Computer gesperrt und ist weder im normalen noch im abgesicherten Modus zu verwenden!

Megalodon · 07.02.2013, 20:20

Hallo liebe Leute!
Mein Computer wurde gesperrt und es erscheint eine Nachricht, dass ich 100 Euro an die Polizei Ueberweisen soll!
Ich habe jetzt versucht den PC im abgesicherten Modus zu starten doch auch hier werde ich von der Nachricht geblockt daher schreibe ich diesen Eintrag gerade vom reatogo-x-pe System aus!
Meine Frage daher, kann ich eine Systemwiderherstellung von hier aus durchfuehren und ist es ueberhaupt sinvoll das zu machen?
Vielen Dank

markusg · 07.02.2013, 21:24

hi
• Dein System sollte jetzt einen REATOGO-X-PE Desktop anzeigen.
• Mache einen doppel Klick auf das OTLPE Icon.
• Wenn du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
• Wenn du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
• entferne den haken bei "Automatically Load All Remaining Users" wenn er gesetzt ist.

• OTL sollte nun starten.
Kopiere nun den Inhalt in die

Textbox.

Code:

ATTFilter

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe

• Drücke Run Scan um den Scan zu starten.
• Wenn er fertig ist werden die Dateien in C:\otl.txt gesichert
• Kopiere diesen Ordner auf deinen USB-Stick wenn du keine Internetverbindung auf diesem System hast.
poste beide logs

Megalodon · 08.02.2013, 08:30

Vielen Dank fuer die schnelle Antwort!
Hier das logfileOTL Logfile:

Code:

ATTFilter

OTL logfile created on: 2/8/2013 8:21:53 AM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 92.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 39.06 Gb Total Space | 15.36 Gb Free Space | 39.32% Space Free | Partition Type: NTFS
Drive D: | 167.24 Gb Total Space | 47.84 Gb Free Space | 28.61% Space Free | Partition Type: NTFS
Drive E: | 166.31 Gb Total Space | 120.09 Gb Free Space | 72.21% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - [2013/02/07 13:19:30 | 000,114,688 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\temp\wwgXEGi.exe -- (winmgmt)
SRV - [2013/01/09 08:09:28 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/11/22 13:19:48 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2012/09/20 07:28:48 | 030,785,672 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2012/08/11 09:43:06 | 000,055,184 | ---- | M] (Apple Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2012/06/25 08:10:22 | 000,185,856 | ---- | M] () [Auto] -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater)
SRV - [2012/03/23 22:04:38 | 000,577,024 | ---- | M] (Hauppauge Computer Works) [Auto] -- C:\Programme\WinTV\TVServer\HauppaugeTVServer.exe -- (HauppaugeTVServer)
SRV - [2010/01/09 14:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010/01/09 14:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009/03/12 05:53:46 | 000,254,036 | ---- | M] (IDT, Inc.) [Auto] -- C:\Programme\IDT\IntelXPV_v103\WDM\stacsv.exe -- (STacSV)
SRV - [2006/03/16 23:34:24 | 000,115,952 | ---- | M] (symantec) [On_Demand] -- C:\Programme\Symantec AntiVirus\SavRoam.exe -- (SavRoam)
SRV - [2006/03/16 23:34:20 | 001,799,408 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Symantec AntiVirus\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2006/03/16 23:34:12 | 000,030,448 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Symantec AntiVirus\DefWatch.exe -- (DefWatch)
SRV - [2006/03/07 06:03:02 | 000,169,632 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)
SRV - [2006/03/07 06:02:34 | 000,192,160 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)
SRV - [2006/02/23 04:41:02 | 002,045,632 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_0.EXE -- (LiveUpdate)
SRV - [2006/02/06 05:50:24 | 001,160,848 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe -- (SPBBCSvc)
SRV - [2006/01/24 13:06:58 | 000,214,720 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe -- (SNDSrvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2012/12/20 05:02:35 | 001,603,824 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20130207.004\NAVEX15.SYS -- (NAVEX15)
DRV - [2012/12/20 05:02:33 | 000,093,296 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20130207.004\NAVENG.SYS -- (NAVENG)
DRV - [2012/07/31 19:34:46 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\eengine\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/07/31 19:34:45 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\eengine\eeCtrl.sys -- (eeCtrl)
DRV - [2012/01/31 06:22:12 | 001,164,176 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HCW713x.sys -- (HCW713x)
DRV - [2009/03/12 05:53:46 | 001,550,613 | ---- | M] (IDT, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2008/04/13 13:46:22 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)
DRV - [2006/02/06 05:50:22 | 000,389,776 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2006/01/31 06:29:20 | 000,107,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Symantec\SYMEVENT.SYS -- (SymEvent)
DRV - [2006/01/24 13:06:36 | 000,195,776 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2006/01/24 13:06:32 | 000,024,768 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2005/12/19 13:41:58 | 000,054,968 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Symantec AntiVirus\Savrtpel.sys -- (SAVRTPEL)
DRV - [2005/12/19 13:41:56 | 000,337,592 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Symantec AntiVirus\savrt.sys -- (SAVRT)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzuyEtN2Y1L1QzutDtDtCzy0DtCzy0D0F0DyBzytBtByDzytN0D0Tzu0CtBtCtCtN1L2XzutBtFtCtFtDtFtAtDtC&cr=845787422
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Karli_ON_C\Software\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = hxxp://mystart.incredibar.com/mb167?a=6R8yGZ8WzP&i=26
IE - HKU\Karli_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzuyEtN2Y1L1QzutDtDtCzy0DtCzy0D0F0DyBzytBtByDzytN0D0Tzu0CtBtCtCtN1L2XzutBtFtCtFtDtFtAtDtC&cr=845787422
IE - HKU\Karli_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Karli_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\WINDOWS\system32\npdeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\Programme\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Programme\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Programme\Web Assistant\Firefox [2012/07/11 14:12:17 | 000,000,000 | ---D | M]
 
[2012/12/28 05:31:30 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Karli\Anwendungsdaten\mozilla\Firefox\Profiles\extensions
[2012/07/29 07:13:50 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Karli\Anwendungsdaten\mozilla\Firefox\Profiles\extensions\extensions
[2012/07/29 07:13:45 | 000,000,000 | ---D | M] (OneClickDownloader) -- C:\Dokumente und Einstellungen\Karli\Anwendungsdaten\mozilla\Firefox\Profiles\extensions\OneClickDownload@OneClickDownload.com
[2012/07/29 07:13:50 | 000,000,000 | ---D | M] (Funmoods.com) -- C:\Dokumente und Einstellungen\Karli\Anwendungsdaten\mozilla\Firefox\Profiles\extensions\extensions\ffxtlbr@funmoods.com
[2012/07/11 14:12:20 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
 
O1 HOSTS File: ([2012/09/26 12:02:35 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Programme\Web Assistant\Extension32.dll ()
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Funmoods Helper Object) - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} -  File not found
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Funmoods Toolbar) - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} -  File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BCSSync] C:\Programme\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NWEReboot]  File not found
O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [vptray] C:\Programme\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\runctf.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\AutoStart IR.lnk = C:\Programme\WinTV\Ir.exe (Hauppauge Computer Works)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinTV Recording Status.lnk = C:\Programme\WinTV\WinTV7\WinTVTray.exe (Hauppauge Computer Works, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Karli\Startmenü\Programme\Autostart\runctf.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Karli_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1336301744328 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1336301799453 (MUWebControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 195.202.128.2 195.202.128.73
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: E:\eigene Dateien\Eigene Bilder\free-wallpaper-14.bmp
O24 - Desktop BackupWallPaper: E:\eigene Dateien\Eigene Bilder\free-wallpaper-14.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/05/06 03:55:42 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Programme\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C3C986D6-06B1-43BF-90DD-BE30756C00DE} - RevokedRootsUpdate
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: winmgmt - C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\temp\wwgXEGi.exe (Microsoft Corporation)
 
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/02/05 11:21:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Karli\Startmenü\Programme\GeoGebra 4.2
[2013/02/03 10:31:25 | 000,000,000 | -H-D | C] -- C:\BJPrinter
[2013/02/02 11:13:02 | 000,580,712 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPDiscoPM5E12.dll
[2013/02/02 11:13:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\HP
[2013/02/02 11:12:59 | 000,529,808 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinksts5E12.dll
[2013/02/02 11:12:59 | 000,268,688 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinksts5E12LM.dll
[2013/02/02 11:12:59 | 000,220,560 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkcoi5E12.dll
[2013/02/02 11:12:58 | 002,216,336 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkins5E12.exe
[2013/02/02 11:12:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HP
[2013/02/02 11:12:50 | 000,000,000 | ---D | C] -- C:\Programme\HP
[2013/02/02 11:12:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\Anwendungsdaten\HP
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/02/07 13:32:38 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/02/07 13:32:19 | 095,023,320 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\iGEXgww.pad
[2013/02/07 13:32:15 | 000,003,155 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\igexgww.js
[2013/02/07 13:31:41 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/02/07 13:25:04 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/02/07 13:19:34 | 000,000,814 | ---- | M] () -- C:\Dokumente und Einstellungen\Karli\Startmenü\Programme\Autostart\runctf.lnk
[2013/02/07 13:17:00 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/02/07 13:09:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/02/05 11:21:14 | 000,002,144 | ---- | M] () -- C:\Dokumente und Einstellungen\Karli\Desktop\GeoGebra 4.2.lnk
[2013/02/04 11:28:23 | 000,097,631 | ---- | M] () -- C:\Dokumente und Einstellungen\Karli\Desktop\20130408_ZECHMEISTER_7H7R36.pdf
[2013/02/03 11:19:07 | 000,001,791 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
[2013/02/02 11:13:01 | 000,001,883 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\HP Officejet 6100.lnk
[2013/02/02 11:13:01 | 000,000,855 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Shop für Zubehör - HP Officejet 6100.lnk
[2013/02/02 11:13:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\HP
[2013/02/02 11:12:47 | 000,000,057 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ament.ini
[2013/01/27 06:06:22 | 000,017,767 | ---- | M] () -- C:\Dokumente und Einstellungen\Karli\Desktop\Your_temporary_card.pdf
[2013/01/16 13:07:04 | 000,001,809 | ---- | M] () -- C:\Dokumente und Einstellungen\Karli\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/15 13:19:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Google Chrome
[2013/01/10 12:12:30 | 000,449,236 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2013/01/10 12:12:30 | 000,432,928 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/01/10 12:12:30 | 000,080,550 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2013/01/10 12:12:30 | 000,067,884 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/01/10 12:08:26 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/01/10 10:49:28 | 000,002,347 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Reader XI.lnk
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/02/07 13:32:15 | 000,003,155 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\igexgww.js
[2013/02/07 13:19:34 | 000,000,814 | ---- | C] () -- C:\Dokumente und Einstellungen\Karli\Startmenü\Programme\Autostart\runctf.lnk
[2013/02/07 13:19:32 | 095,023,320 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\iGEXgww.pad
[2013/02/05 11:21:14 | 000,002,144 | ---- | C] () -- C:\Dokumente und Einstellungen\Karli\Desktop\GeoGebra 4.2.lnk
[2013/02/04 11:28:23 | 000,097,631 | ---- | C] () -- C:\Dokumente und Einstellungen\Karli\Desktop\20130408_ZECHMEISTER_7H7R36.pdf
[2013/02/02 11:13:01 | 000,001,883 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\HP Officejet 6100.lnk
[2013/02/02 11:13:01 | 000,000,855 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Shop für Zubehör - HP Officejet 6100.lnk
[2013/02/02 11:12:47 | 000,000,057 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ament.ini
[2013/01/27 06:06:22 | 000,017,767 | ---- | C] () -- C:\Dokumente und Einstellungen\Karli\Desktop\Your_temporary_card.pdf
[2012/09/19 07:05:47 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/09/19 03:40:20 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Karli\defogger_reenable
[2012/07/29 07:13:51 | 000,384,844 | ---- | C] () -- C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\Anwendungsdaten\funmoods-speeddial.crx
[2012/07/29 07:13:50 | 000,031,465 | ---- | C] () -- C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\Anwendungsdaten\funmoods.crx
[2012/06/21 05:20:42 | 000,056,896 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2012/05/10 10:14:19 | 000,000,173 | ---- | C] () -- C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\Anwendungsdaten\msmathematics.qat.Karli
[2012/05/09 10:05:41 | 001,722,880 | ---- | C] () -- C:\Programme\ZuneDesktopTheme.msi
[2012/05/08 12:00:11 | 000,011,264 | ---- | C] () -- C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/06 08:33:51 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\CNMVS3q.DLL
[2012/05/06 07:34:16 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/05/06 05:32:19 | 000,000,135 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2012/05/06 05:32:07 | 000,000,265 | ---- | C] () -- C:\WINDOWS\HCWBlast.ini
[2012/05/06 05:32:01 | 000,037,621 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2012/05/06 05:31:50 | 000,142,337 | ---- | C] () -- C:\WINDOWS\System32\Wait.exe
[2012/05/06 05:30:06 | 000,009,793 | ---- | C] () -- C:\WINDOWS\HCWPNP.INI
[2012/05/06 05:29:17 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2012/05/06 05:25:08 | 000,007,512 | ---- | C] () -- C:\WINDOWS\System32\34CoInstaller.dll
[2012/05/06 04:43:37 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2012/05/06 04:42:33 | 000,269,392 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/05/06 04:35:01 | 000,234,112 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2012/05/06 04:34:59 | 000,234,112 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2012/05/06 04:34:59 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2012/05/06 04:27:10 | 002,195,030 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2012/05/06 04:18:46 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2012/05/06 03:57:15 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2012/05/06 03:53:02 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/03 18:12:38 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/02 07:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2001/08/23 07:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001/08/23 07:00:00 | 000,449,236 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2001/08/23 07:00:00 | 000,432,928 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/08/23 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/23 07:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2001/08/23 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/08/23 07:00:00 | 000,080,550 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2001/08/23 07:00:00 | 000,067,884 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/23 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/08/23 07:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2001/08/23 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/23 07:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/08/23 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
 
========== LOP Check ==========
 
[2012/10/03 10:27:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Funmoods
[2012/10/03 10:27:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Incredibar.com
[2012/05/14 14:54:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Karli\Anwendungsdaten\.minecraft
[2012/05/06 18:19:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Karli\Anwendungsdaten\Opera
[2012/10/13 09:27:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2012/05/06 18:16:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ask
[2012/05/06 05:31:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Hauppauge
[2012/09/28 11:56:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Temp
[2012/05/06 08:11:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2013/02/03 10:31:25 | 000,000,000 | -H-D | M] -- C:\BJPrinter
[2013/02/07 13:32:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2012/05/10 08:12:53 | 000,000,000 | ---D | M] -- C:\Geogebra
[2012/05/06 05:25:00 | 000,000,000 | ---D | M] -- C:\Hauppauge
[2012/05/06 04:02:54 | 000,000,000 | ---D | M] -- C:\Intel
[2012/05/10 08:14:39 | 000,000,000 | ---D | M] -- C:\Microsoft Mathematics
[2012/05/08 10:39:19 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2013/02/02 11:12:50 | 000,000,000 | R--D | M] -- C:\Programme
[2012/09/28 11:56:46 | 000,000,000 | ---D | M] -- C:\Qoobox
[2013/02/07 20:03:10 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2012/09/28 11:56:36 | 000,000,000 | ---D | M] -- C:\RECYCLER(2)
[2012/10/19 14:10:26 | 000,000,000 | ---D | M] -- C:\Set Ups
[2012/05/06 03:59:09 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2013/02/03 10:31:33 | 000,000,000 | ---D | M] -- C:\WINDOWS
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2004/08/03 18:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2012/05/06 06:20:40 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2012/05/06 06:20:40 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004/08/03 18:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2012/05/06 06:20:40 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2012/05/06 06:20:40 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 15:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/03 15:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys
[2004/08/03 15:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008/04/13 21:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 21:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004/08/03 17:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2004/08/03 17:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2008/04/13 21:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
[2008/04/13 21:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2008/04/13 21:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 21:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/03 17:57:32 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008/04/13 21:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 21:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004/08/03 17:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2004/08/03 17:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2008/04/13 21:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008/04/13 21:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008/04/13 21:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 21:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004/08/03 17:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004/08/03 17:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 21:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 21:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2001/08/23 07:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2001/08/23 07:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2012/05/06 05:41:40 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2012/05/06 05:41:40 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2012/05/06 05:41:40 | 000,458,752 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\system32\*.dll /lockedfiles >
[2011/03/03 01:54:43 | 000,149,504 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dnsapi.dll
[2008/04/13 21:22:18 | 000,280,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\mstask.dll
[2008/04/13 21:22:20 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ntdsapi.dll
[2012/10/31 06:33:21 | 001,510,400 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shdocvw.dll
[2012/06/08 09:25:14 | 008,503,808 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shell32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
 
< End of report >

--- --- ---

markusg · 08.02.2013, 12:10

hi
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

Code:

ATTFilter

:OTL
O4 - Startup: C:\Dokumente und Einstellungen\Karli\Startmenü\Programme\Autostart\runctf.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\runctf.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)
[2013/02/07 13:32:19 | 095,023,320 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\iGEXgww.pad
[2013/02/07 13:32:15 | 000,003,155 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\igexgww.js
O2 - BHO: (Funmoods Helper Object) - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} -  File not found
O3 - HKLM\..\Toolbar: (Funmoods Toolbar) - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} -  File not found
O4 - HKLM..\Run: [NWEReboot]  File not found
:Files
C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\temp\wwgXEGi.exe
:Commands
[EMPTYFLASH] 
[emptytemp]

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!

Drücke bitte die

+ E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

Megalodon · 08.02.2013, 17:29

OK vielen Dank!
Ich habe die C:\_OTL\Movedfiles.zip Datei hochgeladen!
Hier noch das logfile dass erschienen is als ich den PC wieder normal gestartet habe!
========== OTL ==========
C:\Dokumente und Einstellungen\Karli\Startmenü\Programme\Autostart\runctf.lnk moved successfully.
File move failed. X:\I386\SYSTEM32\RUNDLL32.EXE scheduled to be moved on reboot.
C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\runctf.lnk moved successfully.
File move failed. X:\I386\SYSTEM32\RUNDLL32.EXE scheduled to be moved on reboot.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\iGEXgww.pad moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\igexgww.js moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NWEReboot deleted successfully.
========== FILES ==========
C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\temp\wwgXEGi.exe moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Karli
->Temp folder emptied: 307196433 bytes
->Temporary Internet Files folder emptied: 247022 bytes
->Java cache emptied: 8639491 bytes
->Google Chrome cache emptied: 235065172 bytes
->Opera cache emptied: 177731089 bytes
->Flash cache emptied: 74069 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33177 bytes
->Flash cache emptied: 492 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

Total Flash Files Cleaned = 695.00 mb

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Karli
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2134333 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2417401 bytes

Total Files Cleaned = 4.00 mb

OTLPE by OldTimer - Version 3.1.48.0 log created on 02082013_171807

Files\Folders moved on Reboot...
File\Folder X:\I386\SYSTEM32\RUNDLL32.EXE not found!

Registry entries deleted on Reboot...

markusg · 08.02.2013, 17:45

sehr gut.
1. Reg file ausführen:
http://download.bleepingcomputer.com...xp/winmgmt.reg
nachfrage bestätigen, neustarten.
2.
download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten
c: öffnen, tdsskiller-datum-version.txt öffnen, Inhalt posten

Megalodon · 09.02.2013, 14:34

Hier ist der report vom tdss killer:

14:29:35.0937 0704 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
14:29:36.0046 0704 ============================================================
14:29:36.0046 0704 Current date / time: 2013/02/09 14:29:36.0046
14:29:36.0046 0704 SystemInfo:
14:29:36.0046 0704
14:29:36.0046 0704 OS Version: 5.1.2600 ServicePack: 3.0
14:29:36.0046 0704 Product type: Workstation
14:29:36.0046 0704 ComputerName: KARLJ
14:29:36.0046 0704 UserName: Karli
14:29:36.0046 0704 Windows directory: C:\WINDOWS
14:29:36.0046 0704 System windows directory: C:\WINDOWS
14:29:36.0046 0704 Processor architecture: Intel x86
14:29:36.0046 0704 Number of processors: 2
14:29:36.0046 0704 Page size: 0x1000
14:29:36.0046 0704 Boot type: Normal boot
14:29:36.0046 0704 ============================================================
14:29:37.0328 0704 Drive \Device\Harddisk0\DR0 - Size: 0x5D27216000 (372.61 Gb), SectorSize: 0x200, Cylinders: 0xBE01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
14:29:37.0328 0704 ============================================================
14:29:37.0328 0704 \Device\Harddisk0\DR0:
14:29:37.0328 0704 MBR partitions:
14:29:37.0328 0704 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4E1EDEC
14:29:37.0343 0704 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x4E1EE6A, BlocksNum 0x14E7BB09
14:29:37.0359 0704 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x19C9A9B2, BlocksNum 0x14C9D30F
14:29:37.0359 0704 ============================================================
14:29:37.0406 0704 C: <-> \Device\Harddisk0\DR0\Partition1
14:29:37.0421 0704 D: <-> \Device\Harddisk0\DR0\Partition2
14:29:37.0500 0704 E: <-> \Device\Harddisk0\DR0\Partition3
14:29:37.0500 0704 ============================================================
14:29:37.0500 0704 Initialize success
14:29:37.0500 0704 ============================================================
14:30:18.0875 1900 ============================================================
14:30:18.0875 1900 Scan started
14:30:18.0875 1900 Mode: Manual; SigCheck; TDLFS;
14:30:18.0875 1900 ============================================================
14:30:19.0109 1900 ================ Scan system memory ========================
14:30:21.0406 1900 System memory - ok
14:30:21.0406 1900 ================ Scan services =============================
14:30:21.0468 1900 Abiosdsk - ok
14:30:21.0468 1900 abp480n5 - ok
14:30:21.0500 1900 [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
14:30:22.0890 1900 ACPI - ok
14:30:22.0921 1900 [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
14:30:23.0046 1900 ACPIEC - ok
14:30:23.0109 1900 [ EC807244904FA170C299AB06D87FBDBE ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
14:30:23.0156 1900 AdobeFlashPlayerUpdateSvc - ok
14:30:23.0156 1900 adpu160m - ok
14:30:23.0171 1900 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
14:30:23.0265 1900 aec - ok
14:30:23.0296 1900 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
14:30:23.0328 1900 AFD - ok
14:30:23.0343 1900 Aha154x - ok
14:30:23.0343 1900 aic78u2 - ok
14:30:23.0343 1900 aic78xx - ok
14:30:23.0375 1900 [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter C:\WINDOWS\system32\alrsvc.dll
14:30:23.0453 1900 Alerter - ok
14:30:23.0468 1900 [ 190CD73D4984F94D823F9444980513E5 ] ALG C:\WINDOWS\System32\alg.exe
14:30:23.0531 1900 ALG - ok
14:30:23.0531 1900 AliIde - ok
14:30:23.0531 1900 amsint - ok
14:30:23.0609 1900 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
14:30:23.0625 1900 Apple Mobile Device - ok
14:30:23.0656 1900 [ D45960BE52C3C610D361977057F98C54 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
14:30:23.0703 1900 AppMgmt - ok
14:30:23.0734 1900 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys
14:30:23.0828 1900 Arp1394 - ok
14:30:23.0828 1900 asc - ok
14:30:23.0828 1900 asc3350p - ok
14:30:23.0828 1900 asc3550 - ok
14:30:23.0890 1900 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
14:30:23.0921 1900 aspnet_state - ok
14:30:23.0953 1900 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
14:30:24.0031 1900 AsyncMac - ok
14:30:24.0046 1900 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
14:30:24.0109 1900 atapi - ok
14:30:24.0109 1900 Atdisk - ok
14:30:24.0125 1900 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
14:30:24.0218 1900 Atmarpc - ok
14:30:24.0234 1900 [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
14:30:24.0312 1900 AudioSrv - ok
14:30:24.0343 1900 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
14:30:24.0421 1900 audstub - ok
14:30:24.0437 1900 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
14:30:24.0531 1900 Beep - ok
14:30:24.0578 1900 [ D6F603772A789BB3228F310D650B8BD1 ] BITS C:\WINDOWS\system32\qmgr.dll
14:30:24.0687 1900 BITS - ok
14:30:24.0734 1900 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Programme\Bonjour\mDNSResponder.exe
14:30:24.0750 1900 Bonjour Service - ok
14:30:24.0781 1900 [ B71549F23736ADF83A571061C47777FD ] Browser C:\WINDOWS\System32\browser.dll
14:30:24.0812 1900 Browser - ok
14:30:24.0843 1900 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
14:30:24.0921 1900 cbidf2k - ok
14:30:24.0937 1900 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
14:30:25.0031 1900 CCDECODE - ok
14:30:25.0078 1900 [ C5F0C1FFF968E9D143F62075CBD8ED60 ] ccEvtMgr C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
14:30:25.0093 1900 ccEvtMgr - ok
14:30:25.0093 1900 [ 324318BD026AA58E3EA8C23647ADE1C3 ] ccSetMgr C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
14:30:25.0109 1900 ccSetMgr - ok
14:30:25.0109 1900 cd20xrnt - ok
14:30:25.0125 1900 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
14:30:25.0218 1900 Cdaudio - ok
14:30:25.0234 1900 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
14:30:25.0312 1900 Cdfs - ok
14:30:25.0312 1900 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
14:30:25.0406 1900 Cdrom - ok
14:30:25.0406 1900 Changer - ok
14:30:25.0437 1900 [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc C:\WINDOWS\system32\cisvc.exe
14:30:25.0531 1900 CiSvc - ok
14:30:25.0531 1900 [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
14:30:25.0625 1900 ClipSrv - ok
14:30:25.0640 1900 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:30:25.0718 1900 clr_optimization_v2.0.50727_32 - ok
14:30:25.0718 1900 CmdIde - ok
14:30:25.0718 1900 COMSysApp - ok
14:30:25.0718 1900 Cpqarray - ok
14:30:25.0734 1900 [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
14:30:25.0828 1900 CryptSvc - ok
14:30:25.0828 1900 dac2w2k - ok
14:30:25.0828 1900 dac960nt - ok
14:30:25.0859 1900 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
14:30:25.0906 1900 DcomLaunch - ok
14:30:25.0953 1900 [ 6A0A8FE766943DE793E6F03F4FE882DD ] DefWatch C:\Programme\Symantec AntiVirus\DefWatch.exe
14:30:25.0953 1900 DefWatch - ok
14:30:25.0984 1900 [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
14:30:26.0062 1900 Dhcp - ok
14:30:26.0078 1900 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
14:30:26.0156 1900 Disk - ok
14:30:26.0156 1900 dmadmin - ok
14:30:26.0187 1900 [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
14:30:26.0312 1900 dmboot - ok
14:30:26.0312 1900 [ 53720AB12B48719D00E327DA470A619A ] dmio C:\WINDOWS\system32\drivers\dmio.sys
14:30:26.0406 1900 dmio - ok
14:30:26.0406 1900 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
14:30:26.0500 1900 dmload - ok
14:30:26.0515 1900 [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver C:\WINDOWS\System32\dmserver.dll
14:30:26.0593 1900 dmserver - ok
14:30:26.0609 1900 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
14:30:26.0703 1900 DMusic - ok
14:30:26.0734 1900 [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
14:30:26.0796 1900 Dnscache - ok
14:30:26.0828 1900 [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
14:30:26.0890 1900 Dot3svc - ok
14:30:26.0906 1900 dpti2o - ok
14:30:26.0906 1900 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
14:30:26.0984 1900 drmkaud - ok
14:30:27.0015 1900 [ 6DE32A9123EF60F9D423E9163AF0E305 ] e1express C:\WINDOWS\system32\DRIVERS\e1e5132.sys
14:30:27.0187 1900 e1express - ok
14:30:27.0218 1900 [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost C:\WINDOWS\System32\eapsvc.dll
14:30:27.0296 1900 EapHost - ok
14:30:27.0343 1900 [ 85B8B4032A895A746D46A288A9B30DED ] eeCtrl C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
14:30:27.0375 1900 eeCtrl - ok
14:30:27.0406 1900 [ B5A8A04A6E5B4E86B95B1553AA918F5F ] EraserUtilRebootDrv C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
14:30:27.0421 1900 EraserUtilRebootDrv - ok
14:30:27.0437 1900 [ 877C18558D70587AA7823A1A308AC96B ] ERSvc C:\WINDOWS\System32\ersvc.dll
14:30:27.0531 1900 ERSvc - ok
14:30:27.0562 1900 [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog C:\WINDOWS\system32\services.exe
14:30:27.0593 1900 Eventlog - ok
14:30:27.0625 1900 [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem C:\WINDOWS\system32\es.dll
14:30:27.0656 1900 EventSystem - ok
14:30:27.0703 1900 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
14:30:27.0796 1900 Fastfat - ok
14:30:27.0843 1900 [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
14:30:27.0859 1900 FastUserSwitchingCompatibility - ok
14:30:27.0875 1900 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
14:30:27.0953 1900 Fdc - ok
14:30:27.0968 1900 [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
14:30:28.0031 1900 Fips - ok
14:30:28.0046 1900 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
14:30:28.0140 1900 Flpydisk - ok
14:30:28.0156 1900 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
14:30:28.0234 1900 FltMgr - ok
14:30:28.0265 1900 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
14:30:28.0281 1900 FontCache3.0.0.0 - ok
14:30:28.0296 1900 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
14:30:28.0375 1900 Fs_Rec - ok
14:30:28.0390 1900 [ 8F1955CE42E1484714B542F341647778 ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
14:30:28.0468 1900 Ftdisk - ok
14:30:28.0484 1900 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
14:30:28.0500 1900 GEARAspiWDM - ok
14:30:28.0500 1900 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
14:30:28.0593 1900 Gpc - ok
14:30:28.0625 1900 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Programme\Google\Update\GoogleUpdate.exe
14:30:28.0640 1900 gupdate - ok
14:30:28.0656 1900 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Programme\Google\Update\GoogleUpdate.exe
14:30:28.0656 1900 gupdatem - ok
14:30:28.0718 1900 [ 7AB80F7CB53875301742E67775AFDBD3 ] HauppaugeTVServer C:\Programme\WinTV\TVServer\HauppaugeTVServer.exe
14:30:28.0750 1900 HauppaugeTVServer ( UnsignedFile.Multi.Generic ) - warning
14:30:28.0750 1900 HauppaugeTVServer - detected UnsignedFile.Multi.Generic (1)
14:30:28.0812 1900 [ 8CA93EF1AEFC7EF6A751E2BC8C35184F ] HCW713x C:\WINDOWS\system32\DRIVERS\HCW713x.sys
14:30:28.0843 1900 HCW713x - ok
14:30:28.0859 1900 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
14:30:28.0968 1900 HDAudBus - ok
14:30:29.0046 1900 [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
14:30:29.0125 1900 helpsvc - ok
14:30:29.0140 1900 [ B35DA85E60C0103F2E4104532DA2F12B ] HidServ C:\WINDOWS\System32\hidserv.dll
14:30:29.0218 1900 HidServ - ok
14:30:29.0234 1900 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys
14:30:29.0312 1900 hidusb - ok
14:30:29.0343 1900 [ ED29F14101523A6E0E808107405D452C ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
14:30:29.0421 1900 hkmsvc - ok
14:30:29.0421 1900 hpn - ok
14:30:29.0453 1900 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
14:30:29.0500 1900 HTTP - ok
14:30:29.0515 1900 [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
14:30:29.0593 1900 HTTPFilter - ok
14:30:29.0593 1900 i2omgmt - ok
14:30:29.0593 1900 i2omp - ok
14:30:29.0625 1900 [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt C:\WINDOWS\system32\drivers\i8042prt.sys
14:30:29.0718 1900 i8042prt - ok
14:30:29.0750 1900 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
14:30:29.0796 1900 idsvc - ok
14:30:29.0828 1900 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
14:30:29.0921 1900 Imapi - ok
14:30:30.0015 1900 [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService C:\WINDOWS\system32\imapi.exe
14:30:30.0093 1900 ImapiService - ok
14:30:30.0093 1900 ini910u - ok
14:30:30.0093 1900 IntelIde - ok
14:30:30.0109 1900 [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
14:30:30.0187 1900 intelppm - ok
14:30:30.0187 1900 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
14:30:30.0281 1900 Ip6Fw - ok
14:30:30.0312 1900 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
14:30:30.0390 1900 IpFilterDriver - ok
14:30:30.0406 1900 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
14:30:30.0484 1900 IpInIp - ok
14:30:30.0500 1900 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
14:30:30.0593 1900 IpNat - ok
14:30:30.0640 1900 [ BC0EA61246F8D940FBC5F652D337D6BD ] iPod Service C:\Programme\iPod\bin\iPodService.exe
14:30:30.0671 1900 iPod Service - ok
14:30:30.0703 1900 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
14:30:30.0781 1900 IPSec - ok
14:30:30.0781 1900 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
14:30:30.0828 1900 IRENUM - ok
14:30:30.0859 1900 [ 6DFB88F64135C525433E87648BDA30DE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
14:30:30.0937 1900 isapnp - ok
14:30:31.0015 1900 [ B591E761161D1EF547D76EF236EAA6A5 ] JavaQuickStarterService C:\Programme\Java\jre7\bin\jqs.exe
14:30:31.0031 1900 JavaQuickStarterService - ok
14:30:31.0046 1900 [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
14:30:31.0125 1900 Kbdclass - ok
14:30:31.0140 1900 [ B6D6C117D771C98130497265F26D1882 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
14:30:31.0234 1900 kbdhid - ok
14:30:31.0250 1900 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
14:30:31.0328 1900 kmixer - ok
14:30:31.0343 1900 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
14:30:31.0375 1900 KSecDD - ok
14:30:31.0406 1900 [ 2BBDCB79900990F0716DFCB714E72DE7 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
14:30:31.0437 1900 lanmanserver - ok
14:30:31.0484 1900 [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
14:30:31.0515 1900 lanmanworkstation - ok
14:30:31.0515 1900 lbrtfdc - ok
14:30:31.0609 1900 [ 89BFFB6A09652DA7D019A387354D0D19 ] LiveUpdate C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
14:30:31.0671 1900 LiveUpdate - ok
14:30:31.0703 1900 [ 636714B7D43C8D0C80449123FD266920 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
14:30:31.0781 1900 LmHosts - ok
14:30:31.0796 1900 [ B7550A7107281D170CE85524B1488C98 ] Messenger C:\WINDOWS\System32\msgsvc.dll
14:30:31.0890 1900 Messenger - ok
14:30:31.0937 1900 Microsoft SharePoint Workspace Audit Service - ok
14:30:31.0953 1900 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
14:30:32.0031 1900 mnmdd - ok
14:30:32.0093 1900 [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
14:30:32.0187 1900 mnmsrvc - ok
14:30:32.0203 1900 [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
14:30:32.0281 1900 Modem - ok
14:30:32.0281 1900 [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
14:30:32.0375 1900 Mouclass - ok
14:30:32.0390 1900 [ 66A6F73C74E1791464160A7065CE711A ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
14:30:32.0468 1900 mouhid - ok
14:30:32.0500 1900 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
14:30:32.0562 1900 MountMgr - ok
14:30:32.0593 1900 [ C0F8E0C2C3C0437CF37C6781896DC3EC ] MPE C:\WINDOWS\system32\DRIVERS\MPE.sys
14:30:32.0656 1900 MPE - ok
14:30:32.0671 1900 mraid35x - ok
14:30:32.0671 1900 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
14:30:32.0750 1900 MRxDAV - ok
14:30:32.0781 1900 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
14:30:32.0843 1900 MRxSmb - ok
14:30:32.0859 1900 [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC C:\WINDOWS\system32\msdtc.exe
14:30:32.0937 1900 MSDTC - ok
14:30:32.0937 1900 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
14:30:33.0031 1900 Msfs - ok
14:30:33.0031 1900 MSIServer - ok
14:30:33.0031 1900 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
14:30:33.0109 1900 MSKSSRV - ok
14:30:33.0125 1900 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
14:30:33.0203 1900 MSPCLOCK - ok
14:30:33.0218 1900 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
14:30:33.0312 1900 MSPQM - ok
14:30:33.0312 1900 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
14:30:33.0390 1900 mssmbios - ok
14:30:33.0390 1900 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
14:30:33.0468 1900 MSTEE - ok
14:30:33.0468 1900 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
14:30:33.0515 1900 Mup - ok
14:30:33.0531 1900 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
14:30:33.0609 1900 NABTSFEC - ok
14:30:33.0640 1900 [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent C:\WINDOWS\System32\qagentrt.dll
14:30:33.0734 1900 napagent - ok
14:30:33.0812 1900 [ 7D7A3BC6640C1A0D1442816B30856928 ] NAVENG C:\PROGRA~1\GEMEIN~1\SYMANT~1\VIRUSD~1\20130207.004\naveng.sys
14:30:33.0812 1900 NAVENG - ok
14:30:33.0859 1900 [ 28494C43D62AA7584BDCA2FADFBC4D11 ] NAVEX15 C:\PROGRA~1\GEMEIN~1\SYMANT~1\VIRUSD~1\20130207.004\navex15.sys
14:30:33.0906 1900 NAVEX15 - ok
14:30:33.0921 1900 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
14:30:34.0015 1900 NDIS - ok
14:30:34.0046 1900 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
14:30:34.0156 1900 NdisIP - ok
14:30:34.0171 1900 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
14:30:34.0203 1900 NdisTapi - ok
14:30:34.0234 1900 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
14:30:34.0312 1900 Ndisuio - ok
14:30:34.0328 1900 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
14:30:34.0406 1900 NdisWan - ok
14:30:34.0437 1900 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
14:30:34.0468 1900 NDProxy - ok
14:30:34.0484 1900 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
14:30:34.0578 1900 NetBIOS - ok
14:30:34.0593 1900 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
14:30:34.0687 1900 NetBT - ok
14:30:34.0718 1900 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE C:\WINDOWS\system32\netdde.exe
14:30:34.0812 1900 NetDDE - ok
14:30:34.0812 1900 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
14:30:34.0875 1900 NetDDEdsdm - ok
14:30:34.0906 1900 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon C:\WINDOWS\system32\lsass.exe
14:30:34.0984 1900 Netlogon - ok
14:30:35.0000 1900 [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman C:\WINDOWS\System32\netman.dll
14:30:35.0093 1900 Netman - ok
14:30:35.0093 1900 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
14:30:35.0125 1900 NetTcpPortSharing - ok
14:30:35.0140 1900 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys
14:30:35.0234 1900 NIC1394 - ok
14:30:35.0250 1900 [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla C:\WINDOWS\System32\mswsock.dll
14:30:35.0281 1900 Nla - ok
14:30:35.0296 1900 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
14:30:35.0359 1900 Npfs - ok
14:30:35.0390 1900 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
14:30:35.0484 1900 Ntfs - ok
14:30:35.0484 1900 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
14:30:35.0562 1900 NtLmSsp - ok
14:30:35.0593 1900 [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
14:30:35.0703 1900 NtmsSvc - ok
14:30:35.0718 1900 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
14:30:35.0781 1900 Null - ok
14:30:36.0031 1900 [ CF8097AEA6438CDDCF4266DF1C0934E3 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
14:30:36.0328 1900 nv - ok
14:30:36.0359 1900 [ F4AC9545A864A7B7A2562681726EB2D3 ] nvsvc C:\WINDOWS\system32\nvsvc32.exe
14:30:36.0359 1900 nvsvc - ok
14:30:36.0390 1900 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
14:30:36.0468 1900 NwlnkFlt - ok
14:30:36.0484 1900 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
14:30:36.0562 1900 NwlnkFwd - ok
14:30:36.0609 1900 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys
14:30:36.0687 1900 ohci1394 - ok
14:30:36.0734 1900 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
14:30:36.0765 1900 ose - ok
14:30:36.0937 1900 [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
14:30:37.0093 1900 osppsvc - ok
14:30:37.0125 1900 [ F84785660305B9B903FB3BCA8BA29837 ] Parport C:\WINDOWS\system32\drivers\Parport.sys
14:30:37.0203 1900 Parport - ok
14:30:37.0234 1900 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
14:30:37.0328 1900 PartMgr - ok
14:30:37.0343 1900 [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
14:30:37.0437 1900 ParVdm - ok
14:30:37.0437 1900 [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
14:30:37.0515 1900 PCI - ok
14:30:37.0515 1900 PCIDump - ok
14:30:37.0546 1900 [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
14:30:37.0625 1900 PCIIde - ok
14:30:37.0625 1900 [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
14:30:37.0718 1900 Pcmcia - ok
14:30:37.0734 1900 PDCOMP - ok
14:30:37.0734 1900 PDFRAME - ok
14:30:37.0734 1900 PDRELI - ok
14:30:37.0734 1900 PDRFRAME - ok
14:30:37.0734 1900 perc2 - ok
14:30:37.0734 1900 perc2hib - ok
14:30:37.0750 1900 [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay C:\WINDOWS\system32\services.exe
14:30:37.0765 1900 PlugPlay - ok
14:30:37.0781 1900 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
14:30:37.0843 1900 PolicyAgent - ok
14:30:37.0859 1900 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
14:30:37.0937 1900 PptpMiniport - ok
14:30:37.0953 1900 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
14:30:38.0015 1900 ProtectedStorage - ok
14:30:38.0015 1900 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
14:30:38.0093 1900 PSched - ok
14:30:38.0109 1900 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
14:30:38.0203 1900 Ptilink - ok
14:30:38.0203 1900 ql1080 - ok
14:30:38.0203 1900 Ql10wnt - ok
14:30:38.0203 1900 ql12160 - ok
14:30:38.0203 1900 ql1240 - ok
14:30:38.0203 1900 ql1280 - ok
14:30:38.0234 1900 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
14:30:38.0312 1900 RasAcd - ok
14:30:38.0343 1900 [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto C:\WINDOWS\System32\rasauto.dll
14:30:38.0421 1900 RasAuto - ok
14:30:38.0437 1900 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
14:30:38.0500 1900 Rasl2tp - ok
14:30:38.0546 1900 [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan C:\WINDOWS\System32\rasmans.dll
14:30:38.0625 1900 RasMan - ok
14:30:38.0625 1900 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
14:30:38.0718 1900 RasPppoe - ok
14:30:38.0718 1900 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
14:30:38.0796 1900 Raspti - ok
14:30:38.0812 1900 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
14:30:38.0906 1900 Rdbss - ok
14:30:38.0906 1900 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
14:30:38.0984 1900 RDPCDD - ok
14:30:39.0000 1900 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
14:30:39.0093 1900 rdpdr - ok
14:30:39.0109 1900 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
14:30:39.0140 1900 RDPWD - ok
14:30:39.0156 1900 [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
14:30:39.0250 1900 RDSessMgr - ok
14:30:39.0265 1900 [ ED761D453856F795A7FE056E42C36365 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
14:30:39.0343 1900 redbook - ok
14:30:39.0359 1900 [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
14:30:39.0437 1900 RemoteAccess - ok
14:30:39.0468 1900 [ E4CD1F3D84E1C2CA0B8CF7501E201593 ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
14:30:39.0531 1900 RemoteRegistry - ok
14:30:39.0609 1900 [ 8CFCA7E2FD4B57C2BEF929C1C1A4C56E ] RichVideo C:\Programme\CyberLink\Shared files\RichVideo.exe
14:30:39.0625 1900 RichVideo - ok
14:30:39.0640 1900 [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator C:\WINDOWS\system32\locator.exe
14:30:39.0734 1900 RpcLocator - ok
14:30:39.0750 1900 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs C:\WINDOWS\system32\rpcss.dll
14:30:39.0765 1900 RpcSs - ok
14:30:39.0796 1900 [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP C:\WINDOWS\system32\rsvp.exe
14:30:39.0875 1900 RSVP - ok
14:30:39.0890 1900 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs C:\WINDOWS\system32\lsass.exe
14:30:39.0968 1900 SamSs - ok
14:30:40.0000 1900 [ 0DE5CE2C919E4371C1FCED0196086E3E ] SavRoam C:\Programme\Symantec AntiVirus\SavRoam.exe
14:30:40.0015 1900 SavRoam - ok
14:30:40.0031 1900 [ CDB565C093B0105086CC630B32F9E6E6 ] SAVRT C:\Programme\Symantec AntiVirus\savrt.sys
14:30:40.0046 1900 SAVRT - ok
14:30:40.0078 1900 [ 1042CB5A003F9AED8D6CEC56A0FC6C49 ] SAVRTPEL C:\Programme\Symantec AntiVirus\Savrtpel.sys
14:30:40.0078 1900 SAVRTPEL - ok
14:30:40.0125 1900 [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
14:30:40.0203 1900 SCardSvr - ok
14:30:40.0234 1900 [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule C:\WINDOWS\system32\schedsvc.dll
14:30:40.0312 1900 Schedule - ok
14:30:40.0359 1900 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
14:30:40.0390 1900 Secdrv - ok
14:30:40.0421 1900 [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon C:\WINDOWS\System32\seclogon.dll
14:30:40.0500 1900 seclogon - ok
14:30:40.0531 1900 [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS C:\WINDOWS\system32\sens.dll
14:30:40.0609 1900 SENS - ok
14:30:40.0625 1900 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] Serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
14:30:40.0703 1900 Serenum - ok
14:30:40.0718 1900 [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
14:30:40.0796 1900 Serial - ok
14:30:40.0796 1900 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
14:30:40.0875 1900 Sfloppy - ok
14:30:40.0921 1900 [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
14:30:41.0000 1900 SharedAccess - ok
14:30:41.0015 1900 [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
14:30:41.0031 1900 ShellHWDetection - ok
14:30:41.0031 1900 Simbad - ok
14:30:41.0046 1900 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
14:30:41.0140 1900 SLIP - ok
14:30:41.0156 1900 [ C5F415BB02EE89CDE1B6CEE3538F424B ] SNDSrvc C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
14:30:41.0187 1900 SNDSrvc - ok
14:30:41.0187 1900 Sparrow - ok
14:30:41.0203 1900 [ CC22BF5631C4837ABCD81D75DE8FB1AA ] SPBBCDrv C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCDrv.sys
14:30:41.0218 1900 SPBBCDrv - ok
14:30:41.0250 1900 [ DABD8523D9B60CE6513653DFD8B96C1B ] SPBBCSvc C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
14:30:41.0281 1900 SPBBCSvc - ok
14:30:41.0312 1900 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
14:30:41.0390 1900 splitter - ok
14:30:41.0421 1900 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
14:30:41.0468 1900 Spooler - ok
14:30:41.0515 1900 [ 50FA898F8C032796D3B1B9951BB5A90F ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
14:30:41.0562 1900 sr - ok
14:30:41.0593 1900 [ FE77A85495065F3AD59C5C65B6C54182 ] srservice C:\WINDOWS\system32\srsvc.dll
14:30:41.0656 1900 srservice - ok
14:30:41.0671 1900 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
14:30:41.0734 1900 Srv - ok
14:30:41.0750 1900 [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
14:30:41.0781 1900 SSDPSRV - ok
14:30:41.0859 1900 [ C5003D42CC88C1F5D54ED9AF28D6ED7B ] STacSV c:\programme\idt\intelxpv_v103\wdm\STacSV.exe
14:30:41.0890 1900 STacSV - ok
14:30:41.0953 1900 [ 228519217A88C2F6B0CF8C022E6D669C ] STHDA C:\WINDOWS\system32\drivers\sthda.sys
14:30:42.0000 1900 STHDA - ok
14:30:42.0015 1900 [ BC2C5985611C5356B24AEB370953DED9 ] stisvc C:\WINDOWS\system32\wiaservc.dll
14:30:42.0125 1900 stisvc - ok
14:30:42.0156 1900 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
14:30:42.0250 1900 streamip - ok
14:30:42.0265 1900 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
14:30:42.0343 1900 swenum - ok
14:30:42.0359 1900 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
14:30:42.0437 1900 swmidi - ok
14:30:42.0437 1900 SwPrv - ok
14:30:42.0500 1900 [ 8B3550214824ABF244D1E27E2A300990 ] Symantec AntiVirus C:\Programme\Symantec AntiVirus\Rtvscan.exe
14:30:42.0546 1900 Symantec AntiVirus - ok
14:30:42.0546 1900 symc810 - ok
14:30:42.0546 1900 symc8xx - ok
14:30:42.0578 1900 [ 5156F63E684E8C864FF40E40D5309F41 ] SymEvent C:\Programme\Symantec\SYMEVENT.SYS
14:30:42.0593 1900 SymEvent - ok
14:30:42.0609 1900 [ 5314E345DFC068504CFB2676D3B2CA39 ] SYMREDRV C:\WINDOWS\System32\Drivers\SYMREDRV.SYS
14:30:42.0625 1900 SYMREDRV - ok
14:30:42.0640 1900 [ 8CD0A1478256240249B8EE88E6F25E94 ] SYMTDI C:\WINDOWS\System32\Drivers\SYMTDI.SYS
14:30:42.0656 1900 SYMTDI - ok
14:30:42.0656 1900 sym_hi - ok
14:30:42.0656 1900 sym_u3 - ok
14:30:42.0671 1900 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
14:30:42.0750 1900 sysaudio - ok
14:30:42.0765 1900 [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
14:30:42.0859 1900 SysmonLog - ok
14:30:42.0875 1900 [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
14:30:42.0953 1900 TapiSrv - ok
14:30:42.0984 1900 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
14:30:43.0015 1900 Tcpip - ok
14:30:43.0031 1900 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
14:30:43.0140 1900 TDPIPE - ok
14:30:43.0156 1900 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
14:30:43.0234 1900 TDTCP - ok
14:30:43.0265 1900 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
14:30:43.0343 1900 TermDD - ok
14:30:43.0359 1900 [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService C:\WINDOWS\System32\termsrv.dll
14:30:43.0437 1900 TermService - ok
14:30:43.0453 1900 [ 2DB7D303C36DDD055215052F118E8E75 ] Themes C:\WINDOWS\System32\shsvcs.dll
14:30:43.0468 1900 Themes - ok
14:30:43.0500 1900 [ 03681A1CE77F51586903869A5AB1DEAB ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
14:30:43.0562 1900 TlntSvr - ok
14:30:43.0562 1900 TosIde - ok
14:30:43.0578 1900 [ 626504572B175867F30F3215C04B3E2F ] TrkWks C:\WINDOWS\system32\trkwks.dll
14:30:43.0656 1900 TrkWks - ok
14:30:43.0671 1900 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
14:30:43.0765 1900 Udfs - ok
14:30:43.0765 1900 ultra - ok
14:30:43.0796 1900 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
14:30:43.0921 1900 Update - ok
14:30:43.0953 1900 [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost C:\WINDOWS\System32\upnphost.dll
14:30:44.0015 1900 upnphost - ok
14:30:44.0031 1900 [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS C:\WINDOWS\System32\ups.exe
14:30:44.0109 1900 UPS - ok
14:30:44.0140 1900 [ 73B41F4EAD65F355962168D766AF0F2E ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys
14:30:44.0187 1900 USBAAPL - ok
14:30:44.0203 1900 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
14:30:44.0296 1900 usbccgp - ok
14:30:44.0328 1900 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
14:30:44.0406 1900 usbehci - ok
14:30:44.0437 1900 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
14:30:44.0515 1900 usbhub - ok
14:30:44.0546 1900 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
14:30:44.0640 1900 usbscan - ok
14:30:44.0640 1900 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
14:30:44.0734 1900 usbstor - ok
14:30:44.0750 1900 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
14:30:44.0812 1900 usbuhci - ok
14:30:44.0828 1900 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
14:30:44.0906 1900 VgaSave - ok
14:30:44.0906 1900 ViaIde - ok
14:30:44.0921 1900 [ A5A712F4E880874A477AF790B5186E1D ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
14:30:45.0000 1900 VolSnap - ok
14:30:45.0015 1900 [ 68F106273BE29E7B7EF8266977268E78 ] VSS C:\WINDOWS\System32\vssvc.exe
14:30:45.0062 1900 VSS - ok
14:30:45.0078 1900 [ 7B353059E665F8B7AD2BBEAEF597CF45 ] W32Time C:\WINDOWS\system32\w32time.dll
14:30:45.0140 1900 W32Time - ok
14:30:45.0156 1900 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
14:30:45.0234 1900 Wanarp - ok
14:30:45.0234 1900 WDICA - ok
14:30:45.0281 1900 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
14:30:45.0343 1900 wdmaud - ok
14:30:45.0390 1900 [ EBFFE98048709C7CC7A6F6C36C7DE61B ] Web Assistant Updater C:\Programme\Web Assistant\ExtensionUpdaterService.exe
14:30:45.0406 1900 Web Assistant Updater ( UnsignedFile.Multi.Generic ) - warning
14:30:45.0406 1900 Web Assistant Updater - detected UnsignedFile.Multi.Generic (1)
14:30:45.0421 1900 [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient C:\WINDOWS\System32\webclnt.dll
14:30:45.0515 1900 WebClient - ok
14:30:45.0578 1900 [ 6F3F3973D97714CC5F906A19FE883729 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
14:30:45.0656 1900 winmgmt - ok
14:30:45.0687 1900 [ 051B1BDECD6DEE18C771B5D5EC7F044D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
14:30:45.0750 1900 WmdmPmSN - ok
14:30:45.0781 1900 [ FFA4D901D46D07A5BAB2D8307FBB51A6 ] Wmi C:\WINDOWS\System32\advapi32.dll
14:30:45.0812 1900 Wmi - ok
14:30:45.0828 1900 [ 93908111BA57A6E60EC2FA2DE202105C ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
14:30:45.0906 1900 WmiApSrv - ok
14:30:45.0953 1900 [ D3DBD6E76F4BE9BEE67EB631488B5F29 ] WMPNetworkSvc C:\Programme\Windows Media Player\WMPNetwk.exe
14:30:46.0000 1900 WMPNetworkSvc - ok
14:30:46.0031 1900 [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc C:\WINDOWS\system32\wscsvc.dll
14:30:46.0109 1900 wscsvc - ok
14:30:46.0125 1900 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
14:30:46.0218 1900 WSTCODEC - ok
14:30:46.0234 1900 [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
14:30:46.0312 1900 wuauserv - ok
14:30:46.0328 1900 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
14:30:46.0359 1900 WudfPf - ok
14:30:46.0390 1900 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
14:30:46.0406 1900 WudfRd - ok
14:30:46.0421 1900 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
14:30:46.0453 1900 WudfSvc - ok
14:30:46.0500 1900 [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
14:30:46.0578 1900 WZCSVC - ok
14:30:46.0593 1900 [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
14:30:46.0687 1900 xmlprov - ok
14:30:46.0687 1900 ================ Scan global ===============================
14:30:46.0718 1900 [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll
14:30:46.0750 1900 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
14:30:46.0750 1900 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
14:30:46.0765 1900 [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe
14:30:46.0781 1900 [Global] - ok
14:30:46.0781 1900 ================ Scan MBR ==================================
14:30:46.0781 1900 [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk0\DR0
14:30:47.0093 1900 \Device\Harddisk0\DR0 - ok
14:30:47.0093 1900 ================ Scan VBR ==================================
14:30:47.0093 1900 [ 89B7105B135DDFF26DC11F150554F40A ] \Device\Harddisk0\DR0\Partition1
14:30:47.0093 1900 \Device\Harddisk0\DR0\Partition1 - ok
14:30:47.0125 1900 [ C736652EAE5A6D9D2A2BE82EE2E1C452 ] \Device\Harddisk0\DR0\Partition2
14:30:47.0125 1900 \Device\Harddisk0\DR0\Partition2 - ok
14:30:47.0140 1900 [ A3551C346BFA2F17C25321DE89FDF860 ] \Device\Harddisk0\DR0\Partition3
14:30:47.0140 1900 \Device\Harddisk0\DR0\Partition3 - ok
14:30:47.0140 1900 ============================================================
14:30:47.0140 1900 Scan finished
14:30:47.0140 1900 ============================================================
14:30:47.0250 2304 Detected object count: 2
14:30:47.0250 2304 Actual detected object count: 2
14:30:53.0828 2304 HauppaugeTVServer ( UnsignedFile.Multi.Generic ) - skipped by user
14:30:53.0828 2304 HauppaugeTVServer ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:30:53.0828 2304 Web Assistant Updater ( UnsignedFile.Multi.Generic ) - skipped by user
14:30:53.0828 2304 Web Assistant Updater ( UnsignedFile.Multi.Generic ) - User select action: Skip

Und hier ist das .txt Dokument

14:29:35.0937 0704 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
14:29:36.0046 0704 ============================================================
14:29:36.0046 0704 Current date / time: 2013/02/09 14:29:36.0046
14:29:36.0046 0704 SystemInfo:
14:29:36.0046 0704
14:29:36.0046 0704 OS Version: 5.1.2600 ServicePack: 3.0
14:29:36.0046 0704 Product type: Workstation
14:29:36.0046 0704 ComputerName: KARLJ
14:29:36.0046 0704 UserName: Karli
14:29:36.0046 0704 Windows directory: C:\WINDOWS
14:29:36.0046 0704 System windows directory: C:\WINDOWS
14:29:36.0046 0704 Processor architecture: Intel x86
14:29:36.0046 0704 Number of processors: 2
14:29:36.0046 0704 Page size: 0x1000
14:29:36.0046 0704 Boot type: Normal boot
14:29:36.0046 0704 ============================================================
14:29:37.0328 0704 Drive \Device\Harddisk0\DR0 - Size: 0x5D27216000 (372.61 Gb), SectorSize: 0x200, Cylinders: 0xBE01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
14:29:37.0328 0704 ============================================================
14:29:37.0328 0704 \Device\Harddisk0\DR0:
14:29:37.0328 0704 MBR partitions:
14:29:37.0328 0704 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4E1EDEC
14:29:37.0343 0704 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x4E1EE6A, BlocksNum 0x14E7BB09
14:29:37.0359 0704 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x19C9A9B2, BlocksNum 0x14C9D30F
14:29:37.0359 0704 ============================================================
14:29:37.0406 0704 C: <-> \Device\Harddisk0\DR0\Partition1
14:29:37.0421 0704 D: <-> \Device\Harddisk0\DR0\Partition2
14:29:37.0500 0704 E: <-> \Device\Harddisk0\DR0\Partition3
14:29:37.0500 0704 ============================================================
14:29:37.0500 0704 Initialize success
14:29:37.0500 0704 ============================================================
14:30:18.0875 1900 ============================================================
14:30:18.0875 1900 Scan started
14:30:18.0875 1900 Mode: Manual; SigCheck; TDLFS;
14:30:18.0875 1900 ============================================================
14:30:19.0109 1900 ================ Scan system memory ========================
14:30:21.0406 1900 System memory - ok
14:30:21.0406 1900 ================ Scan services =============================
14:30:21.0468 1900 Abiosdsk - ok
14:30:21.0468 1900 abp480n5 - ok
14:30:21.0500 1900 [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
14:30:22.0890 1900 ACPI - ok
14:30:22.0921 1900 [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
14:30:23.0046 1900 ACPIEC - ok
14:30:23.0109 1900 [ EC807244904FA170C299AB06D87FBDBE ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
14:30:23.0156 1900 AdobeFlashPlayerUpdateSvc - ok
14:30:23.0156 1900 adpu160m - ok
14:30:23.0171 1900 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
14:30:23.0265 1900 aec - ok
14:30:23.0296 1900 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
14:30:23.0328 1900 AFD - ok
14:30:23.0343 1900 Aha154x - ok
14:30:23.0343 1900 aic78u2 - ok
14:30:23.0343 1900 aic78xx - ok
14:30:23.0375 1900 [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter C:\WINDOWS\system32\alrsvc.dll
14:30:23.0453 1900 Alerter - ok
14:30:23.0468 1900 [ 190CD73D4984F94D823F9444980513E5 ] ALG C:\WINDOWS\System32\alg.exe
14:30:23.0531 1900 ALG - ok
14:30:23.0531 1900 AliIde - ok
14:30:23.0531 1900 amsint - ok
14:30:23.0609 1900 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
14:30:23.0625 1900 Apple Mobile Device - ok
14:30:23.0656 1900 [ D45960BE52C3C610D361977057F98C54 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
14:30:23.0703 1900 AppMgmt - ok
14:30:23.0734 1900 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys
14:30:23.0828 1900 Arp1394 - ok
14:30:23.0828 1900 asc - ok
14:30:23.0828 1900 asc3350p - ok
14:30:23.0828 1900 asc3550 - ok
14:30:23.0890 1900 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
14:30:23.0921 1900 aspnet_state - ok
14:30:23.0953 1900 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
14:30:24.0031 1900 AsyncMac - ok
14:30:24.0046 1900 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
14:30:24.0109 1900 atapi - ok
14:30:24.0109 1900 Atdisk - ok
14:30:24.0125 1900 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
14:30:24.0218 1900 Atmarpc - ok
14:30:24.0234 1900 [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
14:30:24.0312 1900 AudioSrv - ok
14:30:24.0343 1900 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
14:30:24.0421 1900 audstub - ok
14:30:24.0437 1900 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
14:30:24.0531 1900 Beep - ok
14:30:24.0578 1900 [ D6F603772A789BB3228F310D650B8BD1 ] BITS C:\WINDOWS\system32\qmgr.dll
14:30:24.0687 1900 BITS - ok
14:30:24.0734 1900 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Programme\Bonjour\mDNSResponder.exe
14:30:24.0750 1900 Bonjour Service - ok
14:30:24.0781 1900 [ B71549F23736ADF83A571061C47777FD ] Browser C:\WINDOWS\System32\browser.dll
14:30:24.0812 1900 Browser - ok
14:30:24.0843 1900 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
14:30:24.0921 1900 cbidf2k - ok
14:30:24.0937 1900 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
14:30:25.0031 1900 CCDECODE - ok
14:30:25.0078 1900 [ C5F0C1FFF968E9D143F62075CBD8ED60 ] ccEvtMgr C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
14:30:25.0093 1900 ccEvtMgr - ok
14:30:25.0093 1900 [ 324318BD026AA58E3EA8C23647ADE1C3 ] ccSetMgr C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
14:30:25.0109 1900 ccSetMgr - ok
14:30:25.0109 1900 cd20xrnt - ok
14:30:25.0125 1900 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
14:30:25.0218 1900 Cdaudio - ok
14:30:25.0234 1900 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
14:30:25.0312 1900 Cdfs - ok
14:30:25.0312 1900 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
14:30:25.0406 1900 Cdrom - ok
14:30:25.0406 1900 Changer - ok
14:30:25.0437 1900 [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc C:\WINDOWS\system32\cisvc.exe
14:30:25.0531 1900 CiSvc - ok
14:30:25.0531 1900 [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
14:30:25.0625 1900 ClipSrv - ok
14:30:25.0640 1900 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:30:25.0718 1900 clr_optimization_v2.0.50727_32 - ok
14:30:25.0718 1900 CmdIde - ok
14:30:25.0718 1900 COMSysApp - ok
14:30:25.0718 1900 Cpqarray - ok
14:30:25.0734 1900 [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
14:30:25.0828 1900 CryptSvc - ok
14:30:25.0828 1900 dac2w2k - ok
14:30:25.0828 1900 dac960nt - ok
14:30:25.0859 1900 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
14:30:25.0906 1900 DcomLaunch - ok
14:30:25.0953 1900 [ 6A0A8FE766943DE793E6F03F4FE882DD ] DefWatch C:\Programme\Symantec AntiVirus\DefWatch.exe
14:30:25.0953 1900 DefWatch - ok
14:30:25.0984 1900 [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
14:30:26.0062 1900 Dhcp - ok
14:30:26.0078 1900 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
14:30:26.0156 1900 Disk - ok
14:30:26.0156 1900 dmadmin - ok
14:30:26.0187 1900 [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
14:30:26.0312 1900 dmboot - ok
14:30:26.0312 1900 [ 53720AB12B48719D00E327DA470A619A ] dmio C:\WINDOWS\system32\drivers\dmio.sys
14:30:26.0406 1900 dmio - ok
14:30:26.0406 1900 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
14:30:26.0500 1900 dmload - ok
14:30:26.0515 1900 [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver C:\WINDOWS\System32\dmserver.dll
14:30:26.0593 1900 dmserver - ok
14:30:26.0609 1900 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
14:30:26.0703 1900 DMusic - ok
14:30:26.0734 1900 [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
14:30:26.0796 1900 Dnscache - ok
14:30:26.0828 1900 [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
14:30:26.0890 1900 Dot3svc - ok
14:30:26.0906 1900 dpti2o - ok
14:30:26.0906 1900 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
14:30:26.0984 1900 drmkaud - ok
14:30:27.0015 1900 [ 6DE32A9123EF60F9D423E9163AF0E305 ] e1express C:\WINDOWS\system32\DRIVERS\e1e5132.sys
14:30:27.0187 1900 e1express - ok
14:30:27.0218 1900 [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost C:\WINDOWS\System32\eapsvc.dll
14:30:27.0296 1900 EapHost - ok
14:30:27.0343 1900 [ 85B8B4032A895A746D46A288A9B30DED ] eeCtrl C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
14:30:27.0375 1900 eeCtrl - ok
14:30:27.0406 1900 [ B5A8A04A6E5B4E86B95B1553AA918F5F ] EraserUtilRebootDrv C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
14:30:27.0421 1900 EraserUtilRebootDrv - ok
14:30:27.0437 1900 [ 877C18558D70587AA7823A1A308AC96B ] ERSvc C:\WINDOWS\System32\ersvc.dll
14:30:27.0531 1900 ERSvc - ok
14:30:27.0562 1900 [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog C:\WINDOWS\system32\services.exe
14:30:27.0593 1900 Eventlog - ok
14:30:27.0625 1900 [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem C:\WINDOWS\system32\es.dll
14:30:27.0656 1900 EventSystem - ok
14:30:27.0703 1900 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
14:30:27.0796 1900 Fastfat - ok
14:30:27.0843 1900 [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
14:30:27.0859 1900 FastUserSwitchingCompatibility - ok
14:30:27.0875 1900 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
14:30:27.0953 1900 Fdc - ok
14:30:27.0968 1900 [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
14:30:28.0031 1900 Fips - ok
14:30:28.0046 1900 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
14:30:28.0140 1900 Flpydisk - ok
14:30:28.0156 1900 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
14:30:28.0234 1900 FltMgr - ok
14:30:28.0265 1900 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
14:30:28.0281 1900 FontCache3.0.0.0 - ok
14:30:28.0296 1900 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
14:30:28.0375 1900 Fs_Rec - ok
14:30:28.0390 1900 [ 8F1955CE42E1484714B542F341647778 ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
14:30:28.0468 1900 Ftdisk - ok
14:30:28.0484 1900 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
14:30:28.0500 1900 GEARAspiWDM - ok
14:30:28.0500 1900 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
14:30:28.0593 1900 Gpc - ok
14:30:28.0625 1900 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Programme\Google\Update\GoogleUpdate.exe
14:30:28.0640 1900 gupdate - ok
14:30:28.0656 1900 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Programme\Google\Update\GoogleUpdate.exe
14:30:28.0656 1900 gupdatem - ok
14:30:28.0718 1900 [ 7AB80F7CB53875301742E67775AFDBD3 ] HauppaugeTVServer C:\Programme\WinTV\TVServer\HauppaugeTVServer.exe
14:30:28.0750 1900 HauppaugeTVServer ( UnsignedFile.Multi.Generic ) - warning
14:30:28.0750 1900 HauppaugeTVServer - detected UnsignedFile.Multi.Generic (1)
14:30:28.0812 1900 [ 8CA93EF1AEFC7EF6A751E2BC8C35184F ] HCW713x C:\WINDOWS\system32\DRIVERS\HCW713x.sys
14:30:28.0843 1900 HCW713x - ok
14:30:28.0859 1900 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
14:30:28.0968 1900 HDAudBus - ok
14:30:29.0046 1900 [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
14:30:29.0125 1900 helpsvc - ok
14:30:29.0140 1900 [ B35DA85E60C0103F2E4104532DA2F12B ] HidServ C:\WINDOWS\System32\hidserv.dll
14:30:29.0218 1900 HidServ - ok
14:30:29.0234 1900 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys
14:30:29.0312 1900 hidusb - ok
14:30:29.0343 1900 [ ED29F14101523A6E0E808107405D452C ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
14:30:29.0421 1900 hkmsvc - ok
14:30:29.0421 1900 hpn - ok
14:30:29.0453 1900 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
14:30:29.0500 1900 HTTP - ok
14:30:29.0515 1900 [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
14:30:29.0593 1900 HTTPFilter - ok
14:30:29.0593 1900 i2omgmt - ok
14:30:29.0593 1900 i2omp - ok
14:30:29.0625 1900 [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt C:\WINDOWS\system32\drivers\i8042prt.sys
14:30:29.0718 1900 i8042prt - ok
14:30:29.0750 1900 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
14:30:29.0796 1900 idsvc - ok
14:30:29.0828 1900 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
14:30:29.0921 1900 Imapi - ok
14:30:30.0015 1900 [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService C:\WINDOWS\system32\imapi.exe
14:30:30.0093 1900 ImapiService - ok
14:30:30.0093 1900 ini910u - ok
14:30:30.0093 1900 IntelIde - ok
14:30:30.0109 1900 [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
14:30:30.0187 1900 intelppm - ok
14:30:30.0187 1900 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
14:30:30.0281 1900 Ip6Fw - ok
14:30:30.0312 1900 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
14:30:30.0390 1900 IpFilterDriver - ok
14:30:30.0406 1900 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
14:30:30.0484 1900 IpInIp - ok
14:30:30.0500 1900 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
14:30:30.0593 1900 IpNat - ok
14:30:30.0640 1900 [ BC0EA61246F8D940FBC5F652D337D6BD ] iPod Service C:\Programme\iPod\bin\iPodService.exe
14:30:30.0671 1900 iPod Service - ok
14:30:30.0703 1900 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
14:30:30.0781 1900 IPSec - ok
14:30:30.0781 1900 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
14:30:30.0828 1900 IRENUM - ok
14:30:30.0859 1900 [ 6DFB88F64135C525433E87648BDA30DE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
14:30:30.0937 1900 isapnp - ok
14:30:31.0015 1900 [ B591E761161D1EF547D76EF236EAA6A5 ] JavaQuickStarterService C:\Programme\Java\jre7\bin\jqs.exe
14:30:31.0031 1900 JavaQuickStarterService - ok
14:30:31.0046 1900 [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
14:30:31.0125 1900 Kbdclass - ok
14:30:31.0140 1900 [ B6D6C117D771C98130497265F26D1882 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
14:30:31.0234 1900 kbdhid - ok
14:30:31.0250 1900 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
14:30:31.0328 1900 kmixer - ok
14:30:31.0343 1900 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
14:30:31.0375 1900 KSecDD - ok
14:30:31.0406 1900 [ 2BBDCB79900990F0716DFCB714E72DE7 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
14:30:31.0437 1900 lanmanserver - ok
14:30:31.0484 1900 [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
14:30:31.0515 1900 lanmanworkstation - ok
14:30:31.0515 1900 lbrtfdc - ok
14:30:31.0609 1900 [ 89BFFB6A09652DA7D019A387354D0D19 ] LiveUpdate C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
14:30:31.0671 1900 LiveUpdate - ok
14:30:31.0703 1900 [ 636714B7D43C8D0C80449123FD266920 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
14:30:31.0781 1900 LmHosts - ok
14:30:31.0796 1900 [ B7550A7107281D170CE85524B1488C98 ] Messenger C:\WINDOWS\System32\msgsvc.dll
14:30:31.0890 1900 Messenger - ok
14:30:31.0937 1900 Microsoft SharePoint Workspace Audit Service - ok
14:30:31.0953 1900 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
14:30:32.0031 1900 mnmdd - ok
14:30:32.0093 1900 [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
14:30:32.0187 1900 mnmsrvc - ok
14:30:32.0203 1900 [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
14:30:32.0281 1900 Modem - ok
14:30:32.0281 1900 [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
14:30:32.0375 1900 Mouclass - ok
14:30:32.0390 1900 [ 66A6F73C74E1791464160A7065CE711A ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
14:30:32.0468 1900 mouhid - ok
14:30:32.0500 1900 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
14:30:32.0562 1900 MountMgr - ok
14:30:32.0593 1900 [ C0F8E0C2C3C0437CF37C6781896DC3EC ] MPE C:\WINDOWS\system32\DRIVERS\MPE.sys
14:30:32.0656 1900 MPE - ok
14:30:32.0671 1900 mraid35x - ok
14:30:32.0671 1900 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
14:30:32.0750 1900 MRxDAV - ok
14:30:32.0781 1900 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
14:30:32.0843 1900 MRxSmb - ok
14:30:32.0859 1900 [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC C:\WINDOWS\system32\msdtc.exe
14:30:32.0937 1900 MSDTC - ok
14:30:32.0937 1900 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
14:30:33.0031 1900 Msfs - ok
14:30:33.0031 1900 MSIServer - ok
14:30:33.0031 1900 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
14:30:33.0109 1900 MSKSSRV - ok
14:30:33.0125 1900 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
14:30:33.0203 1900 MSPCLOCK - ok
14:30:33.0218 1900 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
14:30:33.0312 1900 MSPQM - ok
14:30:33.0312 1900 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
14:30:33.0390 1900 mssmbios - ok
14:30:33.0390 1900 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
14:30:33.0468 1900 MSTEE - ok
14:30:33.0468 1900 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
14:30:33.0515 1900 Mup - ok
14:30:33.0531 1900 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
14:30:33.0609 1900 NABTSFEC - ok
14:30:33.0640 1900 [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent C:\WINDOWS\System32\qagentrt.dll
14:30:33.0734 1900 napagent - ok
14:30:33.0812 1900 [ 7D7A3BC6640C1A0D1442816B30856928 ] NAVENG C:\PROGRA~1\GEMEIN~1\SYMANT~1\VIRUSD~1\20130207.004\naveng.sys
14:30:33.0812 1900 NAVENG - ok
14:30:33.0859 1900 [ 28494C43D62AA7584BDCA2FADFBC4D11 ] NAVEX15 C:\PROGRA~1\GEMEIN~1\SYMANT~1\VIRUSD~1\20130207.004\navex15.sys
14:30:33.0906 1900 NAVEX15 - ok
14:30:33.0921 1900 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
14:30:34.0015 1900 NDIS - ok
14:30:34.0046 1900 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
14:30:34.0156 1900 NdisIP - ok
14:30:34.0171 1900 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
14:30:34.0203 1900 NdisTapi - ok
14:30:34.0234 1900 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
14:30:34.0312 1900 Ndisuio - ok
14:30:34.0328 1900 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
14:30:34.0406 1900 NdisWan - ok
14:30:34.0437 1900 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
14:30:34.0468 1900 NDProxy - ok
14:30:34.0484 1900 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
14:30:34.0578 1900 NetBIOS - ok
14:30:34.0593 1900 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
14:30:34.0687 1900 NetBT - ok
14:30:34.0718 1900 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE C:\WINDOWS\system32\netdde.exe
14:30:34.0812 1900 NetDDE - ok
14:30:34.0812 1900 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
14:30:34.0875 1900 NetDDEdsdm - ok
14:30:34.0906 1900 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon C:\WINDOWS\system32\lsass.exe
14:30:34.0984 1900 Netlogon - ok
14:30:35.0000 1900 [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman C:\WINDOWS\System32\netman.dll
14:30:35.0093 1900 Netman - ok
14:30:35.0093 1900 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
14:30:35.0125 1900 NetTcpPortSharing - ok
14:30:35.0140 1900 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys
14:30:35.0234 1900 NIC1394 - ok
14:30:35.0250 1900 [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla C:\WINDOWS\System32\mswsock.dll
14:30:35.0281 1900 Nla - ok
14:30:35.0296 1900 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
14:30:35.0359 1900 Npfs - ok
14:30:35.0390 1900 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
14:30:35.0484 1900 Ntfs - ok
14:30:35.0484 1900 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
14:30:35.0562 1900 NtLmSsp - ok
14:30:35.0593 1900 [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
14:30:35.0703 1900 NtmsSvc - ok
14:30:35.0718 1900 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
14:30:35.0781 1900 Null - ok
14:30:36.0031 1900 [ CF8097AEA6438CDDCF4266DF1C0934E3 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
14:30:36.0328 1900 nv - ok
14:30:36.0359 1900 [ F4AC9545A864A7B7A2562681726EB2D3 ] nvsvc C:\WINDOWS\system32\nvsvc32.exe
14:30:36.0359 1900 nvsvc - ok
14:30:36.0390 1900 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
14:30:36.0468 1900 NwlnkFlt - ok
14:30:36.0484 1900 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
14:30:36.0562 1900 NwlnkFwd - ok
14:30:36.0609 1900 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys
14:30:36.0687 1900 ohci1394 - ok
14:30:36.0734 1900 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
14:30:36.0765 1900 ose - ok
14:30:36.0937 1900 [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
14:30:37.0093 1900 osppsvc - ok
14:30:37.0125 1900 [ F84785660305B9B903FB3BCA8BA29837 ] Parport C:\WINDOWS\system32\drivers\Parport.sys
14:30:37.0203 1900 Parport - ok
14:30:37.0234 1900 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
14:30:37.0328 1900 PartMgr - ok
14:30:37.0343 1900 [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
14:30:37.0437 1900 ParVdm - ok
14:30:37.0437 1900 [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
14:30:37.0515 1900 PCI - ok
14:30:37.0515 1900 PCIDump - ok
14:30:37.0546 1900 [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
14:30:37.0625 1900 PCIIde - ok
14:30:37.0625 1900 [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
14:30:37.0718 1900 Pcmcia - ok
14:30:37.0734 1900 PDCOMP - ok
14:30:37.0734 1900 PDFRAME - ok
14:30:37.0734 1900 PDRELI - ok
14:30:37.0734 1900 PDRFRAME - ok
14:30:37.0734 1900 perc2 - ok
14:30:37.0734 1900 perc2hib - ok
14:30:37.0750 1900 [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay C:\WINDOWS\system32\services.exe
14:30:37.0765 1900 PlugPlay - ok
14:30:37.0781 1900 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
14:30:37.0843 1900 PolicyAgent - ok
14:30:37.0859 1900 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
14:30:37.0937 1900 PptpMiniport - ok
14:30:37.0953 1900 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
14:30:38.0015 1900 ProtectedStorage - ok
14:30:38.0015 1900 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
14:30:38.0093 1900 PSched - ok
14:30:38.0109 1900 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
14:30:38.0203 1900 Ptilink - ok
14:30:38.0203 1900 ql1080 - ok
14:30:38.0203 1900 Ql10wnt - ok
14:30:38.0203 1900 ql12160 - ok
14:30:38.0203 1900 ql1240 - ok
14:30:38.0203 1900 ql1280 - ok
14:30:38.0234 1900 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
14:30:38.0312 1900 RasAcd - ok
14:30:38.0343 1900 [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto C:\WINDOWS\System32\rasauto.dll
14:30:38.0421 1900 RasAuto - ok
14:30:38.0437 1900 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
14:30:38.0500 1900 Rasl2tp - ok
14:30:38.0546 1900 [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan C:\WINDOWS\System32\rasmans.dll
14:30:38.0625 1900 RasMan - ok
14:30:38.0625 1900 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
14:30:38.0718 1900 RasPppoe - ok
14:30:38.0718 1900 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
14:30:38.0796 1900 Raspti - ok
14:30:38.0812 1900 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
14:30:38.0906 1900 Rdbss - ok
14:30:38.0906 1900 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
14:30:38.0984 1900 RDPCDD - ok
14:30:39.0000 1900 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
14:30:39.0093 1900 rdpdr - ok
14:30:39.0109 1900 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
14:30:39.0140 1900 RDPWD - ok
14:30:39.0156 1900 [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
14:30:39.0250 1900 RDSessMgr - ok
14:30:39.0265 1900 [ ED761D453856F795A7FE056E42C36365 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
14:30:39.0343 1900 redbook - ok
14:30:39.0359 1900 [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
14:30:39.0437 1900 RemoteAccess - ok
14:30:39.0468 1900 [ E4CD1F3D84E1C2CA0B8CF7501E201593 ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
14:30:39.0531 1900 RemoteRegistry - ok
14:30:39.0609 1900 [ 8CFCA7E2FD4B57C2BEF929C1C1A4C56E ] RichVideo C:\Programme\CyberLink\Shared files\RichVideo.exe
14:30:39.0625 1900 RichVideo - ok
14:30:39.0640 1900 [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator C:\WINDOWS\system32\locator.exe
14:30:39.0734 1900 RpcLocator - ok
14:30:39.0750 1900 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs C:\WINDOWS\system32\rpcss.dll
14:30:39.0765 1900 RpcSs - ok
14:30:39.0796 1900 [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP C:\WINDOWS\system32\rsvp.exe
14:30:39.0875 1900 RSVP - ok
14:30:39.0890 1900 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs C:\WINDOWS\system32\lsass.exe
14:30:39.0968 1900 SamSs - ok
14:30:40.0000 1900 [ 0DE5CE2C919E4371C1FCED0196086E3E ] SavRoam C:\Programme\Symantec AntiVirus\SavRoam.exe
14:30:40.0015 1900 SavRoam - ok
14:30:40.0031 1900 [ CDB565C093B0105086CC630B32F9E6E6 ] SAVRT C:\Programme\Symantec AntiVirus\savrt.sys
14:30:40.0046 1900 SAVRT - ok
14:30:40.0078 1900 [ 1042CB5A003F9AED8D6CEC56A0FC6C49 ] SAVRTPEL C:\Programme\Symantec AntiVirus\Savrtpel.sys
14:30:40.0078 1900 SAVRTPEL - ok
14:30:40.0125 1900 [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
14:30:40.0203 1900 SCardSvr - ok
14:30:40.0234 1900 [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule C:\WINDOWS\system32\schedsvc.dll
14:30:40.0312 1900 Schedule - ok
14:30:40.0359 1900 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
14:30:40.0390 1900 Secdrv - ok
14:30:40.0421 1900 [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon C:\WINDOWS\System32\seclogon.dll
14:30:40.0500 1900 seclogon - ok
14:30:40.0531 1900 [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS C:\WINDOWS\system32\sens.dll
14:30:40.0609 1900 SENS - ok
14:30:40.0625 1900 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] Serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
14:30:40.0703 1900 Serenum - ok
14:30:40.0718 1900 [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
14:30:40.0796 1900 Serial - ok
14:30:40.0796 1900 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
14:30:40.0875 1900 Sfloppy - ok
14:30:40.0921 1900 [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
14:30:41.0000 1900 SharedAccess - ok
14:30:41.0015 1900 [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
14:30:41.0031 1900 ShellHWDetection - ok
14:30:41.0031 1900 Simbad - ok
14:30:41.0046 1900 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
14:30:41.0140 1900 SLIP - ok
14:30:41.0156 1900 [ C5F415BB02EE89CDE1B6CEE3538F424B ] SNDSrvc C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
14:30:41.0187 1900 SNDSrvc - ok
14:30:41.0187 1900 Sparrow - ok
14:30:41.0203 1900 [ CC22BF5631C4837ABCD81D75DE8FB1AA ] SPBBCDrv C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCDrv.sys
14:30:41.0218 1900 SPBBCDrv - ok
14:30:41.0250 1900 [ DABD8523D9B60CE6513653DFD8B96C1B ] SPBBCSvc C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
14:30:41.0281 1900 SPBBCSvc - ok
14:30:41.0312 1900 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
14:30:41.0390 1900 splitter - ok
14:30:41.0421 1900 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
14:30:41.0468 1900 Spooler - ok
14:30:41.0515 1900 [ 50FA898F8C032796D3B1B9951BB5A90F ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
14:30:41.0562 1900 sr - ok
14:30:41.0593 1900 [ FE77A85495065F3AD59C5C65B6C54182 ] srservice C:\WINDOWS\system32\srsvc.dll
14:30:41.0656 1900 srservice - ok
14:30:41.0671 1900 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
14:30:41.0734 1900 Srv - ok
14:30:41.0750 1900 [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
14:30:41.0781 1900 SSDPSRV - ok
14:30:41.0859 1900 [ C5003D42CC88C1F5D54ED9AF28D6ED7B ] STacSV c:\programme\idt\intelxpv_v103\wdm\STacSV.exe
14:30:41.0890 1900 STacSV - ok
14:30:41.0953 1900 [ 228519217A88C2F6B0CF8C022E6D669C ] STHDA C:\WINDOWS\system32\drivers\sthda.sys
14:30:42.0000 1900 STHDA - ok
14:30:42.0015 1900 [ BC2C5985611C5356B24AEB370953DED9 ] stisvc C:\WINDOWS\system32\wiaservc.dll
14:30:42.0125 1900 stisvc - ok
14:30:42.0156 1900 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
14:30:42.0250 1900 streamip - ok
14:30:42.0265 1900 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
14:30:42.0343 1900 swenum - ok
14:30:42.0359 1900 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
14:30:42.0437 1900 swmidi - ok
14:30:42.0437 1900 SwPrv - ok
14:30:42.0500 1900 [ 8B3550214824ABF244D1E27E2A300990 ] Symantec AntiVirus C:\Programme\Symantec AntiVirus\Rtvscan.exe
14:30:42.0546 1900 Symantec AntiVirus - ok
14:30:42.0546 1900 symc810 - ok
14:30:42.0546 1900 symc8xx - ok
14:30:42.0578 1900 [ 5156F63E684E8C864FF40E40D5309F41 ] SymEvent C:\Programme\Symantec\SYMEVENT.SYS
14:30:42.0593 1900 SymEvent - ok
14:30:42.0609 1900 [ 5314E345DFC068504CFB2676D3B2CA39 ] SYMREDRV C:\WINDOWS\System32\Drivers\SYMREDRV.SYS
14:30:42.0625 1900 SYMREDRV - ok
14:30:42.0640 1900 [ 8CD0A1478256240249B8EE88E6F25E94 ] SYMTDI C:\WINDOWS\System32\Drivers\SYMTDI.SYS
14:30:42.0656 1900 SYMTDI - ok
14:30:42.0656 1900 sym_hi - ok
14:30:42.0656 1900 sym_u3 - ok
14:30:42.0671 1900 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
14:30:42.0750 1900 sysaudio - ok
14:30:42.0765 1900 [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
14:30:42.0859 1900 SysmonLog - ok
14:30:42.0875 1900 [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
14:30:42.0953 1900 TapiSrv - ok
14:30:42.0984 1900 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
14:30:43.0015 1900 Tcpip - ok
14:30:43.0031 1900 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
14:30:43.0140 1900 TDPIPE - ok
14:30:43.0156 1900 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
14:30:43.0234 1900 TDTCP - ok
14:30:43.0265 1900 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
14:30:43.0343 1900 TermDD - ok
14:30:43.0359 1900 [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService C:\WINDOWS\System32\termsrv.dll
14:30:43.0437 1900 TermService - ok
14:30:43.0453 1900 [ 2DB7D303C36DDD055215052F118E8E75 ] Themes C:\WINDOWS\System32\shsvcs.dll
14:30:43.0468 1900 Themes - ok
14:30:43.0500 1900 [ 03681A1CE77F51586903869A5AB1DEAB ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
14:30:43.0562 1900 TlntSvr - ok
14:30:43.0562 1900 TosIde - ok
14:30:43.0578 1900 [ 626504572B175867F30F3215C04B3E2F ] TrkWks C:\WINDOWS\system32\trkwks.dll
14:30:43.0656 1900 TrkWks - ok
14:30:43.0671 1900 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
14:30:43.0765 1900 Udfs - ok
14:30:43.0765 1900 ultra - ok
14:30:43.0796 1900 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
14:30:43.0921 1900 Update - ok
14:30:43.0953 1900 [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost C:\WINDOWS\System32\upnphost.dll
14:30:44.0015 1900 upnphost - ok
14:30:44.0031 1900 [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS C:\WINDOWS\System32\ups.exe
14:30:44.0109 1900 UPS - ok
14:30:44.0140 1900 [ 73B41F4EAD65F355962168D766AF0F2E ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys
14:30:44.0187 1900 USBAAPL - ok
14:30:44.0203 1900 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
14:30:44.0296 1900 usbccgp - ok
14:30:44.0328 1900 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
14:30:44.0406 1900 usbehci - ok
14:30:44.0437 1900 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
14:30:44.0515 1900 usbhub - ok
14:30:44.0546 1900 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
14:30:44.0640 1900 usbscan - ok
14:30:44.0640 1900 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
14:30:44.0734 1900 usbstor - ok
14:30:44.0750 1900 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
14:30:44.0812 1900 usbuhci - ok
14:30:44.0828 1900 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
14:30:44.0906 1900 VgaSave - ok
14:30:44.0906 1900 ViaIde - ok
14:30:44.0921 1900 [ A5A712F4E880874A477AF790B5186E1D ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
14:30:45.0000 1900 VolSnap - ok
14:30:45.0015 1900 [ 68F106273BE29E7B7EF8266977268E78 ] VSS C:\WINDOWS\System32\vssvc.exe
14:30:45.0062 1900 VSS - ok
14:30:45.0078 1900 [ 7B353059E665F8B7AD2BBEAEF597CF45 ] W32Time C:\WINDOWS\system32\w32time.dll
14:30:45.0140 1900 W32Time - ok
14:30:45.0156 1900 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
14:30:45.0234 1900 Wanarp - ok
14:30:45.0234 1900 WDICA - ok
14:30:45.0281 1900 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
14:30:45.0343 1900 wdmaud - ok
14:30:45.0390 1900 [ EBFFE98048709C7CC7A6F6C36C7DE61B ] Web Assistant Updater C:\Programme\Web Assistant\ExtensionUpdaterService.exe
14:30:45.0406 1900 Web Assistant Updater ( UnsignedFile.Multi.Generic ) - warning
14:30:45.0406 1900 Web Assistant Updater - detected UnsignedFile.Multi.Generic (1)
14:30:45.0421 1900 [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient C:\WINDOWS\System32\webclnt.dll
14:30:45.0515 1900 WebClient - ok
14:30:45.0578 1900 [ 6F3F3973D97714CC5F906A19FE883729 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
14:30:45.0656 1900 winmgmt - ok
14:30:45.0687 1900 [ 051B1BDECD6DEE18C771B5D5EC7F044D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
14:30:45.0750 1900 WmdmPmSN - ok
14:30:45.0781 1900 [ FFA4D901D46D07A5BAB2D8307FBB51A6 ] Wmi C:\WINDOWS\System32\advapi32.dll
14:30:45.0812 1900 Wmi - ok
14:30:45.0828 1900 [ 93908111BA57A6E60EC2FA2DE202105C ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
14:30:45.0906 1900 WmiApSrv - ok
14:30:45.0953 1900 [ D3DBD6E76F4BE9BEE67EB631488B5F29 ] WMPNetworkSvc C:\Programme\Windows Media Player\WMPNetwk.exe
14:30:46.0000 1900 WMPNetworkSvc - ok
14:30:46.0031 1900 [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc C:\WINDOWS\system32\wscsvc.dll
14:30:46.0109 1900 wscsvc - ok
14:30:46.0125 1900 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
14:30:46.0218 1900 WSTCODEC - ok
14:30:46.0234 1900 [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
14:30:46.0312 1900 wuauserv - ok
14:30:46.0328 1900 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
14:30:46.0359 1900 WudfPf - ok
14:30:46.0390 1900 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
14:30:46.0406 1900 WudfRd - ok
14:30:46.0421 1900 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
14:30:46.0453 1900 WudfSvc - ok
14:30:46.0500 1900 [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
14:30:46.0578 1900 WZCSVC - ok
14:30:46.0593 1900 [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
14:30:46.0687 1900 xmlprov - ok
14:30:46.0687 1900 ================ Scan global ===============================
14:30:46.0718 1900 [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll
14:30:46.0750 1900 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
14:30:46.0750 1900 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
14:30:46.0765 1900 [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe
14:30:46.0781 1900 [Global] - ok
14:30:46.0781 1900 ================ Scan MBR ==================================
14:30:46.0781 1900 [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk0\DR0
14:30:47.0093 1900 \Device\Harddisk0\DR0 - ok
14:30:47.0093 1900 ================ Scan VBR ==================================
14:30:47.0093 1900 [ 89B7105B135DDFF26DC11F150554F40A ] \Device\Harddisk0\DR0\Partition1
14:30:47.0093 1900 \Device\Harddisk0\DR0\Partition1 - ok
14:30:47.0125 1900 [ C736652EAE5A6D9D2A2BE82EE2E1C452 ] \Device\Harddisk0\DR0\Partition2
14:30:47.0125 1900 \Device\Harddisk0\DR0\Partition2 - ok
14:30:47.0140 1900 [ A3551C346BFA2F17C25321DE89FDF860 ] \Device\Harddisk0\DR0\Partition3
14:30:47.0140 1900 \Device\Harddisk0\DR0\Partition3 - ok
14:30:47.0140 1900 ============================================================
14:30:47.0140 1900 Scan finished
14:30:47.0140 1900 ============================================================
14:30:47.0250 2304 Detected object count: 2
14:30:47.0250 2304 Actual detected object count: 2
14:30:53.0828 2304 HauppaugeTVServer ( UnsignedFile.Multi.Generic ) - skipped by user
14:30:53.0828 2304 HauppaugeTVServer ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:30:53.0828 2304 Web Assistant Updater ( UnsignedFile.Multi.Generic ) - skipped by user
14:30:53.0828 2304 Web Assistant Updater ( UnsignedFile.Multi.Generic ) - User select action: Skip

markusg · 10.02.2013, 17:31

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Megalodon · 10.02.2013, 19:51

Hier das log!
Combofix Logfile:

Code:

ATTFilter

ComboFix 13-02-07.02 - Karli 10.02.2013  19:45:02.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.43.1031.18.3323.1754 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Karli\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\PostBuild.exe
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\PostBuild.exe
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP\{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}\PostBuild.exe
c:\programme\Web Assistant\ExTEnsion32.dll
C:\RECYCLER(2)
c:\recycler(2)\S-1-5-21-1085031214-583907252-725345543-1003(2)\INFO2
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-01-10 bis 2013-02-10  ))))))))))))))))))))))))))))))
.
.
2013-02-09 13:29 . 2013-02-09 13:29	--------	d-----w-	C:\tdsskiller
2013-02-08 22:18 . 2013-02-08 16:24	--------	d-----w-	C:\_OTL
2013-02-08 22:18 . 2011-07-13 02:55	2237440	----a-r-	C:\OTLPE.exe
2013-02-07 18:32 . 2013-02-07 18:32	--------	d-----w-	c:\dokumente und einstellungen\Administrator
2013-02-03 15:31 . 2013-02-03 15:31	--------	d-----w-	C:\BJPrinter
2013-02-02 16:13 . 2012-11-01 11:59	580712	------w-	c:\windows\system32\HPDiscoPM5E12.dll
2013-02-02 16:12 . 2012-06-13 18:22	268688	----a-w-	c:\windows\system32\hpinksts5E12LM.dll
2013-02-02 16:12 . 2012-06-13 18:22	529808	----a-w-	c:\windows\system32\hpinksts5E12.dll
2013-02-02 16:12 . 2012-06-13 18:22	220560	----a-w-	c:\windows\system32\hpinkcoi5E12.dll
2013-02-02 16:12 . 2012-06-13 17:47	2216336	----a-w-	c:\windows\system32\hpinkins5E12.exe
2013-02-02 16:12 . 2013-02-02 16:12	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\HP
2013-02-02 16:12 . 2013-02-02 16:12	--------	d-----w-	c:\programme\HP
2013-02-02 16:12 . 2013-02-02 16:13	--------	d-----w-	c:\dokumente und einstellungen\Karli\Lokale Einstellungen\Anwendungsdaten\HP
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-09 13:29 . 2013-02-09 13:29	2195061	----a-w-	C:\tdsskiller.zip
2013-02-09 13:09 . 2012-10-19 19:07	74096	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-09 13:09 . 2012-10-19 19:07	697712	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-12-16 12:23 . 2004-08-03 22:54	290560	----a-w-	c:\windows\system32\atmfd.dll
2012-11-22 18:19 . 2012-11-22 18:19	93672	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2012-11-22 18:19 . 2012-11-22 18:20	143872	----a-w-	c:\windows\system32\javacpl.cpl
2012-11-22 18:19 . 2012-05-06 23:15	821736	----a-w-	c:\windows\system32\npdeployJava1.dll
2012-11-22 18:19 . 2012-05-06 23:15	746984	----a-w-	c:\windows\system32\deployJava1.dll
2012-11-13 11:55 . 2004-08-03 22:46	1866496	----a-w-	c:\windows\system32\win32k.sys
2012-05-09 15:05 . 2012-05-09 15:05	1722880	----a-w-	c:\programme\ZuneDesktopTheme.msi
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\programme\IDT\WDM\sttray.exe" [2009-03-12 483422]
"ccApp"="c:\programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" [2006-03-07 53408]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-03-17 124656]
"nwiz"="c:\programme\NVIDIA Corporation\nView\nwiz.exe" [2010-08-18 1753192]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-08-19 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-08-19 13925480]
"APSDaemon"="c:\programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"BCSSync"="c:\programme\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2012-09-09 421776]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
AutoStart IR.lnk - c:\programme\WinTV\Ir.exe [2012-5-6 117344]
WinTV Recording Status.lnk - c:\programme\WinTV\WinTV7\WinTVTray.exe [2012-5-6 146944]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\WinTV\\WinTV7\\WinTV7.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\Opera\\opera.exe"=
"c:\\Programme\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Programme\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Programme\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\Programme\\Gemeinsame Dateien\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
.
R2 HauppaugeTVServer;HauppaugeTVServer;c:\programme\WinTV\TVServer\HauppaugeTVServer.exe [06.05.2012 11:31 577024]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programme\Gemeinsame Dateien\Symantec Shared\eengine\EraserUtilRebootDrv.sys [10.08.2012 18:01 106656]
R3 HCW713x;Hauppauge WinTV-HVR 713X PCI Card;c:\windows\system32\drivers\HCW713x.sys [06.05.2012 11:25 1164176]
S2 Web Assistant Updater;Web Assistant Updater;c:\programme\Web Assistant\ExtensionUpdaterService.exe [11.07.2012 20:12 185856]
S3 SavRoam;SAVRoam;c:\programme\Symantec AntiVirus\SavRoam.exe [17.03.2006 05:34 115952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-02-03 16:17	1607120	----a-w-	c:\programme\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-02-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-06 13:09]
.
2013-02-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2012-10-19 19:07]
.
2013-02-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2012-10-19 19:07]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzuyEtN2Y1L1QzutDtDtCzy0DtCzy0D0F0DyBzytBtByDzytN0D0Tzu0CtBtCtCtN1L2XzutBtFtCtFtDtFtAtDtC&cr=845787422
mStart Page = hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzuyEtN2Y1L1QzutDtDtCzy0DtCzy0D0F0DyBzytBtByDzytN0D0Tzu0CtBtCtCtN1L2XzutBtFtCtFtDtFtAtDtC&cr=845787422
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 195.202.128.2 195.202.128.73
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2013-02-10 19:47
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-02-10  19:48:27
ComboFix-quarantined-files.txt  2013-02-10 18:48
ComboFix2.txt  2012-09-26 17:03
.
Vor Suchlauf: 12 Verzeichnis(se), 18.750.898.176 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 18.830.606.336 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - AD7C9E1CDA6FC444DF152332F98F6E32

--- --- ---

markusg · 10.02.2013, 20:10

hi
malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Megalodon · 10.02.2013, 21:16

Vielen Dank, hier das logfile!

Malwarebytes Anti-Malware 1.70.0.1100
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2013.02.10.07

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512
Karli :: KARLJ [Administrator]

10.02.2013 20:18:57
mbam-log-2013-02-10 (20-18-57).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 341334
Laufzeit: 55 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 15
HKCR\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439} (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13} (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\funmoodsApp.appCore.1 (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\funmoodsApp.appCore (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9} (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\f (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191} (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B} (PUP.FunMoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B} (PUP.FunMoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\_OTL\MovedFiles\02082013_171807\C_Dokumente und Einstellungen\Karli\Lokale Einstellungen\temp\wwgXEGi.exe (Trojan.Ransom) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

markusg · 10.02.2013, 21:25

hi
lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Megalodon · 10.02.2013, 21:42

Bitte sehr, die Liste!

Adobe Flash Player 11 Plugin Adobe Systems Incorporated 09.02.2013 11.5.502.149 notwendig
Adobe Reader XI (11.0.01) - Deutsch Adobe Systems Incorporated 10.01.2013 146,00MB 11.0.01 notwendig
Apple Application Support Apple Inc. 13.10.2012 66,27MB 2.2.2 notwendig
Apple Mobile Device Support Apple Inc. 13.10.2012 23,18MB 6.0.0.59 notwendig
Apple Software Update Apple Inc. 06.05.2012 2,38MB 2.1.3.127 notwendig
Bonjour Apple Inc. 06.05.2012 0,99MB 3.0.0.10 notwendig
CCleaner Piriform 24.09.2012 3.23 notwendig
GeoGebra 4 International GeoGebra Institute 06.02.2013 notwendig
Google Chrome Google Inc. 19.10.2012 24.0.1312.57 notwendig
Hauppauge WinTV 7 Hauppauge Computer Works 06.05.2012 v7.0.30108 (CD 2.5c) notwendig
High Definition Audio Driver Package - KB888111 Microsoft Corporation 06.05.2012 20040219.000000 unbekannt
HP Officejet 6100 - Grundlegende Software für das Gerät Hewlett-Packard Co. 02.02.2013 71,21MB 28.0.1321.0 notwendig
HyperCam 2 Hyperionics Technology LLC 11.07.2012 2.27.00 notwendig
IDT Audio IDT 06.05.2012 1.0.20001.0 unbekannt
Intel(R) Network Connections 15.3.68.0 Intel 06.05.2012 15.3.68.0 unbekannt
iTunes Apple Inc. 13.10.2012 179,00MB 10.7.0.21 notwendig
Java 7 Update 9 Oracle 22.11.2012 130,00MB 7.0.90 notwendig
LiveUpdate 3.0 (Symantec Corporation) Symantec Corporation 06.05.2012 3.0.0.160 notwendig
Malwarebytes Anti-Malware Version 1.70.0.1100 Malwarebytes Corporation 10.02.2013 1.70.0.1100 unnötig
Microsoft .NET Framework 2.0 Service Pack 2 Microsoft Corporation 10.01.2013 185,00MB 2.2.30729 unbekannt
Microsoft .NET Framework 3.0 Service Pack 2 Microsoft Corporation 10.01.2013 253,00MB 3.2.30729 unbekannt
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 10.01.2013 unbekannt
Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Corporation 06.05.2012 unbekannt 1
Microsoft Mathematics Microsoft Corporation 10.05.2012 18,10MB 4.0 notwendig
Microsoft Office Professional Plus 2010 Microsoft Corporation 10.01.2013 14.0.6029.1000 unbekannt
Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Corporation 06.05.2012 unbekannt
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 06.05.2012 0,11MB 8.0.50727.4053 unbekannt
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 06.05.2012 5,21MB 8.0.56336 unbekannt
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Corporation 06.05.2012 0,15MB 9.0.30729.4148 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 06.05.2012 10,28MB 9.0.30729 unbekannt
MSXML 6.0 Parser (KB933579) Microsoft Corporation 06.05.2012 1,31MB 6.10.1200.0 unbekannt
NVIDIA Display Control Panel NVIDIA Corporation 06.05.2012 6.14.12.5944 unbekannt
NVIDIA Drivers NVIDIA Corporation 06.05.2012 1.10.62.40 unbekannt
NVIDIA nView Desktop Manager NVIDIA Corporation 06.05.2012 6.14.10.13535 unbekannt
NVIDIA PhysX NVIDIA Corporation 06.05.2012 73,80MB 9.10.0224 unbekannt
Opera 12.13 Opera Software ASA 04.02.2013 12.13.1734 notwendig
Symantec AntiVirus Symantec Corporation 06.05.2012 88,03MB 10.1.394.0 notwendig
VLC media player 2.0.1 VideoLAN 06.05.2012 2.0.1 notwendig
Web Assistant 2.0.0.462 IncrediBar 11.07.2012 unbekannt
Windows Media Format 11 runtime 06.05.2012 unnötig
Windows Media Player 11 06.05.2012 unnötig
Windows XP Service Pack 3 Microsoft Corporation 06.05.2012 20080414.031514 unbekannt
Zune Desktop Theme Microsoft Corporation 12.05.2012 2,49MB 1.0.5341.0 notwendig

markusg · 11.02.2013, 12:50

deinstaliere:
Java
downloade Java jre:
Java-Downloads für alle Betriebssysteme
klicke:
Download der Java-Software für Windows Offline
laden, und instalieren
deinstaliere:
Web Assistant

öffne CCleaner, analysieren, starten, PC neustarten.
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

neustarten, testen, wie PC + Programme wie Browser laufen

Megalodon · 13.02.2013, 13:26

Hier das log!AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v2.112 - Datei am 13/02/2013 um 13:21:00 erstellt
# Aktualisiert am 10/02/2013 von Xplode
# Betriebssystem : Microsoft Windows XP Service Pack 3 (32 bits)
# Benutzer : Karli - KARLJ
# Bootmodus : Normal
# Ausgeführt unter : C:\Dokumente und Einstellungen\Karli\Desktop\adwcleaner0.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\Anwendungsdaten\funmoods.crx
Datei Gelöscht : C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\Anwendungsdaten\funmoods-speeddial.crx
Datei Gelöscht : C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage
Datei Gelöscht : C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage
Datei Gelöscht : C:\user.js
Gelöscht mit Neustart : C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh
Gelöscht mit Neustart : C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Ordner Gelöscht : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ask
Ordner Gelöscht : C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Funmoods
Ordner Gelöscht : C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\incredibar.com
Ordner Gelöscht : C:\Programme\1ClickDownload

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\1ClickDownload
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\Web Assistant
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\funmoods.dskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\funmoods.dskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\funmoods.funmoodsHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\funmoods.funmoodsHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\pmlghpafmmnmmkjdhacccolfgnkiboco
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Schlüssel Gelöscht : HKLM\Software\Web Assistant
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]

***** [Internet Browser] *****

-\\ Internet Explorer v6.0.2900.5512

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzuyEtN2Y1L1QzutDtDtCzy0DtCzy0D0F0DyBzytBtByDzytN0D0Tzu0CtBtCtCtN1L2XzutBtFtCtFtDtFtAtDtC&cr=845787422 --> hxxp://www.google.com
Gelöscht : [HKCU\Software\Microsoft\Internet Explorer\Main - Backup.Old.Start Page]
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.funmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzuyEtN2Y1L1QzutDtDtCzy0DtCzy0D0F0DyBzytBtByDzytN0D0Tzu0CtBtCtCtN1L2XzutBtFtCtFtDtFtAtDtC&cr=845787422 --> hxxp://www.google.com

-\\ Google Chrome v24.0.1312.57

Datei : C:\Dokumente und Einstellungen\Karli\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

-\\ Opera v12.13.1734.0

Datei : C:\Dokumente und Einstellungen\Karli\Anwendungsdaten\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [5964 octets] - [13/02/2013 13:21:00]

########## EOF - C:\AdwCleaner[S1].txt - [6024 octets] ##########

--- --- ---

Computer gesperrt und ist weder im normalen noch im abgesicherten Modus zu verwenden!

Plagegeister aller Art und deren Bekämpfung: Computer gesperrt und ist weder im normalen noch im abgesicherten Modus zu verwenden!