Liebes Forum,

mein Laptop wurde vor wenigen Tagen von einem GVU/BSI-Virus heimgesucht.

Seitdem erscheint beim normalen Starten von Windows ein Sperrbildschirm (siehe Foto im Anhang).

Dieser erscheint auch im "abgesicherten Modus" und im "abgesicherten Modus mit Netzwerktreiber". Nur der "abgesicherte Modus mit Eingabeaufforderung" funktioniert noch.

Betriebssystem: Windows XP Professional
Benutzerkonten: nur 1
Festplatte: nur C:

Priorität hat für mich zunächst die Sicherung meiner Daten!

WER KANN MIR HELFEN???

Für jegliche Unterstützung bereits einen lieben Dank im Voraus!

hi,
Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.


Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.

• Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
• Lege eine leere CD in Deinen Brenner.
• ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
• Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
• Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD


Bebilderte Anleitung: OTLpe-Scan

• Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
• Mache einen Doppelklick auf das OTLPE Icon.
• Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
• Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
• Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
• Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
• OTLpe sollte nun starten.
• Drücke Run Scan, um den Scan zu starten.
• Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
• Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
• Bitte poste den Inhalt von C:\OTL.txt und Extras.txt.

Vielen Dank!

Habe morgen Zugriff auf einen CD-Brenner. Ich poste das Ergebnis des Scans dann ASAP...

ok, einfach weiterarbeiten wenn Zeit ist

Ging doch etwas schneller...OTL Logfile:

OTL logfile created on: 1/15/2013 10:22:51 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Programme
Drive C: | 4.73 Gb Total Space | 0.84 Gb Free Space | 17.67% Space Free | Partition Type: FAT32
Drive D: | 51.15 Gb Total Space | 20.44 Gb Free Space | 39.96% Space Free | Partition Type: NTFS
Drive E: | 3.75 Gb Total Space | 0.43 Gb Free Space | 11.40% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - [2013/01/10 12:35:39 | 000,147,456 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\wpbt0.dll -- (winmgmt)
SRV - [2012/09/12 10:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/04/16 02:33:40 | 000,144,672 | ---- | M] (Apple Inc.) [Auto] -- D:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/03/23 06:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto] -- D:\Programme\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2010/03/02 19:20:00 | 000,132,456 | ---- | M] (Lenovo.) [Auto] -- D:\Programme\ThinkPad\Utilities\DOZESVC.EXE -- (DozeSvc)
SRV - [2010/03/02 19:20:00 | 000,053,248 | ---- | M] () [Auto] -- D:\Programme\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service)
SRV - [2010/01/18 09:41:50 | 000,063,928 | ---- | M] (Lenovo Group Limited) [Auto] -- D:\Programme\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)
SRV - [2009/11/17 12:06:02 | 000,044,984 | ---- | M] (Lenovo Group Limited) [Auto] -- D:\Programme\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE)
SRV - [2009/06/12 04:55:48 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto] -- D:\Programme\Lenovo\System Update\SUService.exe -- (SUService)
SRV - [2008/03/04 04:34:12 | 001,122,304 | ---- | M] (Lenovo Group Limited) [Auto] -- D:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe -- (TVT Scheduler)
SRV - [2007/09/26 11:34:46 | 000,644,408 | ---- | M] (Lenovo Group Limited) [Auto] -- D:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe -- (ThinkVantage Registry Monitor Service)
SRV - [2006/06/29 15:57:50 | 000,032,768 | ---- | M] () [Auto] -- D:\WINDOWS\system32\TpKmpSvc.exe -- (TpKmpSVC)
SRV - [2005/11/01 08:04:02 | 000,258,103 | ---- | M] (Broadcom Corporation.) [Auto] -- D:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe -- (btwdins)
SRV - [2005/04/03 17:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand] -- D:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/09/29 06:14:36 | 000,069,632 | ---- | M] (HP) [Auto] -- D:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2003/07/28 05:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003/06/19 16:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (SymIMMP)
DRV - File not found [Kernel | On_Demand] --  -- (SymIM)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (gfhbpvru)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - File not found [Kernel | On_Demand] --  -- (BCM43XX)
DRV - [2013/01/13 07:46:43 | 000,043,600 | ---- | M] (Microsoft Corporation) [Kernel | System] -- D:\WINDOWS\system32\drivers\bnyxxgis.sys -- (bnyxxgis)
DRV - [2010/03/25 22:08:00 | 000,004,608 | ---- | M] () [Kernel | System] -- D:\WINDOWS\system32\drivers\TSMAPIP.SYS -- (TSMAPIP)
DRV - [2010/03/23 06:15:36 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto] -- D:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2010/03/02 19:20:00 | 000,024,304 | ---- | M] (Lenovo.) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\DOZEHDD.SYS -- (DozeHDD)
DRV - [2010/03/02 19:20:00 | 000,004,442 | ---- | M] () [Kernel | System] -- D:\WINDOWS\system32\drivers\TPPWRIF.SYS -- (TPPWRIF)
DRV - [2009/10/09 06:12:02 | 000,120,360 | ---- | M] (Lenovo.) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\ApsX86.sys -- (Shockprf)
DRV - [2009/10/09 06:10:24 | 000,020,520 | ---- | M] (Lenovo.) [Kernel | Boot] -- D:\WINDOWS\system32\drivers\ApsHM86.sys -- (TPDIGIMN)
DRV - [2009/03/13 07:47:26 | 000,012,560 | ---- | M] (UPEK Inc.) [Kernel | Auto] -- D:\Programme\ThinkVantage Fingerprint Software\smihlp.sys -- (smihlp) SMI Helper Driver (smihlp)
DRV - [2008/11/16 11:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2008/05/12 12:04:02 | 000,013,480 | ---- | M] (Lenovo Group Limited) [Kernel | System] -- D:\WINDOWS\system32\drivers\smiif32.sys -- (lenovo.smi)
DRV - [2008/04/13 18:23:10 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2007/11/14 12:05:16 | 000,394,952 | ---- | M] (Zone Labs, LLC) [Kernel | On_Demand] -- D:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2007/11/01 10:26:36 | 000,989,696 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2007/11/01 10:25:32 | 000,211,456 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2007/11/01 10:25:22 | 000,731,520 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2007/06/14 09:29:08 | 000,457,856 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\PAC7302.SYS -- (PAC7302)
DRV - [2007/02/19 00:56:46 | 000,021,376 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\psadd.sys -- (psadd)
DRV - [2007/01/18 13:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2006/10/01 19:55:00 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | System] -- D:\WINDOWS\system32\drivers\SMAPINT.SYS -- (Smapint)
DRV - [2006/10/01 19:55:00 | 000,009,343 | ---- | M] () [Kernel | System] -- D:\WINDOWS\system32\drivers\TDSMAPI.SYS -- (TDSMAPI)
DRV - [2006/05/09 11:47:10 | 000,024,521 | ---- | M] (Nortel Networks) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\eacfilt.sys -- (Eacfilt)
DRV - [2006/05/09 11:46:42 | 000,155,216 | ---- | M] (Nortel Networks NA, Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ipsecw2k.sys -- (IPSECSHM)
DRV - [2006/05/09 11:46:42 | 000,155,216 | ---- | M] (Nortel Networks NA, Inc.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\ipsecw2k.sys -- (IPSECEXT)
DRV - [2005/11/28 05:09:26 | 000,013,568 | ---- | M] (Intel Corporation) [Kernel | Auto] -- D:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2005/11/27 00:36:08 | 001,427,968 | ---- | M] (Intel® Corporation) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel(R)
DRV - [2005/11/01 07:53:14 | 001,342,122 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2005/11/01 07:51:06 | 000,056,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- D:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Administrator_ON_D\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\Administrator_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\LocalService_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\***_ON_D\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\***_ON_D\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\***_ON_D\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\***_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\***_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\***_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: D:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: D:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: D:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.732: D:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.732: D:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.732: D:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/06/16 09:55:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins
 
[2011/08/06 08:00:03 | 000,000,000 | ---D | M] (No name found) -- D:\Programme\Mozilla Firefox\extensions
[2011/07/08 02:31:38 | 000,142,296 | ---- | M] (Mozilla Foundation) -- D:\Programme\mozilla firefox\components\browsercomps.dll
[2010/01/01 03:00:00 | 000,001,392 | ---- | M] () -- D:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010/01/01 03:00:00 | 000,002,252 | ---- | M] () -- D:\Programme\mozilla firefox\searchplugins\bing.xml
[2010/01/01 03:00:00 | 000,001,153 | ---- | M] () -- D:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2010/01/01 03:00:00 | 000,006,805 | ---- | M] () -- D:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2010/01/01 03:00:00 | 000,001,178 | ---- | M] () -- D:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2010/01/01 03:00:00 | 000,001,105 | ---- | M] () -- D:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004/08/03 22:00:00 | 000,000,820 | ---- | M]) - D:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Programme\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKU\***_ON_D\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] D:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [MSC] D:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PWRMGRTR] D:\Programme\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [TkBellExe] D:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [TP4EX] D:\WINDOWS\System32\TP4EX.exe (Lenovo Group Limited)
O4 - HKLM..\Run: [TPHOTKEY] D:\Programme\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited)
O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] D:\Programme\Gemeinsame Dateien\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\Administrator_ON_D..\RunOnce: [configmsi] D:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - HKU\Administrator_ON_D..\RunOnce: [supportdir]  File not found
O4 - Startup: D:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk =  File not found
O4 - Startup: D:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\runctf.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\***_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Senden an &Bluetooth - D:\Programme\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - D:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} hxxp://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/1.4.2/jinstall-142-win.cab (Java Plug-in 1.4.2)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - D:\WINDOWS\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\NavLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\psfus: DllName - C:\Programme\ThinkVantage Fingerprint Software\psqlpwd.dll - D:\Programme\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: D:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: D:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - D:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/10/16 07:05:51 | 000,000,000 | -H-- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - File not found -  -- [ FAT32 ]
O32 - AutoRun File - [2006/10/16 07:05:51 | 000,000,000 | -H-- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6C298884-91FD-408C-9D90-5A59D2C29FD1} - Microsoft .NET Framework 1.1 Security Update (KB2742597)
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8F736E10-8E5C-4399-A532-D0C00A406227} - Microsoft .NET Framework 1.1 Security Update (KB2698023)
ActiveX: {9309DD7E-EBFE-3C95-8B47-30D3A012F606} - .NET Framework
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework
ActiveX: {C3C986D6-06B1-43BF-90DD-BE30756C00DE} - RevokedRootsUpdate
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: Microsoft Base Smart Card Crypto Provider Package - 
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: winmgmt - D:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\wpbt0.dll (Microsoft Corporation)
 
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk - D:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe - (Adobe Systems Incorporated)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^AutoUpdate Monitor.lnk -  - File not found
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Digital Line Detect.lnk - D:\Program Files\Digital Line Detect\DLG.exe - (Avanquest Software )
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Windows Search.lnk - D:\Programme\Windows Desktop Search\WindowsSearch.exe - (Microsoft Corporation)
MsConfig - StartUpReg: ACTray - hkey= - key= -  File not found
MsConfig - StartUpReg: ACWLIcon - hkey= - key= -  File not found
MsConfig - StartUpReg: AMSG - hkey= - key= -  File not found
MsConfig - StartUpReg: BlackBerryAutoUpdate - hkey= - key= - D:\Programme\Gemeinsame Dateien\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)
MsConfig - StartUpReg: cssauth - hkey= - key= -  File not found
MsConfig - StartUpReg: CTFMON.EXE - hkey= - key= -  File not found
MsConfig - StartUpReg: DiskeeperSystray - hkey= - key= -  File not found
MsConfig - StartUpReg: EZEJMNAP - hkey= - key= - D:\Programme\ThinkPad\Utilities\EZEJMNAP.EXE (Lenovo Group Ltd.)
MsConfig - StartUpReg: ISUSPM Startup - hkey= - key= -  File not found
MsConfig - StartUpReg: ISUSScheduler - hkey= - key= -  File not found
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - D:\Programme\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: LPMailChecker - hkey= - key= - D:\Programme\ThinkVantage\PrdCtr\LPMLCHK.EXE (Lenovo Group Limited)
MsConfig - StartUpReg: LPManager - hkey= - key= - D:\Programme\ThinkVantage\PrdCtr\LPMGR.EXE (Lenovo Group Limited)
MsConfig - StartUpReg: PAC7302_Monitor - hkey= - key= - D:\WINDOWS\PixArt\Pac7302\Monitor.exe (PixArt Imaging Incorporation)
MsConfig - StartUpReg: PDService.exe - hkey= - key= -  File not found
MsConfig - StartUpReg: pwrpdfprsrv.exe - hkey= - key= - D:\Programme\PowerPDF Professional\pwrpdfsrv.exe (Visage Software)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - D:\Programme\QuickTime\qttask.exe (Apple Inc.)
MsConfig - StartUpReg: SDTray - hkey= - key= -  File not found
MsConfig - StartUpReg: Skype - hkey= - key= - D:\Programme\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig - StartUpReg: SoundMAX - hkey= - key= - D:\Programme\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)
MsConfig - StartUpReg: SoundMAXPnP - hkey= - key= - D:\Programme\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - D:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: suScheduler - hkey= - key= -  File not found
MsConfig - StartUpReg: swg - hkey= - key= - D:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig - StartUpReg: SynTPEnh - hkey= - key= - D:\Programme\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)
MsConfig - StartUpReg: SynTPLpr - hkey= - key= - D:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics Incorporated)
MsConfig - StartUpReg: TkBellExe - hkey= - key= - D:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: TP4EX - hkey= - key= -  File not found
MsConfig - StartUpReg: TPFNF7 - hkey= - key= - D:\Programme\Lenovo\NPDIRECT\TPFNF7SP.exe (Lenovo Group Limited)
MsConfig - StartUpReg: TPKMAPHELPER - hkey= - key= - D:\Programme\ThinkPad\Utilities\TpKmapAp.exe (Lenovo)
MsConfig - StartUpReg: TpShocks - hkey= - key= -  File not found
MsConfig - StartUpReg: TVT Scheduler Proxy - hkey= - key= - D:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited)
MsConfig - StartUpReg: updateMgr - hkey= - key= - D:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/13 07:46:42 | 000,043,600 | ---- | C] (Microsoft Corporation) -- D:\WINDOWS\System32\drivers\bnyxxgis.sys
[2013/01/13 07:28:26 | 000,000,000 | -HSD | C] -- D:\WINDOWS\CSC
[2013/01/10 12:35:48 | 000,147,456 | ---- | C] (Microsoft Corporation) -- D:\Dokumente und Einstellungen\***\wgsdgsdgdsgsd.exe
[2013/01/10 12:15:37 | 000,000,000 | -HSD | C] -- D:\Config.Msi
[50 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ]
[46 D:\WINDOWS\System32\dllcache\*.tmp files -> D:\WINDOWS\System32\dllcache\*.tmp -> ]
[1 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/01/13 08:41:18 | 000,002,048 | --S- | M] () -- D:\WINDOWS\bootstat.dat
[2013/01/13 07:53:38 | 000,000,386 | -H-- | M] () -- D:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013/01/13 07:46:43 | 000,043,600 | ---- | M] (Microsoft Corporation) -- D:\WINDOWS\System32\drivers\bnyxxgis.sys
[2013/01/13 07:45:11 | 095,023,320 | ---- | M] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\0tbpw.pad
[2013/01/13 07:44:49 | 000,002,278 | ---- | M] () -- D:\WINDOWS\System32\wpa.dbl
[2013/01/13 07:29:46 | 000,003,176 | ---- | M] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\0tbpw.js
[2013/01/13 07:29:46 | 000,000,813 | ---- | M] () -- D:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\runctf.lnk
[2013/01/13 07:24:42 | 000,000,664 | ---- | M] () -- D:\WINDOWS\System32\d3d9caps.dat
[2013/01/13 07:21:14 | 000,002,423 | ---- | M] () -- D:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk
[2013/01/13 07:21:12 | 000,000,316 | ---- | M] () -- D:\WINDOWS\tasks\PMTask.job
[2013/01/13 07:21:06 | 000,001,100 | ---- | M] () -- D:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/13 07:20:58 | 000,000,286 | ---- | M] () -- D:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1438623065-2946043602-1926309237-1005.job
[2013/01/10 16:36:00 | 000,001,104 | ---- | M] () -- D:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/10 12:49:36 | 000,532,120 | ---- | M] () -- D:\WINDOWS\System32\perfh007.dat
[2013/01/10 12:49:36 | 000,485,012 | ---- | M] () -- D:\WINDOWS\System32\perfh009.dat
[2013/01/10 12:49:36 | 000,081,026 | ---- | M] () -- D:\WINDOWS\System32\perfc009.dat
[2013/01/10 12:49:35 | 000,106,668 | ---- | M] () -- D:\WINDOWS\System32\perfc007.dat
[2013/01/10 12:36:01 | 000,147,456 | ---- | M] (Microsoft Corporation) -- D:\Dokumente und Einstellungen\***\wgsdgsdgdsgsd.exe
[2013/01/06 08:26:00 | 000,000,294 | ---- | M] () -- D:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1438623065-2946043602-1926309237-1005.job
[2012/12/29 08:42:24 | 000,099,931 | ---- | M] () -- D:\Dokumente und Einstellungen\***\Desktop\Sony-KDL-40-EX-655-102-cm-40Zoll-LCD-TV-mit-LED-Technik-schwarz.pdf
[2012/12/29 06:37:47 | 000,034,917 | ---- | M] () -- D:\Dokumente und Einstellungen\***\Desktop\21533601-1.jpg
[2012/12/22 15:27:05 | 000,275,760 | ---- | M] () -- D:\WINDOWS\System32\FNTCACHE.DAT
[2012/12/22 09:30:31 | 000,001,393 | ---- | M] () -- D:\WINDOWS\imsins.BAK
[2012/12/19 16:24:06 | 000,473,538 | ---- | M] () -- D:\Dokumente und Einstellungen\***\Desktop\2012 KFZ Fragebogen - Ausgefüllt.pdf
[50 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ]
[46 D:\WINDOWS\System32\dllcache\*.tmp files -> D:\WINDOWS\System32\dllcache\*.tmp -> ]
[1 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/01/13 07:29:46 | 000,000,813 | ---- | C] () -- D:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\runctf.lnk
[2013/01/10 16:30:06 | 000,003,176 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\0tbpw.js
[2013/01/10 16:30:02 | 095,023,320 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\0tbpw.pad
[2013/01/10 12:39:39 | 000,000,664 | ---- | C] () -- D:\WINDOWS\System32\d3d9caps.dat
[2012/12/29 08:42:23 | 000,099,931 | ---- | C] () -- D:\Dokumente und Einstellungen\***\Desktop\Sony-KDL-40-EX-655-102-cm-40Zoll-LCD-TV-mit-LED-Technik-schwarz.pdf
[2012/12/29 06:38:12 | 000,034,917 | ---- | C] () -- D:\Dokumente und Einstellungen\***\Desktop\21533601-1.jpg
[2012/12/19 16:24:06 | 000,473,538 | ---- | C] () -- D:\Dokumente und Einstellungen\***\Desktop\2012 KFZ Fragebogen - Ausgefüllt.pdf
[2012/09/21 08:47:56 | 000,045,056 | ---- | C] () -- D:\WINDOWS\System32\BRTCPCON.DLL
[2012/09/21 08:47:56 | 000,000,114 | ---- | C] () -- D:\WINDOWS\System32\BRLMW03A.INI
[2012/09/21 08:47:56 | 000,000,050 | ---- | C] () -- D:\WINDOWS\System32\BRADM10A.DAT
[2012/08/25 09:23:22 | 000,001,673 | ---- | C] () -- D:\Dokumente und Einstellungen\***\.recently-used.xbel
[2012/02/17 16:19:30 | 000,003,072 | ---- | C] () -- D:\WINDOWS\System32\iacenc.dll
[2011/10/30 05:21:34 | 000,068,871 | ---- | C] () -- D:\WINDOWS\hpoins05.dat
[2011/10/30 05:21:34 | 000,019,696 | ---- | C] () -- D:\WINDOWS\hpomdl05.dat
[2011/08/06 08:00:18 | 000,000,000 | ---- | C] () -- D:\WINDOWS\nsreg.dat
[2010/12/28 17:31:30 | 000,006,656 | ---- | C] () -- D:\WINDOWS\System32\CNMVS58.DLL
[2010/09/16 11:53:56 | 000,000,136 | ---- | C] () -- D:\WINDOWS\ppdrv.ini
[2010/05/11 10:16:09 | 000,000,141 | ---- | C] () -- D:\WINDOWS\BRVIDEO.INI
[2010/05/11 10:16:09 | 000,000,023 | ---- | C] () -- D:\WINDOWS\Brownie.ini
[2010/05/11 10:16:09 | 000,000,000 | ---- | C] () -- D:\WINDOWS\brmx2001.ini
[2010/05/11 10:16:06 | 000,008,981 | ---- | C] () -- D:\WINDOWS\HL-2030.INI
[2010/05/11 10:15:46 | 000,000,432 | ---- | C] () -- D:\WINDOWS\BRWMARK.INI
[2010/05/11 10:15:46 | 000,000,034 | ---- | C] () -- D:\WINDOWS\System32\BD2030.DAT
[2010/05/01 07:36:13 | 000,045,056 | ---- | C] () -- D:\WINDOWS\System32\FPCALL.dll
[2010/05/01 07:35:43 | 000,032,768 | ---- | C] () -- D:\WINDOWS\System32\TpKmpSvc.exe
[2010/05/01 07:33:51 | 000,009,343 | ---- | C] () -- D:\WINDOWS\System32\drivers\TDSMAPI.SYS
[2010/05/01 04:40:52 | 000,000,044 | ---- | C] () -- D:\WINDOWS\SMWizard.INI
[2010/04/30 19:11:47 | 000,196,608 | ---- | C] () -- D:\WINDOWS\PWMBTHLP.EXE
[2010/04/30 19:11:42 | 000,004,442 | ---- | C] () -- D:\WINDOWS\System32\drivers\TPPWRIF.SYS
[2010/03/23 06:26:48 | 000,201,512 | ---- | C] () -- D:\WINDOWS\System32\vpnapi.dll
[2010/03/23 06:17:40 | 000,197,416 | ---- | C] () -- D:\WINDOWS\System32\CSGina.dll
[2009/10/08 14:18:49 | 000,000,566 | ---- | C] () -- D:\WINDOWS\System32\SP7302.INI
[2009/02/25 05:01:50 | 000,000,256 | ---- | C] () -- D:\Dokumente und Einstellungen\***\pool.bin
[2009/02/05 05:31:09 | 000,000,256 | ---- | C] () -- D:\WINDOWS\System32\pool.bin
[2008/11/28 16:11:13 | 000,116,224 | ---- | C] () -- D:\WINDOWS\System32\pdfcmnnt.dll
[2008/05/26 16:23:36 | 000,016,834 | ---- | C] () -- D:\WINDOWS\System32\gthrctr.ini
[2008/05/26 16:23:34 | 000,024,188 | ---- | C] () -- D:\WINDOWS\System32\idxcntrs.ini
[2008/05/26 16:23:32 | 000,016,568 | ---- | C] () -- D:\WINDOWS\System32\gsrvctr.ini
[2008/05/26 15:59:42 | 000,018,904 | ---- | C] () -- D:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 15:59:40 | 000,106,605 | ---- | C] () -- D:\WINDOWS\System32\structuredqueryschema.bin
[2008/03/28 09:15:51 | 000,000,147 | ---- | C] () -- D:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2007/10/28 05:38:02 | 000,000,212 | ---- | C] () -- D:\Dokumente und Einstellungen\***\webct_upload_applet.properties
[2007/08/09 11:43:16 | 000,204,800 | ---- | C] () -- D:\WINDOWS\System32\igfxCoIn_v4860.dll
[2006/12/21 17:21:49 | 001,266,688 | ---- | C] () -- D:\WINDOWS\System32\pwrpdfuid.dll
[2006/12/21 17:21:49 | 000,014,336 | ---- | C] () -- D:\WINDOWS\System32\vsmon1.dll
[2006/11/10 19:49:12 | 000,021,504 | ---- | C] () -- D:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/10/16 07:36:19 | 000,000,400 | ---- | C] () -- D:\WINDOWS\ODBC.INI
[2006/10/16 07:27:55 | 000,000,000 | ---- | C] () -- D:\WINDOWS\vpc32.INI
[2006/10/16 07:05:45 | 000,000,146 | ---- | C] () -- D:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006/03/30 04:44:52 | 000,000,061 | ---- | C] () -- D:\WINDOWS\smscfg.ini
[2006/03/30 04:36:01 | 000,000,040 | ---- | C] () -- D:\WINDOWS\System32\profile.dat
[2006/03/30 04:34:24 | 000,204,800 | ---- | C] () -- D:\WINDOWS\System32\IVIresizeW7.dll
[2006/03/30 04:34:24 | 000,192,512 | ---- | C] () -- D:\WINDOWS\System32\IVIresizeP6.dll
[2006/03/30 04:34:24 | 000,192,512 | ---- | C] () -- D:\WINDOWS\System32\IVIresizeM6.dll
[2006/03/30 04:34:24 | 000,188,416 | ---- | C] () -- D:\WINDOWS\System32\IVIresizePX.dll
[2006/03/30 04:34:23 | 000,200,704 | ---- | C] () -- D:\WINDOWS\System32\IVIresizeA6.dll
[2006/03/30 04:34:23 | 000,020,480 | ---- | C] () -- D:\WINDOWS\System32\IVIresize.dll
[2006/03/30 04:33:14 | 000,028,848 | ---- | C] () -- D:\WINDOWS\System32\drivers\USBkey.sys
[2006/03/30 04:32:54 | 000,000,148 | ---- | C] () -- D:\WINDOWS\wininit.ini
[2006/03/30 04:28:33 | 000,000,146 | ---- | C] () -- D:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006/03/30 04:09:16 | 000,002,458 | ---- | C] () -- D:\WINDOWS\System32\OEMINFO.INI
[2005/11/01 07:59:16 | 000,090,112 | ---- | C] () -- D:\WINDOWS\System32\btprn2k.dll
[2005/07/07 18:06:00 | 000,114,688 | ---- | C] () -- D:\WINDOWS\desktopset.exe
[2005/05/23 01:22:24 | 013,107,200 | ---- | C] () -- D:\WINDOWS\System32\OEMBIOS.BIN
[2005/05/23 01:22:24 | 000,004,547 | ---- | C] () -- D:\WINDOWS\System32\OEMBIOS.DAT
[2004/08/10 06:48:32 | 000,000,849 | ---- | C] () -- D:\WINDOWS\orun32.ini
[2004/08/10 06:33:43 | 000,002,048 | --S- | C] () -- D:\WINDOWS\bootstat.dat
[2004/08/10 06:23:42 | 000,021,740 | ---- | C] () -- D:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 06:18:03 | 000,004,161 | ---- | C] () -- D:\WINDOWS\ODBCINST.INI
[2004/08/10 06:17:14 | 000,275,760 | ---- | C] () -- D:\WINDOWS\System32\FNTCACHE.DAT
[2003/02/20 10:53:42 | 000,005,702 | ---- | C] () -- D:\WINDOWS\System32\OUTLPERF.INI
[2001/11/14 05:56:00 | 001,802,240 | ---- | C] () -- D:\WINDOWS\System32\lcppn21.dll
[1979/12/31 17:00:00 | 000,673,088 | ---- | C] () -- D:\WINDOWS\System32\mlang.dat
[1979/12/31 17:00:00 | 000,532,120 | ---- | C] () -- D:\WINDOWS\System32\perfh007.dat
[1979/12/31 17:00:00 | 000,485,012 | ---- | C] () -- D:\WINDOWS\System32\perfh009.dat
[1979/12/31 17:00:00 | 000,272,128 | ---- | C] () -- D:\WINDOWS\System32\perfi009.dat
[1979/12/31 17:00:00 | 000,269,480 | ---- | C] () -- D:\WINDOWS\System32\perfi007.dat
[1979/12/31 17:00:00 | 000,218,003 | ---- | C] () -- D:\WINDOWS\System32\dssec.dat
[1979/12/31 17:00:00 | 000,106,668 | ---- | C] () -- D:\WINDOWS\System32\perfc007.dat
[1979/12/31 17:00:00 | 000,081,026 | ---- | C] () -- D:\WINDOWS\System32\perfc009.dat
[1979/12/31 17:00:00 | 000,077,824 | ---- | C] () -- D:\WINDOWS\System32\SynTPCoI.dll
[1979/12/31 17:00:00 | 000,046,258 | ---- | C] () -- D:\WINDOWS\System32\mib.bin
[1979/12/31 17:00:00 | 000,034,478 | ---- | C] () -- D:\WINDOWS\System32\perfd007.dat
[1979/12/31 17:00:00 | 000,028,672 | ---- | C] () -- D:\WINDOWS\System32\notifyf2.dll
[1979/12/31 17:00:00 | 000,028,626 | ---- | C] () -- D:\WINDOWS\System32\perfd009.dat
[1979/12/31 17:00:00 | 000,024,576 | ---- | C] () -- D:\WINDOWS\System32\tphklock.dll
[1979/12/31 17:00:00 | 000,004,569 | ---- | C] () -- D:\WINDOWS\System32\secupd.dat
[1979/12/31 17:00:00 | 000,001,804 | ---- | C] () -- D:\WINDOWS\System32\dcache.bin
[1979/12/31 17:00:00 | 000,000,741 | ---- | C] () -- D:\WINDOWS\System32\noise.dat
 
========== LOP Check ==========
 
[2010/09/20 09:17:32 | 000,000,000 | -H-D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2010/05/01 05:16:03 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lenovo
[2010/05/01 09:10:46 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PCDr
[2007/12/13 15:52:27 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-Online
[2010/04/30 16:48:36 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2010/04/30 17:02:35 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ThinkVantage
[2010/04/30 18:50:09 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UIB
[2010/05/01 04:18:20 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2013/01/13 07:21:12 | 000,000,316 | ---- | M] () -- D:\WINDOWS\Tasks\PMTask.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2010/04/30 19:32:54 | 000,000,000 | ---D | M] -- D:\39c4b120d7a82b41cb07
[2006/11/18 19:48:09 | 000,000,000 | ---D | M] -- D:\b85e92ba65f9cb6f8e
[2010/12/28 17:31:36 | 000,000,000 | -H-D | M] -- D:\BJPrinter
[2012/09/21 08:47:54 | 000,000,000 | ---D | M] -- D:\Brother
[2013/01/10 12:54:18 | 000,000,000 | -HSD | M] -- D:\Config.Msi
[2012/07/28 02:39:24 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen
[2010/04/30 18:55:28 | 000,000,000 | ---D | M] -- D:\DRIVERS
[2006/10/16 07:07:43 | 000,000,000 | ---D | M] -- D:\I386
[2006/10/16 07:05:50 | 000,000,000 | ---D | M] -- D:\IBMTOOLS
[2006/10/16 07:28:11 | 000,000,000 | RH-D | M] -- D:\MSOCache
[2011/10/30 05:22:45 | 000,000,000 | ---D | M] -- D:\Program Files
[2012/09/21 17:31:32 | 000,000,000 | R--D | M] -- D:\Programme
[2011/09/03 11:38:29 | 000,000,000 | -H-D | M] -- D:\Recycle.Bin
[2006/03/30 04:44:56 | 000,000,000 | -HSD | M] -- D:\Recycled
[2011/08/28 05:23:38 | 000,000,000 | -HSD | M] -- D:\RECYCLER
[2009/07/21 17:29:35 | 000,000,000 | ---D | M] -- D:\spoolerlogs
[2004/08/10 05:13:12 | 000,000,000 | ---D | M] -- D:\SUPPORT
[2011/05/20 07:59:45 | 000,000,000 | -HSD | M] -- D:\System Volume Information
[2004/08/10 05:13:12 | 000,000,000 | ---D | M] -- D:\VALUEADD
[2013/01/13 07:28:26 | 000,000,000 | ---D | M] -- D:\WINDOWS
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2004/08/03 22:00:00 | 018,782,319 | ---- | M] () .cab file -- D:\I386\sp2.cab:AGP440.sys
[2004/08/03 22:00:00 | 018,782,319 | ---- | M] () .cab file -- D:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/04/14 02:03:54 | 020,108,202 | ---- | M] () .cab file -- D:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/04/14 02:03:54 | 020,108,202 | ---- | M] () .cab file -- D:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 18:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- D:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- D:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\agp440.sys
[2008/04/13 18:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- D:\WINDOWS\system32\drivers\agp440.sys
[2004/08/03 16:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- D:\WINDOWS\$NtServicePackUninstall$\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004/08/03 22:00:00 | 018,782,319 | ---- | M] () .cab file -- D:\I386\sp2.cab:atapi.sys
[2004/08/03 22:00:00 | 018,782,319 | ---- | M] () .cab file -- D:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/04/14 02:03:54 | 020,108,202 | ---- | M] () .cab file -- D:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 02:03:54 | 020,108,202 | ---- | M] () .cab file -- D:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 18:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- D:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- D:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\atapi.sys
[2008/04/13 18:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- D:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 15:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- D:\WINDOWS\$NtServicePackUninstall$\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008/04/14 01:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- D:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 21:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- D:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\eventlog.dll
[2008/04/14 01:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- D:\WINDOWS\system32\eventlog.dll
[2004/08/03 22:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- D:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2004/08/03 22:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- D:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2007/06/13 08:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- D:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2008/04/14 01:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- D:\WINDOWS\explorer.exe
[2008/04/14 01:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- D:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2008/04/13 21:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- D:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\explorer.exe
[2007/06/13 08:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- D:\WINDOWS\$NtServicePackUninstall$\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2009/08/06 23:17:26 | 000,330,264 | ---- | M] (Intel Corporation) MD5=01446278D4563B3013C92830AE6CBB26 -- D:\Programme\Lenovo\System Update\session\6iim10ww\IaStor.sys
[2009/08/06 23:17:26 | 000,330,264 | ---- | M] (Intel Corporation) MD5=01446278D4563B3013C92830AE6CBB26 -- D:\WINDOWS\system32\drivers\iaStor.sys
[2005/10/12 05:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- D:\DRIVERS\OTHER\IASTOR.SYS
[2005/10/12 05:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- D:\IBMTOOLS\DRIVERS\IMSM\IASTOR.SYS
[2005/10/12 05:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- D:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\iaStor.sys
 
< MD5 for: NETLOGON.DLL  >
[2008/04/14 01:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- D:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 21:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- D:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\netlogon.dll
[2008/04/14 01:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- D:\WINDOWS\system32\netlogon.dll
[2004/08/03 22:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- D:\WINDOWS\$NtUninstallKB968389_0$\netlogon.dll
[2009/02/06 13:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- D:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008/04/14 01:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- D:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 21:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- D:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\scecli.dll
[2008/04/14 01:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- D:\WINDOWS\system32\scecli.dll
[2004/08/03 22:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- D:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2005/03/02 13:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- D:\WINDOWS\$NtUninstallKB925902$\user32.dll
[2007/03/08 10:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- D:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2005/03/02 13:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- D:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2007/03/08 10:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- D:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008/04/14 01:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- D:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008/04/13 21:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- D:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\user32.dll
[2008/04/14 01:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- D:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008/04/14 01:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- D:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 21:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- D:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\userinit.exe
[2008/04/14 01:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- D:\WINDOWS\system32\userinit.exe
[2004/08/03 22:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- D:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2005/04/01 13:33:14 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=B0B3908F5432F9DBBCD83CA4C33F0D82 -- D:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/14 01:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- D:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 21:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- D:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\winlogon.exe
[2008/04/14 01:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- D:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004/08/03 22:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- D:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2004/08/10 06:16:54 | 000,094,208 | ---- | M] () -- D:\WINDOWS\System32\config\default.sav
[2004/08/10 06:16:54 | 000,663,552 | ---- | M] () -- D:\WINDOWS\System32\config\software.sav
[2004/08/10 06:16:54 | 000,417,792 | ---- | M] () -- D:\WINDOWS\System32\config\system.sav
 
< %systemroot%\system32\*.dll /lockedfiles >
[2012/06/08 09:25:14 | 008,503,808 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- D:\WINDOWS\system32\shell32.dll
[50 D:\WINDOWS\system32\*.tmp files -> D:\WINDOWS\system32\*.tmp -> ]
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 688 bytes -> D:\WINDOWS\System32\drivers\bnyxxgis.sys:changelist
@Alternate Data Stream - 123 bytes -> D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
< End of report >
         

--- --- ---

hi
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

:OTL
O4 - Startup: D:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\runctf.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)
[2013/01/13 07:29:46 | 000,003,176 | ---- | M] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\0tbpw.js
[2013/01/10 16:30:06 | 000,003,176 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\0tbpw.js
:Files
:Commands
[EMPTYFLASH] 
[emptytemp]
         

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

Hallo!

Diesmal gab es leider Probleme.

Bis "run fix" alle Schritte wie gefordert ausgeführt.

Nach Abschluss des Vorgangs, kam dann die Frage, ob ein Neustart gewünscht sei. Ich drückte "Yes". Dann hängte sich das System auf. Ich nahm daraufhin die Boot-CD aus dem Laufwerk, machte den PC per Schalter aus und startete ihn neu.

Der Computer fuhr dann hoch. Beim Starten von Windows kam die Meldung, dass die Datei "D:\OTLPE.exe" nicht gefunden werden konnte. Dann öffnete sich der Windows-Startbildschirm wie gewohnt. Die Datei "otl.txt" öffnete sich nicht. Dafür auch kein GVU/BSI-Sperrbildschirm im Vordergrund!

Wie soll ich nun weiter verfahren?

Besten Dank & Gruß

Frage, der Neustart lief aber, also du kannst unter windows wieder ins Netz?
wenn ja:
download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten
c: öffnen, tdsskiller-datum-version.txt öffnen, Inhal posten

Ok, Danke!


21:37:22.0234 3484 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
21:37:22.0625 3484 ============================================================
21:37:22.0625 3484 Current date / time: 2013/01/16 21:37:22.0625
21:37:22.0625 3484 SystemInfo:
21:37:22.0625 3484
21:37:22.0625 3484 OS Version: 5.1.2600 ServicePack: 3.0
21:37:22.0625 3484 Product type: Workstation
21:37:22.0625 3484 ComputerName: LENOVO-2AC64B94
21:37:22.0625 3484 UserName: ***
21:37:22.0625 3484 Windows directory: C:\WINDOWS
21:37:22.0625 3484 System windows directory: C:\WINDOWS
21:37:22.0625 3484 Processor architecture: Intel x86
21:37:22.0625 3484 Number of processors: 2
21:37:22.0625 3484 Page size: 0x1000
21:37:22.0625 3484 Boot type: Normal boot
21:37:22.0625 3484 ============================================================
21:37:24.0250 3484 Drive \Device\Harddisk0\DR0 - Size: 0xDF8F90000 (55.89 Gb), SectorSize: 0x200, Cylinders: 0x1E48, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000050
21:37:24.0281 3484 ============================================================
21:37:24.0281 3484 \Device\Harddisk0\DR0:
21:37:24.0281 3484 MBR partitions:
21:37:24.0281 3484 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x664AD21
21:37:24.0281 3484 ============================================================
21:37:24.0312 3484 C: <-> \Device\Harddisk0\DR0\Partition1
21:37:24.0343 3484 ============================================================
21:37:24.0343 3484 Initialize success
21:37:24.0343 3484 ============================================================
21:38:17.0343 2344 ============================================================
21:38:17.0343 2344 Scan started
21:38:17.0343 2344 Mode: Manual; SigCheck; TDLFS;
21:38:17.0343 2344 ============================================================
21:38:17.0515 2344 ================ Scan system memory ========================
21:38:17.0531 2344 System memory - ok
21:38:17.0531 2344 ================ Scan services =============================
21:38:17.0671 2344 Abiosdsk - ok
21:38:17.0703 2344 [ 6ABB91494FE6C59089B9336452AB2EA3 ] abp480n5 C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
21:38:19.0734 2344 abp480n5 - ok
21:38:19.0796 2344 [ 0F2D66D5F08EBE2F77BB904288DCF6F0 ] ac97intc C:\WINDOWS\system32\drivers\ac97intc.sys
21:38:20.0015 2344 ac97intc - ok
21:38:20.0062 2344 [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
21:38:20.0281 2344 ACPI - ok
21:38:20.0296 2344 [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
21:38:20.0515 2344 ACPIEC - ok
21:38:20.0562 2344 [ BEEE84A79710F705864685B05F1BB172 ] ADIHdAudAddService C:\WINDOWS\system32\drivers\ADIHdAud.sys
21:38:20.0640 2344 ADIHdAudAddService - ok
21:38:20.0671 2344 [ 9A11864873DA202C996558B2106B0BBC ] adpu160m C:\WINDOWS\system32\DRIVERS\adpu160m.sys
21:38:20.0875 2344 adpu160m - ok
21:38:20.0921 2344 [ 358063AB6C1C4173B735525CDFA65F94 ] AEAudioService C:\WINDOWS\system32\drivers\AEAudio.sys
21:38:20.0968 2344 AEAudioService - ok
21:38:21.0015 2344 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
21:38:21.0234 2344 aec - ok
21:38:21.0296 2344 [ 2C5C22990156A1063E19AD162191DC1D ] AegisP C:\WINDOWS\system32\DRIVERS\AegisP.sys
21:38:21.0296 2344 AegisP ( UnsignedFile.Multi.Generic ) - warning
21:38:21.0296 2344 AegisP - detected UnsignedFile.Multi.Generic (1)
21:38:21.0343 2344 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
21:38:21.0468 2344 AFD - ok
21:38:21.0500 2344 [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440 C:\WINDOWS\system32\DRIVERS\agp440.sys
21:38:21.0734 2344 agp440 - ok
21:38:21.0765 2344 [ 03A7E0922ACFE1B07D5DB2EEB0773063 ] agpCPQ C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
21:38:21.0984 2344 agpCPQ - ok
21:38:22.0015 2344 [ C23EA9B5F46C7F7910DB3EAB648FF013 ] Aha154x C:\WINDOWS\system32\DRIVERS\aha154x.sys
21:38:22.0125 2344 Aha154x - ok
21:38:22.0140 2344 [ 19DD0FB48B0C18892F70E2E7D61A1529 ] aic78u2 C:\WINDOWS\system32\DRIVERS\aic78u2.sys
21:38:22.0359 2344 aic78u2 - ok
21:38:22.0406 2344 [ B7FE594A7468AA0132DEB03FB8E34326 ] aic78xx C:\WINDOWS\system32\DRIVERS\aic78xx.sys
21:38:22.0609 2344 aic78xx - ok
21:38:22.0656 2344 [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter C:\WINDOWS\system32\alrsvc.dll
21:38:22.0875 2344 Alerter - ok
21:38:22.0906 2344 [ 190CD73D4984F94D823F9444980513E5 ] ALG C:\WINDOWS\System32\alg.exe
21:38:23.0109 2344 ALG - ok
21:38:23.0140 2344 [ 1140AB9938809700B46BB88E46D72A96 ] AliIde C:\WINDOWS\system32\DRIVERS\aliide.sys
21:38:23.0359 2344 AliIde - ok
21:38:23.0390 2344 [ CB08AED0DE2DD889A8A820CD8082D83C ] alim1541 C:\WINDOWS\system32\DRIVERS\alim1541.sys
21:38:23.0609 2344 alim1541 - ok
21:38:23.0656 2344 [ 95B4FB835E28AA1336CEEB07FD5B9398 ] amdagp C:\WINDOWS\system32\DRIVERS\amdagp.sys
21:38:23.0859 2344 amdagp - ok
21:38:23.0890 2344 [ 79F5ADD8D24BD6893F2903A3E2F3FAD6 ] amsint C:\WINDOWS\system32\DRIVERS\amsint.sys
21:38:24.0031 2344 amsint - ok
21:38:24.0125 2344 [ D503DF3ABA595F551B98B9BAE017A271 ] Apple Mobile Device C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
21:38:24.0156 2344 Apple Mobile Device - ok
21:38:24.0218 2344 [ D45960BE52C3C610D361977057F98C54 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
21:38:24.0437 2344 AppMgmt - ok
21:38:24.0468 2344 [ 62D318E9A0C8FC9B780008E724283707 ] asc C:\WINDOWS\system32\DRIVERS\asc.sys
21:38:24.0703 2344 asc - ok
21:38:24.0734 2344 [ 69EB0CC7714B32896CCBFD5EDCBEA447 ] asc3350p C:\WINDOWS\system32\DRIVERS\asc3350p.sys
21:38:24.0859 2344 asc3350p - ok
21:38:24.0890 2344 [ 5D8DE112AA0254B907861E9E9C31D597 ] asc3550 C:\WINDOWS\system32\DRIVERS\asc3550.sys
21:38:25.0109 2344 asc3550 - ok
21:38:25.0265 2344 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
21:38:25.0296 2344 aspnet_state - ok
21:38:25.0343 2344 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
21:38:25.0546 2344 AsyncMac - ok
21:38:25.0578 2344 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
21:38:25.0781 2344 atapi - ok
21:38:25.0796 2344 Atdisk - ok
21:38:25.0812 2344 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
21:38:26.0031 2344 Atmarpc - ok
21:38:26.0093 2344 [ DBF0D7E2DF33B469EB55406FEA759350 ] atmeltpm C:\WINDOWS\system32\DRIVERS\atmeltpm.sys
21:38:26.0156 2344 atmeltpm - ok
21:38:26.0203 2344 [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
21:38:26.0421 2344 AudioSrv - ok
21:38:26.0453 2344 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
21:38:26.0656 2344 audstub - ok
21:38:26.0671 2344 BCM43XX - ok
21:38:26.0718 2344 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
21:38:26.0937 2344 Beep - ok
21:38:27.0015 2344 [ D6F603772A789BB3228F310D650B8BD1 ] BITS C:\WINDOWS\system32\qmgr.dll
21:38:27.0265 2344 BITS - ok
21:38:27.0359 2344 [ EBAD0F51D8D4DADE7660B1851ADDBD07 ] Bonjour Service C:\Programme\Bonjour\mDNSResponder.exe
21:38:27.0406 2344 Bonjour Service - ok
21:38:27.0453 2344 [ B71549F23736ADF83A571061C47777FD ] Browser C:\WINDOWS\System32\browser.dll
21:38:27.0562 2344 Browser - ok
21:38:27.0671 2344 [ 7512C4F3F408DD9804500E275517A758 ] BTKRNL C:\WINDOWS\system32\DRIVERS\btkrnl.sys
21:38:27.0781 2344 BTKRNL ( UnsignedFile.Multi.Generic ) - warning
21:38:27.0781 2344 BTKRNL - detected UnsignedFile.Multi.Generic (1)
21:38:27.0875 2344 [ 0AB7A2E4EC1A207F1CAA1507552AED9B ] btwdins C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe
21:38:27.0906 2344 btwdins ( UnsignedFile.Multi.Generic ) - warning
21:38:27.0906 2344 btwdins - detected UnsignedFile.Multi.Generic (1)
21:38:27.0937 2344 [ EB68B380DA558BA4F5D54519EC734DC9 ] BTWUSB C:\WINDOWS\system32\Drivers\btwusb.sys
21:38:28.0000 2344 BTWUSB ( UnsignedFile.Multi.Generic ) - warning
21:38:28.0000 2344 BTWUSB - detected UnsignedFile.Multi.Generic (1)
21:38:28.0078 2344 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
21:38:28.0281 2344 cbidf - ok
21:38:28.0281 2344 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
21:38:28.0500 2344 cbidf2k - ok
21:38:28.0546 2344 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
21:38:28.0765 2344 CCDECODE - ok
21:38:28.0781 2344 [ F3EC03299634490E97BBCE94CD2954C7 ] cd20xrnt C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
21:38:28.0921 2344 cd20xrnt - ok
21:38:28.0953 2344 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
21:38:29.0171 2344 Cdaudio - ok
21:38:29.0218 2344 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
21:38:29.0437 2344 Cdfs - ok
21:38:29.0453 2344 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
21:38:29.0656 2344 Cdrom - ok
21:38:29.0671 2344 Changer - ok
21:38:29.0703 2344 [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc C:\WINDOWS\system32\cisvc.exe
21:38:29.0921 2344 CiSvc - ok
21:38:29.0953 2344 [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
21:38:30.0171 2344 ClipSrv - ok
21:38:30.0234 2344 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:38:30.0265 2344 clr_optimization_v2.0.50727_32 - ok
21:38:30.0328 2344 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:38:30.0375 2344 clr_optimization_v4.0.30319_32 - ok
21:38:30.0406 2344 [ 0F6C187D38D98F8DF904589A5F94D411 ] CmBatt C:\WINDOWS\system32\DRIVERS\CmBatt.sys
21:38:30.0609 2344 CmBatt - ok
21:38:30.0671 2344 [ C687F81290303D90099B027A6474F99F ] CmdIde C:\WINDOWS\system32\DRIVERS\cmdide.sys
21:38:30.0890 2344 CmdIde - ok
21:38:30.0906 2344 [ 6E4C9F21F0FAE8940661144F41B13203 ] Compbatt C:\WINDOWS\system32\DRIVERS\compbatt.sys
21:38:31.0125 2344 Compbatt - ok
21:38:31.0140 2344 COMSysApp - ok
21:38:31.0171 2344 [ 3EE529119EED34CD212A215E8C40D4B6 ] Cpqarray C:\WINDOWS\system32\DRIVERS\cpqarray.sys
21:38:31.0390 2344 Cpqarray - ok
21:38:31.0437 2344 [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
21:38:31.0671 2344 CryptSvc - ok
21:38:31.0718 2344 [ B5ECADF7708960F1818C7FA015F4C239 ] CVirtA C:\WINDOWS\system32\DRIVERS\CVirtA.sys
21:38:31.0812 2344 CVirtA - ok
21:38:31.0953 2344 [ 66257CB4E4FB69887CDDC71663741435 ] CVPND C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
21:38:32.0187 2344 CVPND - ok
21:38:32.0250 2344 [ 18994842386FD3039279D7865740ABBD ] CVPNDRVA C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
21:38:32.0281 2344 CVPNDRVA ( UnsignedFile.Multi.Generic ) - warning
21:38:32.0281 2344 CVPNDRVA - detected UnsignedFile.Multi.Generic (1)
21:38:32.0328 2344 [ E550E7418984B65A78299D248F0A7F36 ] dac2w2k C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
21:38:32.0546 2344 dac2w2k - ok
21:38:32.0578 2344 [ 683789CAA3864EB46125AE86FF677D34 ] dac960nt C:\WINDOWS\system32\DRIVERS\dac960nt.sys
21:38:32.0796 2344 dac960nt - ok
21:38:32.0859 2344 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
21:38:33.0031 2344 DcomLaunch - ok
21:38:33.0078 2344 [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
21:38:33.0296 2344 Dhcp - ok
21:38:33.0328 2344 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
21:38:33.0531 2344 Disk - ok
21:38:33.0546 2344 dmadmin - ok
21:38:33.0609 2344 [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
21:38:33.0890 2344 dmboot - ok
21:38:33.0937 2344 [ 53720AB12B48719D00E327DA470A619A ] dmio C:\WINDOWS\system32\drivers\dmio.sys
21:38:34.0156 2344 dmio - ok
21:38:34.0218 2344 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
21:38:34.0437 2344 dmload - ok
21:38:34.0500 2344 [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver C:\WINDOWS\System32\dmserver.dll
21:38:34.0718 2344 dmserver - ok
21:38:34.0765 2344 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
21:38:34.0984 2344 DMusic - ok
21:38:35.0046 2344 [ B5AA5AA5AC327BD7C1AEC0C58F0C1144 ] DNE C:\WINDOWS\system32\DRIVERS\dne2000.sys
21:38:35.0125 2344 DNE - ok
21:38:35.0171 2344 [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
21:38:35.0296 2344 Dnscache - ok
21:38:35.0328 2344 [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
21:38:35.0546 2344 Dot3svc - ok
21:38:35.0609 2344 [ E00B3CE273B17AEE1259C105DF5524CA ] DozeHDD C:\WINDOWS\system32\DRIVERS\DozeHDD.sys
21:38:35.0671 2344 DozeHDD - ok
21:38:35.0703 2344 [ 003ACEE8650BFD49E4121289BBF59480 ] DozeSvc C:\Programme\ThinkPad\Utilities\DOZESVC.EXE
21:38:35.0734 2344 DozeSvc - ok
21:38:35.0765 2344 [ 40F3B93B4E5B0126F2F5C0A7A5E22660 ] dpti2o C:\WINDOWS\system32\DRIVERS\dpti2o.sys
21:38:35.0984 2344 dpti2o - ok
21:38:36.0031 2344 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
21:38:36.0250 2344 drmkaud - ok
21:38:36.0296 2344 [ A6DE5342417FEC3C0AA8EFEBB899C431 ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys
21:38:36.0515 2344 E100B - ok
21:38:36.0578 2344 [ B1E9161BA28D5B826E49A1D0DED7FCC4 ] e1express C:\WINDOWS\system32\DRIVERS\e1e5132.sys
21:38:36.0625 2344 e1express - ok
21:38:36.0656 2344 [ C4E93A2E20C678853C61184D93768742 ] Eacfilt C:\WINDOWS\system32\DRIVERS\eacfilt.sys
21:38:36.0718 2344 Eacfilt ( UnsignedFile.Multi.Generic ) - warning
21:38:36.0718 2344 Eacfilt - detected UnsignedFile.Multi.Generic (1)
21:38:36.0781 2344 [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost C:\WINDOWS\System32\eapsvc.dll
21:38:36.0984 2344 EapHost - ok
21:38:37.0031 2344 [ 877C18558D70587AA7823A1A308AC96B ] ERSvc C:\WINDOWS\System32\ersvc.dll
21:38:37.0250 2344 ERSvc - ok
21:38:37.0312 2344 [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog C:\WINDOWS\system32\services.exe
21:38:37.0406 2344 Eventlog - ok
21:38:37.0453 2344 [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem C:\WINDOWS\system32\es.dll
21:38:37.0531 2344 EventSystem - ok
21:38:37.0593 2344 [ 56DED3ADE453272E6A0AD582D945D1A4 ] EvtEng C:\Programme\Intel\Wireless\Bin\EvtEng.exe
21:38:37.0625 2344 EvtEng ( UnsignedFile.Multi.Generic ) - warning
21:38:37.0625 2344 EvtEng - detected UnsignedFile.Multi.Generic (1)
21:38:37.0656 2344 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
21:38:37.0859 2344 Fastfat - ok
21:38:37.0906 2344 [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
21:38:37.0968 2344 FastUserSwitchingCompatibility - ok
21:38:38.0015 2344 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
21:38:38.0218 2344 Fdc - ok
21:38:38.0265 2344 [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
21:38:38.0468 2344 Fips - ok
21:38:38.0500 2344 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
21:38:38.0718 2344 Flpydisk - ok
21:38:38.0765 2344 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
21:38:38.0984 2344 FltMgr - ok
21:38:39.0062 2344 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
21:38:39.0093 2344 FontCache3.0.0.0 - ok
21:38:39.0109 2344 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
21:38:39.0328 2344 Fs_Rec - ok
21:38:39.0375 2344 [ 8F1955CE42E1484714B542F341647778 ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
21:38:39.0593 2344 Ftdisk - ok
21:38:39.0640 2344 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
21:38:39.0671 2344 GEARAspiWDM - ok
21:38:39.0671 2344 gfhbpvru - ok
21:38:39.0687 2344 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
21:38:39.0890 2344 Gpc - ok
21:38:39.0984 2344 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Programme\Google\Update\GoogleUpdate.exe
21:38:40.0015 2344 gupdate - ok
21:38:40.0015 2344 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Programme\Google\Update\GoogleUpdate.exe
21:38:40.0046 2344 gupdatem - ok
21:38:40.0109 2344 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
21:38:40.0140 2344 gusvc - ok
21:38:40.0187 2344 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
21:38:40.0421 2344 HDAudBus - ok
21:38:40.0515 2344 [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
21:38:40.0718 2344 helpsvc - ok
21:38:40.0781 2344 [ B35DA85E60C0103F2E4104532DA2F12B ] HidServ C:\WINDOWS\System32\hidserv.dll
21:38:41.0000 2344 HidServ - ok
21:38:41.0031 2344 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
21:38:41.0250 2344 HidUsb - ok
21:38:41.0312 2344 [ ED29F14101523A6E0E808107405D452C ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
21:38:41.0515 2344 hkmsvc - ok
21:38:41.0546 2344 [ B028377DEA0546A5FCFBA928A8AEFAE0 ] hpn C:\WINDOWS\system32\DRIVERS\hpn.sys
21:38:41.0750 2344 hpn - ok
21:38:41.0796 2344 [ 9F1D80908658EB7F1BF70809E0B51470 ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys
21:38:41.0890 2344 HPZid412 - ok
21:38:41.0921 2344 [ F7E3E9D50F9CD3DE28085A8FDAA0A1C3 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
21:38:41.0984 2344 HPZipr12 - ok
21:38:42.0031 2344 [ CF1B7951B4EC8D13F3C93B74BB2B461B ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys
21:38:42.0125 2344 HPZius12 - ok
21:38:42.0171 2344 [ 0AAEF566E6782957252FA79F566FBC0B ] HSFHWAZL C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
21:38:42.0312 2344 HSFHWAZL - ok
21:38:42.0390 2344 [ E472E0CB4E716CC34C0E045F2C196221 ] HSF_DPV C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
21:38:42.0531 2344 HSF_DPV - ok
21:38:42.0578 2344 [ 3AF45F5B4157C88FFAE24D89BA408302 ] HSXHWAZL C:\WINDOWS\system32\DRIVERS\hsxhwazl.sys
21:38:42.0625 2344 HSXHWAZL - ok
21:38:42.0687 2344 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
21:38:42.0781 2344 HTTP - ok
21:38:42.0812 2344 [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
21:38:43.0031 2344 HTTPFilter - ok
21:38:43.0078 2344 [ 9368670BD426EBEA5E8B18A62416EC28 ] i2omgmt C:\WINDOWS\system32\drivers\i2omgmt.sys
21:38:43.0296 2344 i2omgmt - ok
21:38:43.0328 2344 [ F10863BF1CCC290BABD1A09188AE49E0 ] i2omp C:\WINDOWS\system32\DRIVERS\i2omp.sys
21:38:43.0546 2344 i2omp - ok
21:38:43.0609 2344 [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
21:38:43.0828 2344 i8042prt - ok
21:38:44.0140 2344 [ 06B71441957B48A4866DE2FE27CB79C8 ] ialm C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
21:38:44.0812 2344 ialm - ok
21:38:44.0875 2344 [ 01446278D4563B3013C92830AE6CBB26 ] iaStor C:\WINDOWS\system32\DRIVERS\iaStor.sys
21:38:44.0921 2344 iaStor - ok
21:38:44.0968 2344 [ 400D7095D5AE08970F839BCAC1843106 ] IBMPMDRV C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys
21:38:45.0000 2344 IBMPMDRV - ok
21:38:45.0015 2344 [ 06AF18300C5B511A3D85C3E0B7909C10 ] IBMPMSVC C:\WINDOWS\system32\ibmpmsvc.exe
21:38:45.0046 2344 IBMPMSVC - ok
21:38:45.0140 2344 [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
21:38:45.0171 2344 IDriverT ( UnsignedFile.Multi.Generic ) - warning
21:38:45.0171 2344 IDriverT - detected UnsignedFile.Multi.Generic (1)
21:38:45.0265 2344 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
21:38:45.0421 2344 idsvc - ok
21:38:45.0453 2344 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
21:38:45.0671 2344 Imapi - ok
21:38:45.0734 2344 [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService C:\WINDOWS\system32\imapi.exe
21:38:45.0953 2344 ImapiService - ok
21:38:46.0000 2344 [ 4A40E045FAEE58631FD8D91AFC620719 ] ini910u C:\WINDOWS\system32\DRIVERS\ini910u.sys
21:38:46.0218 2344 ini910u - ok
21:38:46.0250 2344 [ 69C4E3C9E67A1F103B94E14FDD5F3213 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys
21:38:46.0468 2344 IntelIde - ok
21:38:46.0500 2344 [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
21:38:46.0718 2344 intelppm - ok
21:38:46.0765 2344 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
21:38:46.0984 2344 Ip6Fw - ok
21:38:47.0015 2344 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
21:38:47.0218 2344 IpFilterDriver - ok
21:38:47.0250 2344 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
21:38:47.0453 2344 IpInIp - ok
21:38:47.0500 2344 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
21:38:47.0718 2344 IpNat - ok
21:38:47.0781 2344 [ 3C30491045DBBD44A42876B3D6F3917D ] iPod Service C:\Programme\iPod\bin\iPodService.exe
21:38:47.0859 2344 iPod Service - ok
21:38:47.0921 2344 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
21:38:48.0156 2344 IPSec - ok
21:38:48.0203 2344 [ 4904D7E701CAA114BA65D1E08318ADF0 ] IPSECEXT C:\WINDOWS\system32\DRIVERS\ipsecw2k.sys
21:38:48.0328 2344 IPSECEXT ( UnsignedFile.Multi.Generic ) - warning
21:38:48.0328 2344 IPSECEXT - detected UnsignedFile.Multi.Generic (1)
21:38:48.0343 2344 [ 4904D7E701CAA114BA65D1E08318ADF0 ] IPSECSHM C:\WINDOWS\system32\DRIVERS\ipsecw2k.sys
21:38:48.0359 2344 IPSECSHM ( UnsignedFile.Multi.Generic ) - warning
21:38:48.0359 2344 IPSECSHM - detected UnsignedFile.Multi.Generic (1)
21:38:48.0390 2344 [ ACA5E7B54409F9CB5EED97ED0C81120E ] irda C:\WINDOWS\system32\DRIVERS\irda.sys
21:38:48.0609 2344 irda - ok
21:38:48.0656 2344 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
21:38:48.0875 2344 IRENUM - ok
21:38:48.0937 2344 [ 2EFE1DB1EC58A26B0C14BFDA122E246F ] Irmon C:\WINDOWS\System32\irmon.dll
21:38:49.0156 2344 Irmon - ok
21:38:49.0203 2344 [ 6DFB88F64135C525433E87648BDA30DE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
21:38:49.0406 2344 isapnp - ok
21:38:49.0546 2344 [ 5E06A9D23727DAF96FAA796F1135FDCD ] JavaQuickStarterService C:\Programme\Java\jre6\bin\jqs.exe
21:38:49.0593 2344 JavaQuickStarterService - ok
21:38:49.0593 2344 [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
21:38:49.0812 2344 Kbdclass - ok
21:38:49.0859 2344 [ B6D6C117D771C98130497265F26D1882 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
21:38:50.0078 2344 kbdhid - ok
21:38:50.0125 2344 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
21:38:50.0343 2344 kmixer - ok
21:38:50.0390 2344 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
21:38:50.0484 2344 KSecDD - ok
21:38:50.0531 2344 [ 2BBDCB79900990F0716DFCB714E72DE7 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
21:38:50.0640 2344 lanmanserver - ok
21:38:50.0687 2344 [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
21:38:50.0765 2344 lanmanworkstation - ok
21:38:50.0781 2344 lbrtfdc - ok
21:38:50.0937 2344 [ E9953EEED1653D1CB9EC5C54FF8057DB ] LENOVO.MICMUTE C:\Programme\LENOVO\HOTKEY\MICMUTE.exe
21:38:50.0968 2344 LENOVO.MICMUTE - ok
21:38:51.0015 2344 [ 3C3F7F424E324C6971632C5DE5FF458F ] lenovo.smi C:\WINDOWS\system32\DRIVERS\smiif32.sys
21:38:51.0046 2344 lenovo.smi - ok
21:38:51.0093 2344 [ 636714B7D43C8D0C80449123FD266920 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
21:38:51.0312 2344 LmHosts - ok
21:38:51.0406 2344 [ 11F714F85530A2BD134074DC30E99FCA ] MDM C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
21:38:51.0437 2344 MDM - ok
21:38:51.0484 2344 [ 0CEA2D0D3FA284B85ED5B68365114F76 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
21:38:51.0546 2344 mdmxsdk - ok
21:38:51.0578 2344 [ B7550A7107281D170CE85524B1488C98 ] Messenger C:\WINDOWS\System32\msgsvc.dll
21:38:51.0796 2344 Messenger - ok
21:38:51.0859 2344 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
21:38:52.0078 2344 mnmdd - ok
21:38:52.0140 2344 [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
21:38:52.0343 2344 mnmsrvc - ok
21:38:52.0406 2344 [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
21:38:52.0609 2344 Modem - ok
21:38:52.0671 2344 [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
21:38:52.0890 2344 Mouclass - ok
21:38:52.0937 2344 [ 66A6F73C74E1791464160A7065CE711A ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
21:38:53.0156 2344 mouhid - ok
21:38:53.0187 2344 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
21:38:53.0390 2344 MountMgr - ok
21:38:53.0453 2344 [ EE728AF83850DDAD9A3FCAC0AAB3AD97 ] MpFilter C:\WINDOWS\system32\DRIVERS\MpFilter.sys
21:38:53.0500 2344 MpFilter - ok
21:38:53.0640 2344 [ A69630D039C38018689190234F866D77 ] MpKsldca852c0 c:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{31AEC6A1-DB09-4D4E-8E36-4A5D560D62EB}\MpKsldca852c0.sys
21:38:53.0671 2344 MpKsldca852c0 - ok
21:38:53.0703 2344 [ 3F4BB95E5A44F3BE34824E8E7CAF0737 ] mraid35x C:\WINDOWS\system32\DRIVERS\mraid35x.sys
21:38:53.0906 2344 mraid35x - ok
21:38:53.0921 2344 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
21:38:54.0125 2344 MRxDAV - ok
21:38:54.0187 2344 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
21:38:54.0343 2344 MRxSmb - ok
21:38:54.0375 2344 [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC C:\WINDOWS\system32\msdtc.exe
21:38:54.0593 2344 MSDTC - ok
21:38:54.0640 2344 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
21:38:54.0859 2344 Msfs - ok
21:38:54.0859 2344 MSIServer - ok
21:38:54.0890 2344 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
21:38:55.0109 2344 MSKSSRV - ok
21:38:55.0187 2344 [ E077FCA2A7E79FB9BF67D3E30B5CE593 ] MsMpSvc c:\Programme\Microsoft Security Client\MsMpEng.exe
21:38:55.0218 2344 MsMpSvc - ok
21:38:55.0234 2344 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
21:38:55.0421 2344 MSPCLOCK - ok
21:38:55.0468 2344 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
21:38:55.0671 2344 MSPQM - ok
21:38:55.0718 2344 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
21:38:55.0921 2344 mssmbios - ok
21:38:55.0953 2344 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
21:38:56.0171 2344 MSTEE - ok
21:38:56.0218 2344 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
21:38:56.0312 2344 Mup - ok
21:38:56.0343 2344 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
21:38:56.0562 2344 NABTSFEC - ok
21:38:56.0625 2344 [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent C:\WINDOWS\System32\qagentrt.dll
21:38:56.0843 2344 napagent - ok
21:38:56.0890 2344 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
21:38:57.0109 2344 NDIS - ok
21:38:57.0156 2344 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
21:38:57.0359 2344 NdisIP - ok
21:38:57.0421 2344 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
21:38:57.0515 2344 NdisTapi - ok
21:38:57.0531 2344 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
21:38:57.0734 2344 Ndisuio - ok
21:38:57.0781 2344 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
21:38:57.0984 2344 NdisWan - ok
21:38:58.0015 2344 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
21:38:58.0062 2344 NDProxy - ok
21:38:58.0078 2344 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
21:38:58.0296 2344 NetBIOS - ok
21:38:58.0343 2344 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
21:38:58.0578 2344 NetBT - ok
21:38:58.0609 2344 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE C:\WINDOWS\system32\netdde.exe
21:38:58.0828 2344 NetDDE - ok
21:38:58.0843 2344 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
21:38:59.0046 2344 NetDDEdsdm - ok
21:38:59.0062 2344 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon C:\WINDOWS\system32\lsass.exe
21:38:59.0265 2344 Netlogon - ok
21:38:59.0312 2344 [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman C:\WINDOWS\System32\netman.dll
21:38:59.0531 2344 Netman - ok
21:38:59.0578 2344 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
21:38:59.0625 2344 NetTcpPortSharing - ok
21:38:59.0671 2344 [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla C:\WINDOWS\System32\mswsock.dll
21:38:59.0734 2344 Nla - ok
21:38:59.0796 2344 [ 1E421A6BCF2203CC61B821ADA9DE878B ] nm C:\WINDOWS\system32\DRIVERS\NMnt.sys
21:39:00.0015 2344 nm - ok
21:39:00.0062 2344 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
21:39:00.0250 2344 Npfs - ok
21:39:00.0281 2344 [ 2ADC0CA9945C65284B3D19BC18765974 ] NSCIRDA C:\WINDOWS\system32\DRIVERS\nscirda.sys
21:39:00.0500 2344 NSCIRDA - ok
21:39:00.0546 2344 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
21:39:00.0828 2344 Ntfs - ok
21:39:00.0859 2344 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
21:39:01.0062 2344 NtLmSsp - ok
21:39:01.0125 2344 [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
21:39:01.0375 2344 NtmsSvc - ok
21:39:01.0406 2344 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
21:39:01.0640 2344 Null - ok
21:39:01.0750 2344 [ 2B298519EDBFCF451D43E0F1E8F1006D ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
21:39:02.0125 2344 nv - ok
21:39:02.0187 2344 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
21:39:02.0406 2344 NwlnkFlt - ok
21:39:02.0437 2344 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
21:39:02.0656 2344 NwlnkFwd - ok
21:39:02.0703 2344 [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
21:39:02.0734 2344 ose - ok
21:39:02.0812 2344 [ AFF9A1986555E4592DE8092F9A5FA2D2 ] PAC7302 C:\WINDOWS\system32\DRIVERS\PAC7302.SYS
21:39:02.0937 2344 PAC7302 - ok
21:39:02.0968 2344 [ F84785660305B9B903FB3BCA8BA29837 ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
21:39:03.0187 2344 Parport - ok
21:39:03.0218 2344 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
21:39:03.0437 2344 PartMgr - ok
21:39:03.0468 2344 [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
21:39:03.0687 2344 ParVdm - ok
21:39:03.0718 2344 [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
21:39:03.0953 2344 PCI - ok
21:39:03.0953 2344 PCIDump - ok
21:39:03.0984 2344 [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
21:39:04.0218 2344 PCIIde - ok
21:39:04.0250 2344 [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia C:\WINDOWS\system32\DRIVERS\pcmcia.sys
21:39:04.0484 2344 Pcmcia - ok
21:39:04.0484 2344 PDCOMP - ok
21:39:04.0500 2344 PDFRAME - ok
21:39:04.0500 2344 PDRELI - ok
21:39:04.0515 2344 PDRFRAME - ok
21:39:04.0562 2344 [ 6C14B9C19BA84F73D3A86DBA11133101 ] perc2 C:\WINDOWS\system32\DRIVERS\perc2.sys
21:39:04.0765 2344 perc2 - ok
21:39:04.0781 2344 [ F50F7C27F131AFE7BEBA13E14A3B9416 ] perc2hib C:\WINDOWS\system32\DRIVERS\perc2hib.sys
21:39:05.0000 2344 perc2hib - ok
21:39:05.0062 2344 [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay C:\WINDOWS\system32\services.exe
21:39:05.0156 2344 PlugPlay - ok
21:39:05.0203 2344 [ FA292805788528C083F416E151B60AB6 ] pmem C:\WINDOWS\System32\drivers\pmemnt.sys
21:39:05.0203 2344 pmem ( UnsignedFile.Multi.Generic ) - warning
21:39:05.0203 2344 pmem - detected UnsignedFile.Multi.Generic (1)
21:39:05.0250 2344 [ 9D84376931440F3679BEEF2A414FA493 ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe
21:39:05.0250 2344 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
21:39:05.0250 2344 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
21:39:05.0265 2344 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
21:39:05.0468 2344 PolicyAgent - ok
21:39:05.0531 2344 [ 5EE573B5AB364E8A5B5AEAF5EDFB68D9 ] Power Manager DBC Service C:\Programme\ThinkPad\Utilities\PWMDBSVC.exe
21:39:05.0531 2344 Power Manager DBC Service ( UnsignedFile.Multi.Generic ) - warning
21:39:05.0531 2344 Power Manager DBC Service - detected UnsignedFile.Multi.Generic (1)
21:39:05.0578 2344 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
21:39:05.0781 2344 PptpMiniport - ok
21:39:05.0781 2344 [ 2CB55427C58679F49AD600FCCBA76360 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys
21:39:06.0000 2344 Processor - ok
21:39:06.0000 2344 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
21:39:06.0203 2344 ProtectedStorage - ok
21:39:06.0265 2344 [ 651D3ABC1D82D61B6CFB40CB947B3DB3 ] psadd C:\WINDOWS\system32\DRIVERS\psadd.sys
21:39:06.0312 2344 psadd - ok
21:39:06.0343 2344 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
21:39:06.0562 2344 PSched - ok
21:39:06.0609 2344 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
21:39:06.0843 2344 Ptilink - ok
21:39:06.0859 2344 [ 0A63FB54039EB5662433CABA3B26DBA7 ] ql1080 C:\WINDOWS\system32\DRIVERS\ql1080.sys
21:39:07.0078 2344 ql1080 - ok
21:39:07.0109 2344 [ 6503449E1D43A0FF0201AD5CB1B8C706 ] Ql10wnt C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
21:39:07.0328 2344 Ql10wnt - ok
21:39:07.0359 2344 [ 156ED0EF20C15114CA097A34A30D8A01 ] ql12160 C:\WINDOWS\system32\DRIVERS\ql12160.sys
21:39:07.0578 2344 ql12160 - ok
21:39:07.0609 2344 [ 70F016BEBDE6D29E864C1230A07CC5E6 ] ql1240 C:\WINDOWS\system32\DRIVERS\ql1240.sys
21:39:07.0812 2344 ql1240 - ok
21:39:07.0812 2344 [ 907F0AEEA6BC451011611E732BD31FCF ] ql1280 C:\WINDOWS\system32\DRIVERS\ql1280.sys
21:39:08.0015 2344 ql1280 - ok
21:39:08.0015 2344 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
21:39:08.0234 2344 RasAcd - ok
21:39:08.0281 2344 [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto C:\WINDOWS\System32\rasauto.dll
21:39:08.0484 2344 RasAuto - ok
21:39:08.0562 2344 [ 0207D26DDF796A193CCD9F83047BB5FC ] Rasirda C:\WINDOWS\system32\DRIVERS\rasirda.sys
21:39:08.0671 2344 Rasirda - ok
21:39:08.0687 2344 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
21:39:08.0906 2344 Rasl2tp - ok
21:39:08.0968 2344 [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan C:\WINDOWS\System32\rasmans.dll
21:39:09.0187 2344 RasMan - ok
21:39:09.0218 2344 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
21:39:09.0406 2344 RasPppoe - ok
21:39:09.0437 2344 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
21:39:09.0656 2344 Raspti - ok
21:39:09.0703 2344 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
21:39:09.0937 2344 Rdbss - ok
21:39:09.0968 2344 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
21:39:10.0156 2344 RDPCDD - ok
21:39:10.0203 2344 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
21:39:10.0421 2344 rdpdr - ok
21:39:10.0468 2344 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
21:39:10.0593 2344 RDPWD - ok
21:39:10.0656 2344 [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
21:39:10.0875 2344 RDSessMgr - ok
21:39:10.0906 2344 [ ED761D453856F795A7FE056E42C36365 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
21:39:11.0125 2344 redbook - ok
21:39:11.0187 2344 [ 1B2857EF12D79A9F9ADBA14B0637CBF8 ] RegSrvc C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
21:39:11.0187 2344 RegSrvc ( UnsignedFile.Multi.Generic ) - warning
21:39:11.0187 2344 RegSrvc - detected UnsignedFile.Multi.Generic (1)
21:39:11.0234 2344 [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
21:39:11.0453 2344 RemoteAccess - ok
21:39:11.0500 2344 [ E4CD1F3D84E1C2CA0B8CF7501E201593 ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
21:39:11.0718 2344 RemoteRegistry - ok
21:39:11.0781 2344 [ F17713D108ACA124A139FDE877EEF68A ] RimUsb C:\WINDOWS\system32\Drivers\RimUsb.sys
21:39:11.0859 2344 RimUsb - ok
21:39:11.0890 2344 [ D9B34325EE5DF78B8F28A3DE9F577C7D ] RimVSerPort C:\WINDOWS\system32\DRIVERS\RimSerial.sys
21:39:11.0984 2344 RimVSerPort - ok
21:39:12.0015 2344 [ D8B0B4ADE32574B2D9C5CC34DC0DBBE7 ] ROOTMODEM C:\WINDOWS\system32\Drivers\RootMdm.sys
21:39:12.0234 2344 ROOTMODEM - ok
21:39:12.0281 2344 [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator C:\WINDOWS\system32\locator.exe
21:39:12.0515 2344 RpcLocator - ok
21:39:12.0562 2344 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs C:\WINDOWS\system32\rpcss.dll
21:39:12.0687 2344 RpcSs - ok
21:39:12.0734 2344 [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP C:\WINDOWS\system32\rsvp.exe
21:39:12.0968 2344 RSVP - ok
21:39:13.0046 2344 [ 6C5155CC0E805C7BE6028BFF7AC14524 ] S24EventMonitor C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
21:39:13.0109 2344 S24EventMonitor ( UnsignedFile.Multi.Generic ) - warning
21:39:13.0109 2344 S24EventMonitor - detected UnsignedFile.Multi.Generic (1)
21:39:13.0171 2344 [ 1CC074E0D48383D4E9BFFC6A26C2A58A ] s24trans C:\WINDOWS\system32\DRIVERS\s24trans.sys
21:39:13.0218 2344 s24trans ( UnsignedFile.Multi.Generic ) - warning
21:39:13.0218 2344 s24trans - detected UnsignedFile.Multi.Generic (1)
21:39:13.0250 2344 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs C:\WINDOWS\system32\lsass.exe
21:39:13.0453 2344 SamSs - ok
21:39:13.0500 2344 [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
21:39:13.0718 2344 SCardSvr - ok
21:39:13.0796 2344 [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule C:\WINDOWS\system32\schedsvc.dll
21:39:14.0015 2344 Schedule - ok
21:39:14.0062 2344 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
21:39:14.0265 2344 Secdrv - ok
21:39:14.0296 2344 [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon C:\WINDOWS\System32\seclogon.dll
21:39:14.0515 2344 seclogon - ok
21:39:14.0562 2344 [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS C:\WINDOWS\system32\sens.dll
21:39:14.0765 2344 SENS - ok
21:39:14.0828 2344 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
21:39:15.0031 2344 serenum - ok
21:39:15.0046 2344 [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
21:39:15.0265 2344 Serial - ok
21:39:15.0312 2344 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\DRIVERS\sfloppy.sys
21:39:15.0531 2344 Sfloppy - ok
21:39:15.0593 2344 [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
21:39:15.0796 2344 SharedAccess - ok
21:39:15.0828 2344 [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
21:39:15.0875 2344 ShellHWDetection - ok
21:39:15.0921 2344 [ 486A1BD22DD66D0A8542EBB0CD792BDB ] Shockprf C:\WINDOWS\system32\DRIVERS\Apsx86.sys
21:39:15.0968 2344 Shockprf - ok
21:39:15.0968 2344 Simbad - ok
21:39:16.0015 2344 [ 6B33D0EBD30DB32E27D1D78FE946A754 ] sisagp C:\WINDOWS\system32\DRIVERS\sisagp.sys
21:39:16.0218 2344 sisagp - ok
21:39:16.0250 2344 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
21:39:16.0468 2344 SLIP - ok
21:39:16.0515 2344 [ 26341D0DD225D19FD50E0EE3C3C77502 ] Smapint C:\WINDOWS\system32\drivers\Smapint.sys
21:39:16.0531 2344 Smapint ( UnsignedFile.Multi.Generic ) - warning
21:39:16.0546 2344 Smapint - detected UnsignedFile.Multi.Generic (1)
21:39:16.0625 2344 [ 0B9C01236D25BDCB37AA79DC59DFB7D3 ] smihlp C:\Programme\ThinkVantage Fingerprint Software\smihlp.sys
21:39:16.0640 2344 smihlp - ok
21:39:16.0687 2344 [ 83C0F71F86D3BDAF915685F3D568B20E ] Sparrow C:\WINDOWS\system32\DRIVERS\sparrow.sys
21:39:16.0828 2344 Sparrow - ok
21:39:16.0890 2344 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
21:39:17.0093 2344 splitter - ok
21:39:17.0156 2344 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
21:39:17.0234 2344 Spooler - ok
21:39:17.0250 2344 [ 50FA898F8C032796D3B1B9951BB5A90F ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
21:39:17.0468 2344 sr - ok
21:39:17.0578 2344 [ FE77A85495065F3AD59C5C65B6C54182 ] srservice C:\WINDOWS\system32\srsvc.dll
21:39:17.0796 2344 srservice - ok
21:39:17.0859 2344 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
21:39:17.0953 2344 Srv - ok
21:39:17.0968 2344 [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
21:39:18.0187 2344 SSDPSRV - ok
21:39:18.0250 2344 [ BC2C5985611C5356B24AEB370953DED9 ] stisvc C:\WINDOWS\system32\wiaservc.dll
21:39:18.0484 2344 stisvc - ok
21:39:18.0546 2344 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
21:39:18.0765 2344 streamip - ok
21:39:18.0859 2344 [ F1262146970C5B73159E3727ACDE8278 ] SUService c:\programme\lenovo\system update\suservice.exe
21:39:18.0921 2344 SUService ( UnsignedFile.Multi.Generic ) - warning
21:39:18.0921 2344 SUService - detected UnsignedFile.Multi.Generic (1)
21:39:18.0953 2344 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
21:39:19.0156 2344 swenum - ok
21:39:19.0187 2344 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
21:39:19.0406 2344 swmidi - ok
21:39:19.0406 2344 SwPrv - ok
21:39:19.0437 2344 [ 1FF3217614018630D0A6758630FC698C ] symc810 C:\WINDOWS\system32\DRIVERS\symc810.sys
21:39:19.0656 2344 symc810 - ok
21:39:19.0671 2344 [ 070E001D95CF725186EF8B20335F933C ] symc8xx C:\WINDOWS\system32\DRIVERS\symc8xx.sys
21:39:19.0890 2344 symc8xx - ok
21:39:19.0890 2344 SymIM - ok
21:39:19.0906 2344 SymIMMP - ok
21:39:19.0921 2344 [ 80AC1C4ABBE2DF3B738BF15517A51F2C ] sym_hi C:\WINDOWS\system32\DRIVERS\sym_hi.sys
21:39:20.0140 2344 sym_hi - ok
21:39:20.0171 2344 [ BF4FAB949A382A8E105F46EBB4937058 ] sym_u3 C:\WINDOWS\system32\DRIVERS\sym_u3.sys
21:39:20.0359 2344 sym_u3 - ok
21:39:20.0421 2344 [ D7DC30B8B41E7A913C3FCCC0631E72EC ] SynTP C:\WINDOWS\system32\DRIVERS\SynTP.sys
21:39:20.0453 2344 SynTP - ok
21:39:20.0484 2344 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
21:39:20.0671 2344 sysaudio - ok
21:39:20.0734 2344 [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
21:39:20.0953 2344 SysmonLog - ok
21:39:20.0984 2344 [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
21:39:21.0218 2344 TapiSrv - ok
21:39:21.0281 2344 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
21:39:21.0312 2344 Tcpip - ok
21:39:21.0375 2344 [ 64ABEA4001F8EB869385E65D85BC302B ] TcUsb C:\WINDOWS\system32\Drivers\tcusb.sys
21:39:21.0390 2344 TcUsb - ok
21:39:21.0437 2344 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
21:39:21.0640 2344 TDPIPE - ok
21:39:21.0687 2344 [ 564B337034271B7BDDCABFDDC91C6B7A ] TDSMAPI C:\WINDOWS\system32\drivers\TDSMAPI.SYS
21:39:21.0734 2344 TDSMAPI ( UnsignedFile.Multi.Generic ) - warning
21:39:21.0734 2344 TDSMAPI - detected UnsignedFile.Multi.Generic (1)
21:39:21.0765 2344 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
21:39:21.0984 2344 TDTCP - ok
21:39:22.0015 2344 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
21:39:22.0234 2344 TermDD - ok
21:39:22.0296 2344 [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService C:\WINDOWS\System32\termsrv.dll
21:39:22.0531 2344 TermService - ok
21:39:22.0578 2344 [ 2DB7D303C36DDD055215052F118E8E75 ] Themes C:\WINDOWS\System32\shsvcs.dll
21:39:22.0609 2344 Themes - ok
21:39:22.0718 2344 [ 9626746A9B120D2ED537DD8D76278405 ] ThinkVantage Registry Monitor Service C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe
21:39:22.0812 2344 ThinkVantage Registry Monitor Service - ok
21:39:22.0875 2344 [ 03681A1CE77F51586903869A5AB1DEAB ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
21:39:23.0109 2344 TlntSvr - ok
21:39:23.0140 2344 [ D213A9247DC347F305A2D4CC9B951487 ] TosIde C:\WINDOWS\system32\DRIVERS\toside.sys
21:39:23.0343 2344 TosIde - ok
21:39:23.0359 2344 [ 20A439D6475D6FE1909159C0143D0466 ] TPDIGIMN C:\WINDOWS\system32\DRIVERS\ApsHM86.sys
21:39:23.0390 2344 TPDIGIMN - ok
21:39:23.0437 2344 [ 3775E4AA5F72264DBAB7A578DD913ECF ] TPHDEXLGSVC C:\WINDOWS\system32\TPHDEXLG.exe
21:39:23.0468 2344 TPHDEXLGSVC - ok
21:39:23.0515 2344 [ 8AEF2188630F5ECD79AD9ABBA630630B ] TPHKDRV C:\WINDOWS\system32\DRIVERS\TPHKDRV.sys
21:39:23.0593 2344 TPHKDRV - ok
21:39:23.0656 2344 [ 88E1F5E9C121167D9E226CBE7FE5FB82 ] TPHKSVC C:\Programme\LENOVO\HOTKEY\TPHKSVC.exe
21:39:23.0671 2344 TPHKSVC - ok
21:39:23.0718 2344 [ DFB268FF0A6DCB9280015FF527F892FF ] TpKmpSVC C:\WINDOWS\system32\TpKmpSVC.exe
21:39:23.0750 2344 TpKmpSVC ( UnsignedFile.Multi.Generic ) - warning
21:39:23.0750 2344 TpKmpSVC - detected UnsignedFile.Multi.Generic (1)
21:39:23.0796 2344 [ 44672DE6CEA9569C21C4B7A8D2560750 ] TPPWRIF C:\WINDOWS\system32\drivers\Tppwrif.sys
21:39:23.0828 2344 TPPWRIF ( UnsignedFile.Multi.Generic ) - warning
21:39:23.0828 2344 TPPWRIF - detected UnsignedFile.Multi.Generic (1)
21:39:23.0875 2344 [ 626504572B175867F30F3215C04B3E2F ] TrkWks C:\WINDOWS\system32\trkwks.dll
21:39:24.0109 2344 TrkWks - ok
21:39:24.0156 2344 [ F10F36E20448A5500A5F83F67EE4AAD4 ] TSMAPIP C:\WINDOWS\system32\drivers\TSMAPIP.SYS
21:39:24.0218 2344 TSMAPIP ( UnsignedFile.Multi.Generic ) - warning
21:39:24.0218 2344 TSMAPIP - detected UnsignedFile.Multi.Generic (1)
21:39:24.0328 2344 [ E9EA448F1174BE4052416B62263EA4EE ] TVT Scheduler C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe
21:39:24.0484 2344 TVT Scheduler ( UnsignedFile.Multi.Generic ) - warning
21:39:24.0484 2344 TVT Scheduler - detected UnsignedFile.Multi.Generic (1)
21:39:24.0531 2344 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
21:39:24.0750 2344 Udfs - ok
21:39:24.0781 2344 [ 1B698A51CD528D8DA4FFAED66DFC51B9 ] ultra C:\WINDOWS\system32\DRIVERS\ultra.sys
21:39:24.0921 2344 ultra - ok
21:39:25.0000 2344 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
21:39:25.0234 2344 Update - ok
21:39:25.0281 2344 [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost C:\WINDOWS\System32\upnphost.dll
21:39:25.0515 2344 upnphost - ok
21:39:25.0546 2344 [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS C:\WINDOWS\System32\ups.exe
21:39:25.0750 2344 UPS - ok
21:39:25.0781 2344 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys
21:39:25.0984 2344 usbaudio - ok
21:39:26.0000 2344 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
21:39:26.0218 2344 usbccgp - ok
21:39:26.0281 2344 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
21:39:26.0484 2344 usbehci - ok
21:39:26.0531 2344 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
21:39:26.0765 2344 usbhub - ok
21:39:26.0796 2344 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
21:39:27.0015 2344 usbprint - ok
21:39:27.0062 2344 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
21:39:27.0265 2344 usbscan - ok
21:39:27.0312 2344 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
21:39:27.0531 2344 USBSTOR - ok
21:39:27.0562 2344 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
21:39:27.0765 2344 usbuhci - ok
21:39:28.0062 2344 [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys
21:39:28.0281 2344 usb_rndisx - ok
21:39:28.0328 2344 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
21:39:28.0531 2344 VgaSave - ok
21:39:28.0593 2344 [ 754292CE5848B3738281B4F3607EAEF4 ] viaagp C:\WINDOWS\system32\DRIVERS\viaagp.sys
21:39:28.0796 2344 viaagp - ok
21:39:28.0812 2344 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys
21:39:29.0031 2344 ViaIde - ok
21:39:29.0078 2344 [ A5A712F4E880874A477AF790B5186E1D ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
21:39:29.0296 2344 VolSnap - ok
21:39:29.0375 2344 [ 0354BA3A5BA5E28CC247EB5F5DD8793C ] vsdatant C:\WINDOWS\system32\vsdatant.sys
21:39:29.0453 2344 vsdatant - ok
21:39:29.0515 2344 [ 68F106273BE29E7B7EF8266977268E78 ] VSS C:\WINDOWS\System32\vssvc.exe
21:39:29.0718 2344 VSS - ok
21:39:29.0781 2344 [ 7B353059E665F8B7AD2BBEAEF597CF45 ] W32Time C:\WINDOWS\system32\w32time.dll
21:39:30.0015 2344 W32Time - ok
21:39:30.0125 2344 [ 73395A19FC86461A151D3C330604E8B3 ] w39n51 C:\WINDOWS\system32\DRIVERS\w39n51.sys
21:39:30.0343 2344 w39n51 - ok
21:39:30.0406 2344 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
21:39:30.0625 2344 Wanarp - ok
21:39:30.0687 2344 [ D918617B46457B9AC28027722E30F647 ] Wdf01000 C:\WINDOWS\system32\Drivers\wdf01000.sys
21:39:30.0734 2344 Wdf01000 - ok
21:39:30.0750 2344 WDICA - ok
21:39:30.0781 2344 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
21:39:31.0000 2344 wdmaud - ok
21:39:31.0046 2344 [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient C:\WINDOWS\System32\webclnt.dll
21:39:31.0250 2344 WebClient - ok
21:39:31.0328 2344 [ 0E666AC2766F2FD860CC03F405A2ACE1 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
21:39:31.0421 2344 winachsf - ok
21:39:31.0500 2344 winmgmt - ok
21:39:31.0609 2344 [ F10075C2EC96D2EB118012E78ECE2FC2 ] WinRM C:\WINDOWS\system32\WsmSvc.dll
21:39:31.0828 2344 WinRM - ok
21:39:31.0875 2344 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
21:39:31.0937 2344 WmdmPmSN - ok
21:39:32.0000 2344 [ FFA4D901D46D07A5BAB2D8307FBB51A6 ] Wmi C:\WINDOWS\System32\advapi32.dll
21:39:32.0171 2344 Wmi - ok
21:39:32.0296 2344 [ 93908111BA57A6E60EC2FA2DE202105C ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
21:39:32.0515 2344 WmiApSrv - ok
21:39:32.0609 2344 [ BF05650BB7DF5E9EBDD25974E22403BB ] WMPNetworkSvc C:\Programme\Windows Media Player\WMPNetwk.exe
21:39:32.0750 2344 WMPNetworkSvc - ok
21:39:32.0812 2344 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
21:39:32.0859 2344 WpdUsb - ok
21:39:33.0015 2344 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
21:39:33.0125 2344 WPFFontCache_v0400 - ok
21:39:33.0171 2344 [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc C:\WINDOWS\system32\wscsvc.dll
21:39:33.0390 2344 wscsvc - ok
21:39:33.0390 2344 WSearch - ok
21:39:33.0453 2344 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
21:39:33.0656 2344 WSTCODEC - ok
21:39:33.0687 2344 [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
21:39:33.0890 2344 wuauserv - ok
21:39:33.0937 2344 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
21:39:33.0984 2344 WudfPf - ok
21:39:34.0015 2344 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
21:39:34.0062 2344 WudfRd - ok
21:39:34.0093 2344 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
21:39:34.0140 2344 WudfSvc - ok
21:39:34.0203 2344 [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
21:39:34.0484 2344 WZCSVC - ok
21:39:34.0515 2344 [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
21:39:34.0734 2344 xmlprov - ok
21:39:34.0765 2344 ================ Scan global ===============================
21:39:34.0812 2344 [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll
21:39:34.0875 2344 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
21:39:34.0890 2344 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
21:39:34.0921 2344 [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe
21:39:34.0921 2344 [Global] - ok
21:39:34.0921 2344 ================ Scan MBR ==================================
21:39:34.0953 2344 [ BD888EDE7CD62688AF281ED379D051C6 ] \Device\Harddisk0\DR0
21:39:37.0875 2344 \Device\Harddisk0\DR0 - ok
21:39:37.0875 2344 ================ Scan VBR ==================================
21:39:37.0875 2344 [ 35E4707A798EED5115EAF5C00E7CF3D7 ] \Device\Harddisk0\DR0\Partition1
21:39:37.0875 2344 \Device\Harddisk0\DR0\Partition1 - ok
21:39:37.0875 2344 ============================================================
21:39:37.0875 2344 Scan finished
21:39:37.0875 2344 ============================================================
21:39:37.0984 0620 Detected object count: 23
21:39:37.0984 0620 Actual detected object count: 23
21:40:24.0703 0620 AegisP ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0703 0620 AegisP ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0718 0620 BTKRNL ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0718 0620 BTKRNL ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0718 0620 btwdins ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0718 0620 btwdins ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0718 0620 BTWUSB ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0718 0620 BTWUSB ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0718 0620 CVPNDRVA ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0718 0620 CVPNDRVA ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0718 0620 Eacfilt ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0718 0620 Eacfilt ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0734 0620 EvtEng ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0734 0620 EvtEng ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0734 0620 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0734 0620 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0734 0620 IPSECEXT ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0734 0620 IPSECEXT ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0734 0620 IPSECSHM ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0734 0620 IPSECSHM ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0734 0620 pmem ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0734 0620 pmem ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0750 0620 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0750 0620 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0750 0620 Power Manager DBC Service ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0750 0620 Power Manager DBC Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0750 0620 RegSrvc ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0750 0620 RegSrvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0750 0620 S24EventMonitor ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0750 0620 S24EventMonitor ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0750 0620 s24trans ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0750 0620 s24trans ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0750 0620 Smapint ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0750 0620 Smapint ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0750 0620 SUService ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0750 0620 SUService ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0765 0620 TDSMAPI ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0765 0620 TDSMAPI ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0765 0620 TpKmpSVC ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0765 0620 TpKmpSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0765 0620 TPPWRIF ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0765 0620 TPPWRIF ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0765 0620 TSMAPIP ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0765 0620 TSMAPIP ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:40:24.0765 0620 TVT Scheduler ( UnsignedFile.Multi.Generic ) - skipped by user
21:40:24.0765 0620 TVT Scheduler ( UnsignedFile.Multi.Generic ) - User select action: Skip

hi
combofix:

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

So, auch dies ist geschafft:

Combofix Logfile:

ComboFix 13-01-17.03 - *** 17.01.2013  21:54:57.1.2 - x86
ausgeführt von:: c:\dokumente und einstellungen\***\Eigene Dateien\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\All Users\Anwendungsdaten\0tbpw.pad
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP
c:\dokumente und einstellungen\***\wgsdgsdgdsgsd.exe
c:\programme\Internet Explorer\SET5F.tmp
c:\programme\Internet Explorer\SET63.tmp
c:\programme\Internet Explorer\SET64.tmp
C:\Recycle.Bin
c:\windows\IsUn0407.exe
c:\windows\system32\SET4.tmp
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-12-17 bis 2013-01-17  ))))))))))))))))))))))))))))))
.
.
2013-01-17 20:34 . 2013-01-17 20:34	--------	d-----w-	c:\windows\LastGood
2013-01-17 20:28 . 2013-01-17 20:28	60872	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{31AEC6A1-DB09-4D4E-8E36-4A5D560D62EB}\offreg.dll
2013-01-16 23:42 . 2011-07-13 02:55	2237440	----a-r-	C:\OTLPE.exe
2013-01-16 23:42 . 2013-01-16 23:42	--------	d-----w-	C:\_OTL
2013-01-16 18:31 . 2013-01-08 04:57	6991832	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{31AEC6A1-DB09-4D4E-8E36-4A5D560D62EB}\mpengine.dll
2013-01-10 19:19 . 2012-11-08 18:00	6812136	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-16 12:23 . 1979-12-31 22:00	290560	----a-w-	c:\windows\system32\atmfd.dll
2012-11-13 11:55 . 1979-12-31 22:00	1866496	------w-	c:\windows\system32\win32k.sys
2012-11-06 02:01 . 2009-08-19 17:07	1371648	----a-w-	c:\windows\system32\msxml6.dll
2012-11-02 02:02 . 1979-12-31 22:00	375296	------w-	c:\windows\system32\dpnet.dll
2012-11-01 12:17 . 1979-12-31 22:00	916992	----a-w-	c:\windows\system32\wininet.dll
2012-11-01 12:17 . 1979-12-31 22:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2012-11-01 12:17 . 1979-12-31 22:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2012-11-01 00:35 . 1979-12-31 22:00	385024	----a-w-	c:\windows\system32\html.iec
2011-07-08 07:31 . 2011-08-06 13:00	142296	----a-w-	c:\programme\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-04-05 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPHOTKEY"="c:\programme\Lenovo\HOTKEY\TPOSDSVC.exe" [2009-12-21 69568]
"TpShocks"="TpShocks.exe" [2009-12-11 337256]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2010-03-03 513384]
"SoundMAXPnP"="c:\programme\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-09 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-09 155648]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-09 131072]
"TP4EX"="tp4ex.exe" [2005-10-17 65536]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2010-04-22 1725736]
"MSC"="c:\programme\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"APSDaemon"="c:\programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2012-04-18 421888]
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2010-03-27 202256]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
VPN Client.lnk - c:\windows\Installer\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\Icon3E5562ED7.ico [2012-9-9 6144]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programme\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2009-12-01 12:41	100104	----a-w-	c:\programme\ThinkVantage Fingerprint Software\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli c:\programme\ThinkVantage Fingerprint Software\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk
backup=c:\windows\pss\Adobe Reader - Schnellstart.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^AutoUpdate Monitor.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\AutoUpdate Monitor.lnk
backup=c:\windows\pss\AutoUpdate Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Digital Line Detect.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Windows Search.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlackBerryAutoUpdate]
2008-11-04 11:09	615696	-c----w-	c:\programme\Gemeinsame Dateien\Research In Motion\Auto Update\RIMAutoUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 06:52	15360	----a-w-	c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EZEJMNAP]
2009-12-01 01:39	256576	-c----w-	c:\progra~1\ThinkPad\UTILIT~1\EZEJMNAP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-04-28 14:06	142120	-c--a-w-	c:\programme\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LPMailChecker]
2009-07-23 02:11	124248	-c----w-	c:\progra~1\THINKV~2\PrdCtr\LPMLCHK.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LPManager]
2009-07-23 02:11	185688	-c----w-	c:\progra~1\THINKV~2\PrdCtr\LPMGR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PAC7302_Monitor]
2006-11-03 10:01	319488	-c--a-w-	c:\windows\PixArt\Pac7302\Monitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pwrpdfprsrv.exe]
2003-02-07 07:22	4219904	-c----w-	c:\programme\PowerPDF Professional\pwrpdfsrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-04-18 18:56	421888	----a-w-	c:\programme\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2007-03-30 12:34	25263144	------w-	c:\programme\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
2005-05-06 14:06	716800	----a-w-	c:\programme\Analog Devices\SoundMAX\SMax4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2005-05-20 08:11	925696	----a-w-	c:\programme\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 13:49	249064	----a-w-	c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2011-04-05 17:39	39408	----a-w-	c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2010-04-22 22:16	1725736	----a-w-	c:\programme\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
2010-04-22 22:16	128296	----a-w-	c:\programme\Synaptics\SynTP\SynTPLpr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-03-27 01:26	202256	----a-w-	c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TP4EX]
2005-10-17 00:11	65536	----a-w-	c:\windows\system32\TP4EX.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPFNF7]
2010-03-26 03:08	62312	-c----w-	c:\programme\Lenovo\NPDIRECT\tpfnf7sp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPKMAPHELPER]
2007-01-09 15:28	868352	----a-w-	c:\programme\ThinkPad\Utilities\TpKmapAp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TpShocks]
2009-12-11 11:19	337256	----a-w-	c:\windows\system32\TpShocks.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVT Scheduler Proxy]
2008-03-04 09:34	487424	----a-w-	c:\programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
2006-03-30 14:45	313472	------r-	c:\programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Nortel Networks\\Extranet.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\Programme\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows-Remoteverwaltung 
.
R1 gfhbpvru;gfhbpvru;c:\windows\system32\drivers\gfhbpvru.sys [x]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\programme\LENOVO\HOTKEY\MICMUTE.exe [x]
R3 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\DRIVERS\ipsecw2k.sys [x]
S0 DozeHDD;DozeHDD;c:\windows\System32\DRIVERS\DozeHDD.sys [x]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM86.sys [x]
S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiif32.sys [x]
S2 DozeSvc;Lenovo Doze Mode Service;c:\programme\ThinkPad\Utilities\DOZESVC.EXE [x]
S2 Power Manager DBC Service;Power Manager DBC Service;c:\programme\ThinkPad\Utilities\PWMDBSVC.exe [x]
S2 smihlp;SMI Helper Driver (smihlp);c:\programme\ThinkVantage Fingerprint Software\smihlp.sys [x]
S2 TPHKSVC;Anzeige am Bildschirm;c:\programme\LENOVO\HOTKEY\TPHKSVC.exe [x]
S3 Eacfilt;Eacfilt Miniport;c:\windows\system32\DRIVERS\eacfilt.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-01-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2011-03-16 14:42]
.
2013-01-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2011-03-16 14:42]
.
2013-01-17 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\programme\Microsoft Security Client\MpCmdRun.exe [2012-09-12 15:25]
.
2013-01-17 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2010-05-01 00:20]
.
2013-01-17 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1438623065-2946043602-1926309237-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2010-02-24 22:09]
.
2013-01-06 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1438623065-2946043602-1926309237-1005.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2010-02-24 22:09]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Senden an &Bluetooth - c:\programme\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\b1x5qj3y.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.golero.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Notify-NavLogon - (no file)
SafeBoot-Wdf01000.sys
MSConfigStartUp-ACTray - c:\programme\ThinkPad\ConnectUtilities\ACTray.exe
MSConfigStartUp-ACWLIcon - c:\programme\ThinkPad\ConnectUtilities\ACWLIcon.exe
MSConfigStartUp-AMSG - c:\programme\ThinkVantage\AMSG\Amsg.exe
MSConfigStartUp-cssauth - c:\programme\IBM ThinkVantage\Client Security Solution\cssauth.exe
MSConfigStartUp-DiskeeperSystray - c:\programme\Diskeeper Corporation\Diskeeper\DkIcon.exe
MSConfigStartUp-ISUSPM Startup - c:\progra~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe
MSConfigStartUp-ISUSScheduler - c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe
MSConfigStartUp-PDService - c:\programme\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe
MSConfigStartUp-SDTray - c:\programme\Spyware Doctor\SDTrayApp.exe
MSConfigStartUp-suScheduler - c:\programme\ThinkVantage\SystemUpdate\UCLauncher.exe
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-01-17 22:01
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\p*"! ]
"Path"="c:\\WINDOWS\\system32\\config\\systemprofile\\Anwendungsdaten\\Intel\\Wireless\\"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"7040AC1900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(940)
c:\windows\system32\vrlogon.dll
c:\programme\ThinkVantage Fingerprint Software\psqlpwd.dll
c:\programme\ThinkVantage Fingerprint Software\homefus2.dll
c:\programme\ThinkVantage Fingerprint Software\infql2.dll
c:\programme\ThinkVantage Fingerprint Software\homepass.dll
c:\programme\ThinkVantage Fingerprint Software\bio.dll
c:\programme\ThinkVantage Fingerprint Software\qlbase.dll
c:\programme\ThinkVantage Fingerprint Software\ps2css.dll
.
- - - - - - - > 'lsass.exe'(996)
c:\programme\ThinkVantage Fingerprint Software\psqlpwd.dll
c:\programme\ThinkVantage Fingerprint Software\homefus2.dll
c:\programme\ThinkVantage Fingerprint Software\infql2.dll
.
Zeit der Fertigstellung: 2013-01-17  22:04:58
ComboFix-quarantined-files.txt  2013-01-17 21:04
.
Vor Suchlauf: 15 Verzeichnis(se), 20.699.082.752 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 21.107.101.696 Bytes frei
.
WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
.
- - End Of File - - 0868D46B41D917FB539D4C6B68D89D07
         

--- --- ---

hi
malwarebytes:
Downloade Dir bitte Malwarebytes

• Installiere
  das Programm in den vorgegebenen Pfad.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Starte Malwarebytes, klicke auf Aktualisierung --> Suche
  nach Aktualisierung
• Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
• Wenn der Scan beendet
  ist, klicke auf Ergebnisse anzeigen.
• Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
• Poste
  das Logfile, welches sich in Notepad öffnet, hier in den Thread.
• Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Malwarebytes Anti-Malware 1.70.0.1100
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2013.01.19.06

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
*** :: LENOVO-2AC64B94 [Administrator]

19.01.2013 13:16:56
mbam-log-2013-01-19 (13-16-56).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 322506
Laufzeit: 1 Stunde(n), 10 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Qoobox\Quarantine\C\Dokumente und Einstellungen\***\wgsdgsdgdsgsd.exe.vir (Trojan.FakeMS) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Sehr gut.

lade den CCleaner standard:
CCleaner Download - CCleaner 3.21.1767
falls der CCleaner bereits instaliert ist, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Legende:
Notwendig (+)
Unnötig (-)
Unbekannt (?)

+ Adobe Flash Player 11 ActiveX Adobe Systems Incorporated 10.01.2013 11.1.102.55
+ Adobe Reader 7.1.0 - Deutsch Adobe Systems Incorporated 28.07.2008 80,40MB 7.1.0
+ Ahnenblatt 2.62 Dirk Boettcher 25.09.2010 2.62.0.0
- Alle meine Adressen 1.20 27.12.2009
? Anzeige am Bildschirm 01.05.2010 6.03.00
? Apple Application Support Apple Inc. 16.06.2012 62,74MB 2.1.7
? Apple Mobile Device Support Apple Inc. 01.05.2010 21,44MB 3.0.1.3
? Apple Software Update Apple Inc. 16.06.2012 2,38MB 2.1.3.127
+ BlackBerry Desktop Software 4.7 Research in Motion Ltd. 08.02.2009 4.7.0.32
? Bonjour Apple Inc. 01.05.2010 0,76MB 2.0.1.2
+ Brother HL-2035 Brother 11.05.2010 1.00
+ CCleaner Piriform 19.12.2012 3.26
+ Cisco Systems VPN Client 5.0.07.0290 Cisco Systems, Inc. 09.09.2012 12,37MB 5.0.6
? Compatibility Pack für 2007 Office System Microsoft Corporation 10.01.2013 167,00MB 12.0.6612.1000
+ Dienstprogramm "ThinkPad UltraNav" Lenovo 01.05.2010 2.12.0
+ Dienstprogramm 'ThinkPad-Tastaturanpassung' 01.05.2010 1.3.53.0
+ EPSON-Drucker-Software 08.08.2008
+ Ergänzung zu Productivity Center für ThinkPad 01.05.2010 3.00b
? FTP Commander 16.10.2008
+ Funktion "TrackPoint-Eingabehilfen" 19.01.2013 1.11.0.0
+ GIMP 2.6.11 The GIMP Team 15.06.2011 2.6.11
- Google Chrome Google Inc. 21.01.2013 24.0.1312.52
+ Google Earth Plug-in Google 16.12.2011 40,92MB 6.1.0.5001
? Google Toolbar for Internet Explorer Google Inc. 05.04.2011 7.4.3607.2246
? High Definition Audio - KB888111 Microsoft Corporation 20040219.000000
+ HL-2130 Brother Industries, Ltd. 21.09.2012 1.0.7.0
+ HP Image Zone 4.7 HP 30.10.2011 4.7
+ HP PSC & OfficeJet 4.7 HP 30.10.2011
+ IBM 32-bit Runtime Environment for Java 2, v1.4.2 IBM 30.03.2006 1.4.2
+ Intel(R) Graphics Media Accelerator Driver 01.05.2010
+ Intel(R) PRO Network Connections Drivers 19.01.2013
? Intel(R) PROSet/Wireless Software Intel Corporation 18.01.2013
? InterVideo WinDVD InterVideo Inc. 30.03.2006 5.0-B11.300
- iTunes Apple Inc. 01.05.2010 159,00MB 9.1.1.12
? Java(TM) 6 Update 24 Oracle 15.03.2011 90,88MB 6.0.240
+ Lenovo System Interface Driver 1.01
+ Malwarebytes Anti-Malware Version 1.70.0.1100 Malwarebytes Corporation 19.01.2013 1.70.0.1100
? Microsoft .NET Framework 1.1 10.01.2013
? Microsoft .NET Framework 1.1 German Language Pack Microsoft 30.03.2006 3,76MB 1.1.4322
? Microsoft .NET Framework 2.0 Service Pack 2 Microsoft Corporation 10.01.2013 185,00MB 2.2.30729
? Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU Microsoft Corporation 01.05.2010 6,30MB 2.2.30729
? Microsoft .NET Framework 3.0 Service Pack 2 Microsoft Corporation 10.01.2013 264,00MB 3.2.30729
? Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU Microsoft Corporation 01.05.2010 37,52MB 3.2.30729
? Microsoft .NET Framework 3.5 Language Pack SP1 - DEU Microsoft Corporation 01.05.2010
? Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 10.01.2013
? Microsoft .NET Framework 4 Client Profile Microsoft Corporation 10.01.2013 4.0.30319
? Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 20.06.2011 4.0.30319
? Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Corporation 01.05.2010 1
? Microsoft Office File Validation Add-In Microsoft Corporation 16.09.2011 11,21MB 14.0.5130.5003
? Microsoft Office Live Add-in 1.5 Microsoft Corporation 20.07.2012 0,49MB 2.0.4024.1
+ Microsoft Office Small Business Edition 2003 Microsoft Corporation 10.01.2013 1.275,00MB 11.0.8173.0
+ Microsoft Security Essentials Microsoft Corporation 02.10.2012 4.1.522.0
? Microsoft Silverlight Microsoft Corporation 13.05.2012 197,00MB 5.1.10411.0
? Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Corporation 01.05.2010
? Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 07.09.2010 0,11MB 8.0.50727.4053
? Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 16.06.2011 5,28MB 8.0.61001
? Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Corporation 07.09.2010 0,15MB 9.0.30729.4148
? Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Corporation 20.05.2011 10,20MB 9.0.30729.5570
? Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 01.05.2010 10,28MB 9.0.30729
? Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 16.06.2011 10,20MB 9.0.30729.6161
? Microsoft Works 6-9 Converter Microsoft Corporation 09.05.2012 1,17MB 14.0.6120.5002
? Microsoft-Basissmartcard-Kryptografiedienstanbieterpaket Microsoft Corporation 01.05.2010
+ Mozilla Firefox 5.0.1 (x86 de) Mozilla 25.09.2011 5.0.1
- MS Works Spreadsheet to XLS Converter 16.01.2013
? MSXML 4.0 SP2 (KB927978) Microsoft Corporation 19.11.2006 2,56MB 4.20.9841.0
? MSXML 4.0 SP2 (KB936181) Microsoft Corporation 15.08.2007 2,62MB 4.20.9848.0
? MSXML 4.0 SP2 (KB954430) Microsoft Corporation 14.11.2008 2,67MB 4.20.9870.0
? MSXML 4.0 SP2 (KB973688) Microsoft Corporation 26.11.2009 2,77MB 4.20.9876.0
? MSXML 6 Service Pack 2 (KB973686) Microsoft Corporation 26.11.2009 1,40MB 6.20.2003.0
+ MyTomTom 3.2.0.700 TomTom 08.06.2012 3.2.0.700
+ Nortel Networks Contivity VPN Client 18.12.2006
+ PDFCreator Frank Heindörfer, Philip Chinery 28.11.2008 0.9.6
+ PowerPDF Professional Visage Software 21.12.2006 9,35MB 2.0
? Präsentationsdirektor 01.05.2010 4.08
+ QuickTime Apple Inc. 16.06.2012 73,28MB 7.72.80.56
+ RealPlayer RealNetworks 27.03.2010
? Security Update for Windows Search 4 - KB963093 Microsoft Corporation 01.05.2010
- Skype 3.1 Skype Technologies S.A. 06.05.2007 3.1
? SoundMAX Analog Devices 01.05.2010 5.10.01.4326
? ThinkPad Bluetooth with Enhanced Data Rate Software IBM, Inc. 30.03.2006 33,53MB 4.0.1.3000
? ThinkPad Energie-Manager 01.05.2010 1.80
? ThinkPad FullScreen Magnifier 01.05.2010 2.13
? ThinkPad Modem 01.05.2010 7.70.00
? ThinkPad Power Management Driver 19.01.2013 1.60.0.4
? ThinkPad UltraNav Driver 21.05.2011 15.0.18.0
? ThinkPad-Dienstprogramm 'EasyEject' 01.05.2010 2.39
? ThinkPad-Konfiguration 01.05.2010 1.55
? ThinkVantage Fingerprint Software UPEK Inc. 01.05.2010 68,55MB 5.8.5.6014
? ThinkVantage Productivity Center Lenovo 01.05.2010 3.11
? ThinkVantage System für aktiven Festplattenschutz Lenovo 01.05.2010 8,77MB 1.71
? ThinkVantage System Update Lenovo 01.05.2010 27,17MB 3.14.0024
? Uniblue RegistryBooster Uniblue Systems Ltd 01.05.2010
? Visual Studio C++ 10.0 Runtime TomTom International B.V. 08.06.2012 1,15MB 10.0.0
? Webcam 2200 Logitech 08.10.2009 1.0.0.0
+ Windows Internet Explorer 8 Microsoft Corporation 30.04.2010 20090308.140743
? Windows Management Framework Core Microsoft Corporation 21.05.2011
+ Windows Media Format 11 runtime 01.05.2010
+ Windows Media Player 11 01.05.2010
? Windows Search 4.0 Microsoft Corporation 01.05.2010 04.00.6001.503
+ Windows XP Service Pack 3 Microsoft Corporation 30.04.2010 20080414.031514