Trojaner/Virus über ICQ

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4300

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

10.07.2010 18:18:03
mbam-log-2010-07-10 (18-18-03).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 123836
Laufzeit: 4 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 6

Infizierte Speicherprozesse:
C:\Users\Public\winsvrcn.exe (Backdoor.Bot) -> Unloaded process successfully.

Infizierte Speichermodule:
C:\Users\***\AppData\Local\Temp\sshnas21.dll (Trojan.Downloader) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windowssyscontrol (Backdoor.Bot) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\Public\winsvrcn.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Temp\BmlK1bgM17.log (Mismatched.Extension) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Temp\vir.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Temp\fDc8F0K6iK.log (Mismatched.Extension) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Temp\sshnas21.dll (Trojan.Downloader) -> Delete on reboot.
C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
         

Logfile of random's system information tool 1.08 (written by random/random)
Run by *** at 2010-07-10 18:24:00
Microsoft Windows 7 Home Premium  
System drive C: has 102 GB (78%) free of 131 GB
Total RAM: 3037 MB (76% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:24:09, on 10.07.2010
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Raxco\PerfectDisk\PDAgentS1.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\***\Desktop\RSIT.exe
C:\Program Files\trend micro\***.exe Die Datei hiess so wie ich/mein Benutzerkonto

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) -  - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ Malwarebytes Anti-Malware  (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O9 - Extra button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--
End of file - 4222 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2009-07-28 13797920]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-03-02 282792]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
" Malwarebytes Anti-Malware  (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-04-29 1090952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06 500208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Halo2]
C:\Users\***\AppData\Local\Temp\sshnas21.dll,GetMainWnd []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2010-06-15 141624]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2010-03-18 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Realtime Audio Engine]
mmrtkrnl.exe /i []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-07-10 18:24:00 ----D---- C:\rsit
2010-07-10 18:24:00 ----D---- C:\Program Files\trend micro
2010-07-10 18:10:27 ----D---- C:\Users\***\AppData\Roaming\Malwarebytes
2010-07-10 18:10:20 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-07-10 18:10:18 ----D---- C:\ProgramData\Malwarebytes
2010-07-10 18:10:18 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-07-10 18:10:18 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-07-10 17:57:10 ----D---- C:\Program Files\CCleaner
2010-07-10 16:50:41 ----RA---- C:\Users\***\AppData\Roaming\LJC8G.txt
2010-07-10 16:50:41 ----RA---- C:\Users\***\AppData\Roaming\BkE6c.txt
2010-07-03 13:57:32 ----SHD---- C:\Config.Msi
2010-06-29 20:40:55 ----D---- C:\ProgramData\Raxco
2010-06-29 11:36:45 ----D---- C:\Program Files\MSXML 4.0
2010-06-24 17:25:32 ----D---- C:\s-winprosa
2010-06-24 16:20:59 ----A---- C:\Windows\system32\devil.dll
2010-06-24 16:20:59 ----A---- C:\Windows\system32\avisynth.dll
2010-06-24 16:20:56 ----A---- C:\Windows\system32\yv12vfw.dll
2010-06-24 16:20:56 ----A---- C:\Windows\system32\i420vfw.dll
2010-06-24 16:20:56 ----A---- C:\Windows\system32\AVSredirect.dll
2010-06-24 16:20:55 ----D---- C:\Program Files\AviSynth 2.5
2010-06-24 16:09:49 ----D---- C:\ProgramData\TEMP
2010-06-24 16:09:12 ----D---- C:\Users\Eliah\AppData\Roaming\AnvSoft
2010-06-23 19:30:51 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2010-06-23 19:30:51 ----A---- C:\Windows\system32\PresentationHost.exe
2010-06-23 19:30:51 ----A---- C:\Windows\system32\netfxperf.dll
2010-06-23 19:30:51 ----A---- C:\Windows\system32\mscoree.dll
2010-06-23 19:30:51 ----A---- C:\Windows\system32\dfshim.dll
2010-06-23 19:29:48 ----A---- C:\Windows\system32\ntdll.dll
2010-06-23 19:29:46 ----A---- C:\Windows\system32\msdri.dll
2010-06-23 19:29:46 ----A---- C:\Windows\system32\CPFilters.dll
2010-06-21 18:31:55 ----DC---- C:\Windows\system32\DRVSTORE
2010-06-21 18:31:55 ----A---- C:\Windows\system32\GEARAspi.dll
2010-06-21 18:31:55 ----A---- C:\Windows\system32\drivers\GEARAspiWDM.sys
2010-06-21 18:31:36 ----D---- C:\Program Files\iPod
2010-06-21 18:31:35 ----D---- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-06-21 18:31:35 ----D---- C:\Program Files\iTunes
2010-06-21 18:30:47 ----D---- C:\ProgramData\Apple Computer
2010-06-21 18:30:47 ----D---- C:\Program Files\QuickTime
2010-06-21 18:30:39 ----D---- C:\Program Files\Apple Software Update
2010-06-21 18:30:04 ----D---- C:\Program Files\Bonjour
2010-06-17 20:19:44 ----D---- C:\Users\***\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2010-06-15 17:47:32 ----D---- C:\Users\***\AppData\Roaming\AlcaTech
2010-06-15 17:47:18 ----A---- C:\Windows\system32\Setup.dll
2010-06-15 17:47:16 ----D---- C:\ProgramData\AlcaTech
2010-06-12 11:45:19 ----D---- C:\Users\***\AppData\Roaming\Adobe Mini Bridge CS5
2010-06-12 11:45:18 ----D---- C:\Users\***\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2010-06-12 11:34:46 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2010-06-12 11:29:24 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-06-12 09:29:30 ----A---- C:\Windows\system32\win32k.sys
2010-06-12 09:29:30 ----A---- C:\Windows\system32\asycfilt.dll
2010-06-12 09:29:29 ----A---- C:\Windows\system32\mshtml.dll
2010-06-12 09:29:28 ----A---- C:\Windows\system32\urlmon.dll
2010-06-12 09:29:28 ----A---- C:\Windows\system32\mstime.dll
2010-06-12 09:29:28 ----A---- C:\Windows\system32\ieframe.dll
2010-06-12 09:29:27 ----A---- C:\Windows\system32\wininet.dll
2010-06-12 09:29:27 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-06-12 09:29:27 ----A---- C:\Windows\system32\jsproxy.dll
2010-06-12 09:29:27 ----A---- C:\Windows\system32\iedkcs32.dll
2010-06-12 09:29:25 ----A---- C:\Windows\system32\atmlib.dll
2010-06-12 09:29:25 ----A---- C:\Windows\system32\atmfd.dll

======List of files/folders modified in the last 1 months======

2010-07-10 18:24:00 ----D---- C:\Program Files
2010-07-10 18:22:22 ----D---- C:\Users\***\AppData\Roaming\ICQ
2010-07-10 18:21:23 ----D---- C:\Windows\Temp
2010-07-10 18:21:15 ----D---- C:\Windows
2010-07-10 18:20:58 ----D---- C:\Windows\system32\drivers
2010-07-10 18:20:58 ----D---- C:\Windows\Logs
2010-07-10 18:10:18 ----D---- C:\ProgramData
2010-07-10 18:05:23 ----D---- C:\Windows\debug
2010-07-10 18:02:55 ----SHD---- C:\System Volume Information
2010-07-10 17:40:29 ----D---- C:\Windows\Tasks
2010-07-10 17:24:32 ----D---- C:\Windows\system32\Tasks
2010-07-10 16:52:51 ----D---- C:\Users\***\AppData\Roaming\GrabIt
2010-07-10 15:17:21 ----D---- C:\Windows\system32\config
2010-07-10 15:08:11 ----D---- C:\Windows\System32
2010-07-10 15:08:11 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-07-10 15:08:10 ----D---- C:\Windows\inf
2010-07-10 15:04:56 ----D---- C:\ProgramData\Microsoft
2010-07-10 15:04:46 ----SD---- C:\Users\***\AppData\Roaming\Microsoft
2010-07-03 14:59:50 ----D---- C:\Windows\Prefetch
2010-07-03 13:57:48 ----SHD---- C:\Windows\Installer
2010-06-29 20:41:07 ----D---- C:\Windows\system32\catroot
2010-06-29 20:40:54 ----D---- C:\Program Files\Raxco
2010-06-29 20:08:22 ----D---- C:\Program Files\Common Files
2010-06-29 20:08:13 ----HD---- C:\Program Files\InstallShield Installation Information
2010-06-29 20:07:34 ----D---- C:\ProgramData\WindSolutions
2010-06-29 20:04:24 ----D---- C:\Program Files\Adobe
2010-06-29 12:22:47 ----D---- C:\Windows\winsxs
2010-06-28 14:20:45 ----SHD---- C:\$Recycle.Bin
2010-06-27 14:54:59 ----D---- C:\Program Files\Mozilla Firefox
2010-06-24 17:49:00 ----D---- C:\Windows\system32\wdi
2010-06-24 16:20:54 ----RSD---- C:\Windows\Fonts
2010-06-24 13:11:33 ----D---- C:\Windows\Microsoft.NET
2010-06-24 13:11:31 ----RSD---- C:\Windows\assembly
2010-06-24 13:02:15 ----D---- C:\Windows\system32\catroot2
2010-06-23 19:33:38 ----D---- C:\Windows\ehome
2010-06-23 19:32:56 ----D---- C:\Windows\system32\de-DE
2010-06-23 19:31:40 ----D---- C:\Windows\system32\en-US
2010-06-23 19:31:40 ----D---- C:\Program Files\Microsoft.NET
2010-06-23 19:30:44 ----D---- C:\Windows\AppPatch
2010-06-21 18:37:24 ----D---- C:\Users\***\AppData\Roaming\Apple Computer
2010-06-21 18:31:35 ----D---- C:\Program Files\Common Files\Apple
2010-06-21 18:31:02 ----D---- C:\Program Files\Internet Explorer
2010-06-21 18:30:30 ----D---- C:\Windows\system32\DriverStore
2010-06-21 15:24:49 ----D---- C:\Users\***\AppData\Roaming\WindSolutions
2010-06-19 11:10:06 ----D---- C:\Program Files\Common Files\DVDVideoSoft
2010-06-15 15:38:22 ----D---- C:\Users\***\AppData\Roaming\Adobe
2010-06-15 15:36:16 ----D---- C:\ProgramData\Adobe
2010-06-12 13:16:11 ----D---- C:\Windows\system32\migration
2010-06-12 11:31:57 ----D---- C:\Program Files\Common Files\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-05-28 691696]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2010-03-01 124784]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2010-02-16 60936]
R2 DefragFS;DefragFS; C:\Windows\system32\drivers\DefragFS.sys [2010-04-07 135184]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2009-07-14 1035776]
R3 b57nd60x;Broadcom NetXtreme-Gigabit-Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 NETw5s32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 32-Bit; C:\Windows\system32\DRIVERS\NETw5s32.sys [2009-09-15 6114816]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-10-10 84992]
R3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2010-04-19 41984]
R3 winbondcir;Winbond IR Transceiver; C:\Windows\system32\DRIVERS\winbondcir.sys [2007-03-28 43008]
R3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 auesbwxk;auesbwxk; C:\Windows\system32\drivers\auesbwxk.sys []
S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\netw5v32.sys [2009-07-14 4231168]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 xnacc;Treiberdienst XBOX 360-Controller für Windows; C:\Windows\system32\DRIVERS\xnacc.sys [2009-07-14 465408]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-04-01 267432]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-06-10 144176]
R2 Bonjour Service;Dienst "Bonjour"; C:\Program Files\Bonjour\mDNSResponder.exe [2010-05-18 345376]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-07-28 211488]
R2 PDAgent;PDAgent; C:\Program Files\Raxco\PerfectDisk\PDAgent.exe [2010-05-27 1565960]
R3 PDEngine;PDEngine; C:\Program Files\Raxco\PerfectDisk\PDEngine.exe [2010-05-27 1471752]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2010-06-15 540472]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

-----------------EOF-----------------