mozilla Firefox\firefox.exe[2716] kernel32.dll!MapViewOfFileEx + 6A                                                                                                             7C80B9A0 7 Bytes  JMP 01687B35 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text                                                                                                                                 C:\Programme\Mozilla Firefox\firefox.exe[2716] kernel32.dll!ValidateLocale + B130                                                                                                            7C844958 7 Bytes  JMP 0144EF12 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text                                                                                                                                 C:\Programme\Mozilla Firefox\firefox.exe[2716] GDI32.dll!SetDIBitsToDevice + 20A                                                                                                             77EF9E14 7 Bytes  JMP 01687AB6 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\ipsec.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                          [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\tcpip.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                          [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject]                                                                                                                      [BA353DC0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\netbt.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                          [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject]                                                                                                                      [BA353DC0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\ipnat.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                          [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                            [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\netbios.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                        [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\rdbss.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                          [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\wanarp.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                         [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                         [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\System32\Drivers\Fips.SYS[ntoskrnl.exe!IoCreateDevice]                                                                                                                           [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\usbprint.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                       [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\System32\Drivers\HIDCLASS.SYS[ntoskrnl.exe!IoCreateDevice]                                                                                                                       [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\mouhid.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                         [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\System32\Drivers\Cdfs.SYS[ntoskrnl.exe!IoCreateDevice]                                                                                                                           [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\irda.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                           [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\ndisuio.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                        [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\drivers\wdmaud.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                         [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\drivers\sysaudio.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                       [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\System32\Drivers\ParVdm.SYS[ntoskrnl.exe!IoCreateDevice]                                                                                                                         [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\System32\Drivers\Fastfat.SYS[ntoskrnl.exe!IoCreateDevice]                                                                                                                        [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                            [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT                                                                                                                                   \SystemRoot\System32\Drivers\HTTP.sys[ntoskrnl.exe!IoCreateDevice]                                                                                                                           [BA353C70] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)

---- Devices - GMER 1.0.15 ----

AttachedDevice                                                                                                                        \FileSystem\Ntfs \Ntfs                                                                                                                                                                       symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice                                                                                                                        \Driver\Tcpip \Device\Ip                                                                                                                                                                     kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice                                                                                                                        \Driver\Tcpip \Device\Tcp                                                                                                                                                                    kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)

Device                                                                                                                                                                                                                                                                                                                             pci.sys (NT-Plug & Play PCI-Enumerator/Microsoft Corporation)
Device                                                                                                                                                                                                                                                                                                                             ftdisk.sys (FT-Datenträgertreiber/Microsoft Corporation)

AttachedDevice                                                                                                                                                                                                                                                                                                                     symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

Device                                                                                                                                \Driver\atapi \Device\Ide\IdePort0                                                                                                                                                           sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device                                                                                                                                                                                                                                                                                                                             sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device                                                                                                                                \Driver\atapi \Device\Ide\IdePort1                                                                                                                                                           sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device                                                                                                                                \Driver\atapi \Device\Ide\IdePort2                                                                                                                                                           sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device                                                                                                                                \Driver\atapi \Device\Ide\IdePort3                                                                                                                                                           sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

AttachedDevice                                                                                                                        \Driver\Tcpip \Device\Udp                                                                                                                                                                    kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice                                                                                                                        \Driver\Tcpip \Device\RawIp                                                                                                                                                                  kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)

Device                                                                                                                                                                                                                                                                                                                             mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device                                                                                                                                                                                                                                                                                                                             Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)
Device                                                                                                                                                                                                                                                                                                                             Fs_Rec.SYS (File System Recognizer Driver/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg                                                                                                                                   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@C:\Programme\IMSI\CADsymbols\Variants\Architektur\Sonnenschutz\Raffstore\Einzelteile\Antriebe\include\Gelenklager_0-45\xb0.StvVar  1
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel                                                                                             Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@                                                                                                           C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b                                                                           0xC8 0x28 0x51 0xAF ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel                                                                                             Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@                                                                                                           C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b                                                                           0x71 0x3B 0x04 0x66 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel                                                                                             Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@                                                                                                           C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016                                                                           0x25 0xDA 0xEC 0x7E ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel                                                                                             Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@                                                                                                           C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48                                                                           0x86 0x8C 0x21 0x01 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel                                                                                             Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@                                                                                                           C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472                                                                           0xF5 0x1D 0x4D 0x73 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel                                                                                             Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@                                                                                                           C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d                                                                           0xB0 0x18 0xED 0xA7 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel                                                                                             Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@                                                                                                           C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b                                                                           0x31 0x77 0xE1 0xBA ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel                                                                                             Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@                                                                                                           C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d                                                                           0x83 0x6C 0x56 0x8B ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel                                                                                             Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@                                                                                                           C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3                                                                           0x51 0xFA 0x6E 0x91 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel                                                                                             Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@                                                                                                           C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b                                                                           0xB1 0xCD 0x45 0x5A ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel                                                                                             Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@                                                                                                           C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6                                                                           0xE3 0x0E 0x66 0xD5 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel                                                                                             Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@                                                                                                           C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2                                                                           0xFA 0xEA 0x66 0x7F ...
Reg                                                                                                                                   HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{81A5E050-A058-9B7D-3121-B4D07E0CD962}                                                                              
Reg                                                                                                                                   HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{81A5E050-A058-9B7D-3121-B4D07E0CD962}@oapgnojopinngplplhckbpkmfgekhb                                               0x63 0x61 0x70 0x61 ...
Reg                                                                                                                                   HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{81A5E050-A058-9B7D-3121-B4D07E0CD962}@oalfnkeajmodfepbafbbageoffnpoj                                               0x69 0x61 0x61 0x62 ...
Reg                                                                                                                                   HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{81A5E050-A058-9B7D-3121-B4D07E0CD962}@nabglajpckfghfgglkkgiljfnalp                                                 0x69 0x61 0x70 0x61 ...

---- EOF - GMER 1.0.15 ----

--- --- ---

cosinus · 15.11.2012, 17:02

Ok, was bitte ist mit Farbars Service Scanner?

15.11.2012, 17:02	#15
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Kaspersky startet nicht Ok, was bitte ist mit Farbars Service Scanner? __________________ Logfiles bitte immer in CODE-Tags posten

Kaspersky startet nicht

Log-Analyse und Auswertung: Kaspersky startet nicht