Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Avira meldet BOO/Whistler.A [virus] gefunden (https://www.trojaner-board.de/117269-avira-meldet-boo-whistler-a-virus-gefunden.html)

Robot 13.06.2012 16:52
Avira meldet BOO/Whistler.A [virus] gefunden
 
Hallo

Mein Problem ist folgendes:
Ich bekomme bei jedem Neustart von Windows mehrmals die Meldung BOO/Whistler.A [virus] gefunden. (von Avira Free Antivirus)

Und zwar in:
Laufwerk C
Laufwerk E
Masterbootsektor HD0


Ich habe diese Meldungen erst seit 2 Tagen aber mein Notebook verhält sich schon länger komisch.
Laut Process Hacker laufen mehrere versteckte Prozesse mit Namen iexplore.exe (C:\Programme\Internet Explorer\iexplore.exe)
Ich nutze den IE nicht.

Ich habe ein Notebook mit Windows XP SP3 (32 bit)
Außerdem nutze ich noch 1 externe Festplatte über USB und 2 weitere über eine USB Sata Docking Station (kann immer nur eine Festplatte drin sein).
Ich nehme an, dass die externen Platten auch untersucht werden müssen. Wobei eine komplett leer ist. Ist es dann ausreichend diese zu formatieren?


Ich habe bereits Malwarebytes Anti-Malware laufen lassen.


Den Scan mit OTL habe ich auch durchgeführt allerdings wird nur eine otl.txt und keine extra.txt erstellt. (habs mehrmals versucht)



Ich hoffe es ist möglich mein Daten zu retten. Eine Win XP Neuinstallation ist kein Problem, wollte ich sowieso machen.
Wie gehts jetzt weiter?

Danke schonmal.
Robot

Psychotic 14.06.2012 10:33
:hallo:

Mein Name ist Marius und ich werde dir bei deinem Problem helfen.

Eines vorneweg:

Hinweis: Wir können hier nie dafür garantieren, dass wir sämtliche Reste von Schadsoftware gefunden haben. Eine Formatierung ist meist der schnellste und immer der sicherste Weg.

Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass dein Rechner clean ist.

Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden.
  1. Bitte arbeite alle Schritte der Reihe nach ab.
  2. Lese die Anleitungen sorgfältig. Solltest du irgendwo nicht weiterkommen, stoppe an diesem Punkt und beschreibe dein Problem hier!
  3. Nur Scans durchführen, zu denen du von einem Helfer aufgefordert wirst.
  4. Bitte kein Crossposting (posten in mehreren Foren) - wenn du die Anweisungen mehrere Helfer ausführst, kann das schwere Probleme nach sich ziehen!.
  5. Installiere oder Deinstalliere während der Bereinigung keine Software (ausser, du wurdest dazu aufgefordert).
  6. Wenn etwas unklar ist: Frage, bevor du etwas "blind" machst!

    ...und ganz wichtig:

  7. Poste die Logfiles mit code-tags (das #-Symbol oben im Antwortfenster) in deinen Thread! Nicht anhängen, außer, ich fordere dich dazu auf. (Erschwert mir nämlich das Auswerten).


Vista und Win7 User
Alle Tools mit Rechtsklick --> "als Administrator ausführen" starten.



Schritt 1: defogger


Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.
  • Starte das Tool mit Doppelklick.
    Vista und Win7 User mit Rechtsklick "als Administrator starten".
  • Klicke nun auf den Disable Button um die Treiber gewisser Emulatoren zu deaktivieren.
  • Wenn der Scan beendet wurde ( Finished ), klicke auf OK.
  • Defogger fordert gegebenfalls zum Neustart auf. Bestätige dies mit OK.
Sollte Defogger eine Fehlermeldung ausgeben, poste bitte die defogger_disable Log von deinem Desktop.
Klicke den Re-enable Button nicht ohne Anweisung.



Schritt 2: Gmer



Bitte
  • alle anderen Scanner gegen Viren, Spyware, usw. deaktivieren,
  • keine bestehende Verbindung zu einem Netzwerk/Internet (WLAN nicht vergessen),
  • nichts am Rechner arbeiten,
  • nach jedem Scan der Rechner neu gestarten.
Gmer scannen lassen
  • Lade Dir Gmer von dieser Seite herunter (auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
  • Alle anderen Programme sollen geschlossen sein.
  • Starte gmer.exe (Programm hat einen willkürlichen Programm-Namen). Vista und Win7 User mit Rechtsklick und als Administrator starten.
  • Sollte sich ein Fenster mit folgender Warnung öffnen:
    WARNING !!! GMER has found system modification, which might have been caused by ROOTKIT activity. Do you want to fully scan your system ?
    Unbedingt auf "No" klicken.
  • Entferne rechts den Hacken bei:
    • IAT/EAT
    • Alle Festplatten ausser die Systemplatte (normalerweise ist nur C:\ angehackt)
    • Show all (sollte abgehackt sein)
  • Starte den Scan mit "Scan". Mache nichts am Computer während der Scan läuft.
  • Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.
Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!



Schritt 3: Scan mit TDSS-Killer


Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe
  • Klicke Change parameters, wähle Detect TDLFS file system, klicke OK.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und speichere das Logfile. TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern ( Meistens C:\ ) Als Beispiel: C:\TDSSKiller.<version_date_time>log.txt
Poste den Inhalt bitte hier in deinen Thread.

Robot 14.06.2012 11:23
Hi Marius

Danke das Du dich so schnell um mein Problem kümmern kannst.

defogger habe ich gestern schon ausgeführt. Hab leider vergessen das zu erwähnen.
Ich habe es aber jetzt nocheinmal gemacht. Hier das log:
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:06 on 14/06/2012 (Robert)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
SPTD -> Already disabled


-=E.O.F=-
Soll ich bei den Scans mit Gmer und TDSS-Killler meine externen USB Festplatten einschalten?

Psychotic 14.06.2012 11:33
Nein, nicht nötig

Robot 14.06.2012 16:03
Hier sind die Logfiles

die gmer.txt ist zu lang, deshalb als Anhang.

tdss-Killer
Code:
16:48:39.0468 1500        TDSS rootkit removing tool 2.7.39.0 Jun 14 2012 08:11:46
16:48:39.0546 1500        ============================================================
16:48:39.0546 1500        Current date / time: 2012/06/14 16:48:39.0546
16:48:39.0546 1500        SystemInfo:
16:48:39.0546 1500       
16:48:39.0546 1500        OS Version: 5.1.2600 ServicePack: 3.0
16:48:39.0546 1500        Product type: Workstation
16:48:39.0546 1500        ComputerName: ****
16:48:39.0546 1500        UserName: ****
16:48:39.0546 1500        Windows directory: C:\WINDOWS
16:48:39.0546 1500        System windows directory: C:\WINDOWS
16:48:39.0546 1500        Processor architecture: Intel x86
16:48:39.0546 1500        Number of processors: 1
16:48:39.0546 1500        Page size: 0x1000
16:48:39.0546 1500        Boot type: Normal boot
16:48:39.0546 1500        ============================================================
16:48:43.0328 1500        Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4BB55, SectorsPerTrack: 0x3F, TracksPerCylinder: 0x10, Type 'K0', Flags 0x00000054
16:48:43.0343 1500        ============================================================
16:48:43.0343 1500        \Device\Harddisk0\DR0:
16:48:43.0343 1500        MBR partitions:
16:48:43.0343 1500        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x7722621
16:48:43.0359 1500        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x772269F, BlocksNum 0xB2F6422
16:48:43.0359 1500        ============================================================
16:48:43.0406 1500        C: <-> \Device\Harddisk0\DR0\Partition0
16:48:44.0750 1500        E: <-> \Device\Harddisk0\DR0\Partition1
16:48:44.0750 1500        ============================================================
16:48:44.0750 1500        Initialize success
16:48:44.0750 1500        ============================================================
16:49:19.0562 1952        ============================================================
16:49:19.0562 1952        Scan started
16:49:19.0562 1952        Mode: Manual; TDLFS;
16:49:19.0562 1952        ============================================================
16:49:20.0562 1952        Abiosdsk - ok
16:49:20.0578 1952        abp480n5 - ok
16:49:21.0156 1952        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
16:49:21.0156 1952        ACPI - ok
16:49:21.0234 1952        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
16:49:21.0250 1952        ACPIEC - ok
16:49:21.0781 1952        ADDMEM - ok
16:49:21.0781 1952        adpu160m - ok
16:49:21.0859 1952        aeaudio        (75bee80a25fc7f690dcd57570dc159c1) C:\WINDOWS\system32\drivers\aeaudio.sys
16:49:21.0859 1952        aeaudio - ok
16:49:21.0890 1952        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
16:49:21.0890 1952        aec - ok
16:49:21.0921 1952        AegisP          (023867b6606fbabcdd52e089c4a507da) C:\WINDOWS\system32\DRIVERS\AegisP.sys
16:49:21.0921 1952        AegisP - ok
16:49:21.0968 1952        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
16:49:21.0968 1952        AFD - ok
16:49:22.0078 1952        AgereSoftModem  (029e01cb2938bec5af31bf47b6af0159) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
16:49:22.0125 1952        AgereSoftModem - ok
16:49:22.0125 1952        Aha154x - ok
16:49:22.0140 1952        aic78u2 - ok
16:49:22.0140 1952        aic78xx - ok
16:49:22.0171 1952        Alerter        (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
16:49:22.0187 1952        Alerter - ok
16:49:22.0203 1952        ALG            (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
16:49:22.0203 1952        ALG - ok
16:49:22.0218 1952        AliIde - ok
16:49:22.0218 1952        amsint - ok
16:49:22.0312 1952        AntiVirSchedulerService (a122d68ea2541453f787f341877cb40b) C:\Programme\Avira\AntiVir Desktop\sched.exe
16:49:22.0312 1952        AntiVirSchedulerService - ok
16:49:22.0375 1952        AntiVirService  (2fe359edeb34efcf42574752f8aebd3f) C:\Programme\Avira\AntiVir Desktop\avguard.exe
16:49:22.0375 1952        AntiVirService - ok
16:49:22.0421 1952        AppMgmt        (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll
16:49:22.0453 1952        AppMgmt - ok
16:49:22.0500 1952        Arp1394        (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
16:49:22.0500 1952        Arp1394 - ok
16:49:22.0515 1952        asc - ok
16:49:22.0531 1952        asc3350p - ok
16:49:22.0546 1952        asc3550 - ok
16:49:22.0656 1952        aspnet_state    (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
16:49:22.0671 1952        aspnet_state - ok
16:49:22.0703 1952        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:49:22.0703 1952        AsyncMac - ok
16:49:22.0765 1952        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
16:49:22.0765 1952        atapi - ok
16:49:22.0781 1952        Atdisk - ok
16:49:22.0859 1952        Ati HotKey Poller (2a27a3a8634fb9e29f539d6d3ed3646a) C:\WINDOWS\system32\Ati2evxx.exe
16:49:22.0859 1952        Ati HotKey Poller - ok
16:49:22.0953 1952        ATI Smart      (3ae69ea1af3d65c362869d6dec0cfa52) C:\WINDOWS\system32\ati2sgag.exe
16:49:22.0953 1952        ATI Smart - ok
16:49:23.0281 1952        ati2mtag        (8763ede3e0cd40f5c3450571ac57f205) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
16:49:23.0375 1952        ati2mtag - ok
16:49:23.0531 1952        ATITool        (0e4bb35c5305099ac82053ac992e3e0e) C:\WINDOWS\system32\DRIVERS\ATITool.sys
16:49:23.0531 1952        ATITool - ok
16:49:23.0593 1952        atitray        (6e51838f65c4f5264af489773a53d678) C:\Programme\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys
16:49:23.0593 1952        atitray - ok
16:49:23.0625 1952        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:49:23.0640 1952        Atmarpc - ok
16:49:23.0687 1952        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
16:49:23.0687 1952        AudioSrv - ok
16:49:23.0718 1952        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
16:49:23.0718 1952        audstub - ok
16:49:23.0765 1952        avgntflt        (7713e4eb0276702faa08e52a6e23f2a6) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
16:49:23.0765 1952        avgntflt - ok
16:49:23.0796 1952        avipbb          (13b02b9b969dde270cd7c351203dad3c) C:\WINDOWS\system32\DRIVERS\avipbb.sys
16:49:23.0796 1952        avipbb - ok
16:49:23.0828 1952        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
16:49:23.0828 1952        avkmgr - ok
16:49:23.0875 1952        b57w2k          (4826fcf97c47b361a2e2f68cd487a19e) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
16:49:23.0890 1952        b57w2k - ok
16:49:23.0953 1952        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
16:49:23.0953 1952        Beep - ok
16:49:24.0031 1952        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
16:49:24.0109 1952        BITS - ok
16:49:24.0140 1952        Browser        (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
16:49:24.0140 1952        Browser - ok
16:49:24.0171 1952        BthEnum        (b279426e3c0c344893ed78a613a73bde) C:\WINDOWS\system32\DRIVERS\BthEnum.sys
16:49:24.0171 1952        BthEnum - ok
16:49:24.0218 1952        BthPan          (80602b8746d3738f5886ce3d67ef06b6) C:\WINDOWS\system32\DRIVERS\bthpan.sys
16:49:24.0218 1952        BthPan - ok
16:49:24.0281 1952        BTHPORT        (592e1cedbe314d0ef184dc6f46141e76) C:\WINDOWS\system32\Drivers\BTHport.sys
16:49:24.0296 1952        BTHPORT - ok
16:49:24.0343 1952        BthServ        (26c601ef7525e31379744abfc6f35a1b) C:\WINDOWS\System32\bthserv.dll
16:49:24.0343 1952        BthServ - ok
16:49:24.0359 1952        BTHUSB          (61364cd71ef63b0f038b7e9df00f1efa) C:\WINDOWS\system32\Drivers\BTHUSB.sys
16:49:24.0375 1952        BTHUSB - ok
16:49:24.0406 1952        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
16:49:24.0421 1952        cbidf2k - ok
16:49:24.0421 1952        cd20xrnt - ok
16:49:24.0453 1952        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
16:49:24.0453 1952        Cdaudio - ok
16:49:24.0500 1952        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
16:49:24.0515 1952        Cdfs - ok
16:49:24.0531 1952        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
16:49:24.0531 1952        Cdrom - ok
16:49:24.0546 1952        Changer - ok
16:49:24.0578 1952        CiSvc          (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
16:49:24.0578 1952        CiSvc - ok
16:49:24.0609 1952        ClipSrv        (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
16:49:24.0625 1952        ClipSrv - ok
16:49:24.0703 1952        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:49:24.0703 1952        clr_optimization_v2.0.50727_32 - ok
16:49:24.0765 1952        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
16:49:24.0765 1952        CmBatt - ok
16:49:24.0984 1952        cmdAgent        (a98775f9140d0337f019c381707444a1) C:\Programme\COMODO\COMODO Internet Security\cmdagent.exe
16:49:25.0000 1952        cmdAgent - ok
16:49:25.0140 1952        cmdGuard        (dd530ee7d9efbb0ec42aebe7226b8a93) C:\WINDOWS\system32\DRIVERS\cmdguard.sys
16:49:25.0140 1952        cmdGuard - ok
16:49:25.0156 1952        cmdHlp          (07cbbe993ed08a52dafac1e6cf27b6a5) C:\WINDOWS\system32\DRIVERS\cmdhlp.sys
16:49:25.0171 1952        cmdHlp - ok
16:49:25.0171 1952        CmdIde - ok
16:49:25.0203 1952        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
16:49:25.0218 1952        Compbatt - ok
16:49:25.0234 1952        COMSysApp - ok
16:49:25.0250 1952        Cpqarray - ok
16:49:25.0296 1952        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
16:49:25.0296 1952        CryptSvc - ok
16:49:25.0312 1952        dac2w2k - ok
16:49:25.0312 1952        dac960nt - ok
16:49:25.0375 1952        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
16:49:25.0390 1952        DcomLaunch - ok
16:49:25.0406 1952        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
16:49:25.0406 1952        Dhcp - ok
16:49:25.0437 1952        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
16:49:25.0453 1952        Disk - ok
16:49:25.0468 1952        dmadmin - ok
16:49:25.0578 1952        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
16:49:25.0625 1952        dmboot - ok
16:49:25.0656 1952        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
16:49:25.0671 1952        dmio - ok
16:49:25.0718 1952        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
16:49:25.0718 1952        dmload - ok
16:49:25.0781 1952        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
16:49:25.0796 1952        dmserver - ok
16:49:25.0828 1952        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
16:49:25.0828 1952        DMusic - ok
16:49:25.0875 1952        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
16:49:25.0875 1952        Dnscache - ok
16:49:25.0921 1952        DOSMEMIO        (8a4cb9438571814b128b6dc30d698064) C:\WINDOWS\system32\MEMIO.SYS
16:49:25.0921 1952        DOSMEMIO - ok
16:49:25.0984 1952        Dot3svc        (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
16:49:26.0000 1952        Dot3svc - ok
16:49:26.0015 1952        dpti2o - ok
16:49:26.0031 1952        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
16:49:26.0031 1952        drmkaud - ok
16:49:26.0062 1952        EapHost        (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
16:49:26.0078 1952        EapHost - ok
16:49:26.0125 1952        ERSvc          (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
16:49:26.0140 1952        ERSvc - ok
16:49:26.0187 1952        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
16:49:26.0187 1952        Eventlog - ok
16:49:26.0218 1952        EventSystem    (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
16:49:26.0234 1952        EventSystem - ok
16:49:26.0390 1952        EvtEng          (e2d3e74c02abe0fb2169a541ce976aac) C:\Programme\Intel\Wireless\Bin\EvtEng.exe
16:49:26.0484 1952        EvtEng - ok
16:49:26.0546 1952        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
16:49:26.0562 1952        Fastfat - ok
16:49:26.0609 1952        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
16:49:26.0609 1952        FastUserSwitchingCompatibility - ok
16:49:26.0625 1952        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
16:49:26.0625 1952        Fdc - ok
16:49:26.0640 1952        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
16:49:26.0640 1952        Fips - ok
16:49:26.0656 1952        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
16:49:26.0656 1952        Flpydisk - ok
16:49:26.0703 1952        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
16:49:26.0718 1952        FltMgr - ok
16:49:26.0796 1952        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
16:49:26.0796 1952        FontCache3.0.0.0 - ok
16:49:26.0828 1952        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
16:49:26.0828 1952        Fs_Rec - ok
16:49:26.0843 1952        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:49:26.0859 1952        Ftdisk - ok
16:49:26.0890 1952        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
16:49:26.0890 1952        Gpc - ok
16:49:26.0984 1952        helpsvc        (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
16:49:26.0984 1952        helpsvc - ok
16:49:27.0031 1952        HidServ        (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
16:49:27.0031 1952        HidServ - ok
16:49:27.0046 1952        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
16:49:27.0046 1952        HidUsb - ok
16:49:27.0093 1952        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
16:49:27.0109 1952        hkmsvc - ok
16:49:27.0125 1952        hpn - ok
16:49:27.0171 1952        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
16:49:27.0187 1952        HTTP - ok
16:49:27.0218 1952        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
16:49:27.0218 1952        HTTPFilter - ok
16:49:27.0234 1952        i2omgmt - ok
16:49:27.0250 1952        i2omp - ok
16:49:27.0281 1952        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:49:27.0281 1952        i8042prt - ok
16:49:27.0406 1952        idsvc          (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:49:27.0484 1952        idsvc - ok
16:49:27.0500 1952        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
16:49:27.0500 1952        Imapi - ok
16:49:27.0546 1952        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
16:49:27.0562 1952        ImapiService - ok
16:49:27.0578 1952        ini910u - ok
16:49:27.0640 1952        Inspect        (8154a2c13b72b08db11157673c60c3eb) C:\WINDOWS\system32\DRIVERS\inspect.sys
16:49:27.0656 1952        Inspect - ok
16:49:27.0671 1952        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
16:49:27.0671 1952        IntelIde - ok
16:49:27.0703 1952        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
16:49:27.0703 1952        intelppm - ok
16:49:27.0750 1952        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
16:49:27.0765 1952        Ip6Fw - ok
16:49:27.0796 1952        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:49:27.0796 1952        IpFilterDriver - ok
16:49:27.0812 1952        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
16:49:27.0828 1952        IpInIp - ok
16:49:27.0859 1952        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
16:49:27.0875 1952        IpNat - ok
16:49:27.0890 1952        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
16:49:27.0890 1952        IPSec - ok
16:49:27.0921 1952        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
16:49:27.0921 1952        IRENUM - ok
16:49:27.0937 1952        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
16:49:27.0953 1952        isapnp - ok
16:49:28.0093 1952        JavaQuickStarterService (9aa67569d5257462e230767510b0c815) C:\Programme\Java\jre6\bin\jqs.exe
16:49:28.0093 1952        JavaQuickStarterService - ok
16:49:28.0125 1952        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:49:28.0125 1952        Kbdclass - ok
16:49:28.0171 1952        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
16:49:28.0171 1952        kbdhid - ok
16:49:28.0203 1952        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
16:49:28.0218 1952        kmixer - ok
16:49:28.0265 1952        KProcessHacker2 (42868dcfd4ad0b089a65ff51bc2a6578) C:\Programme\Process Hacker 2\kprocesshacker.sys
16:49:28.0265 1952        KProcessHacker2 - ok
16:49:28.0312 1952        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
16:49:28.0328 1952        KSecDD - ok
16:49:28.0375 1952        lanmanserver    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
16:49:28.0390 1952        lanmanserver - ok
16:49:28.0421 1952        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
16:49:28.0437 1952        lanmanworkstation - ok
16:49:28.0437 1952        lbrtfdc - ok
16:49:28.0484 1952        LmHosts        (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
16:49:28.0484 1952        LmHosts - ok
16:49:28.0515 1952        Messenger      (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
16:49:28.0531 1952        Messenger - ok
16:49:28.0593 1952        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
16:49:28.0593 1952        mnmdd - ok
16:49:28.0640 1952        mnmsrvc        (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
16:49:28.0640 1952        mnmsrvc - ok
16:49:28.0671 1952        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
16:49:28.0687 1952        Modem - ok
16:49:28.0703 1952        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
16:49:28.0703 1952        Mouclass - ok
16:49:28.0750 1952        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
16:49:28.0750 1952        mouhid - ok
16:49:28.0765 1952        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
16:49:28.0781 1952        MountMgr - ok
16:49:28.0828 1952        MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
16:49:28.0828 1952        MozillaMaintenance - ok
16:49:28.0843 1952        mraid35x - ok
16:49:28.0875 1952        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:49:28.0875 1952        MRxDAV - ok
16:49:28.0937 1952        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:49:28.0953 1952        MRxSmb - ok
16:49:29.0015 1952        MSDTC          (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
16:49:29.0015 1952        MSDTC - ok
16:49:29.0031 1952        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
16:49:29.0031 1952        Msfs - ok
16:49:29.0031 1952        MSIServer - ok
16:49:29.0078 1952        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
16:49:29.0078 1952        MSKSSRV - ok
16:49:29.0093 1952        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:49:29.0093 1952        MSPCLOCK - ok
16:49:29.0125 1952        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
16:49:29.0125 1952        MSPQM - ok
16:49:29.0156 1952        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:49:29.0156 1952        mssmbios - ok
16:49:29.0171 1952        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
16:49:29.0187 1952        Mup - ok
16:49:29.0250 1952        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
16:49:29.0281 1952        napagent - ok
16:49:29.0312 1952        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
16:49:29.0343 1952        NDIS - ok
16:49:29.0375 1952        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
16:49:29.0375 1952        NdisTapi - ok
16:49:29.0406 1952        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
16:49:29.0406 1952        Ndisuio - ok
16:49:29.0437 1952        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
16:49:29.0437 1952        NdisWan - ok
16:49:29.0484 1952        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
16:49:29.0484 1952        NDProxy - ok
16:49:29.0500 1952        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
16:49:29.0515 1952        NetBIOS - ok
16:49:29.0546 1952        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
16:49:29.0546 1952        NetBT - ok
16:49:29.0593 1952        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
16:49:29.0609 1952        NetDDE - ok
16:49:29.0625 1952        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
16:49:29.0625 1952        NetDDEdsdm - ok
16:49:29.0656 1952        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
16:49:29.0656 1952        Netlogon - ok
16:49:29.0687 1952        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
16:49:29.0703 1952        Netman - ok
16:49:29.0781 1952        NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:49:29.0812 1952        NetTcpPortSharing - ok
16:49:29.0843 1952        nhcDriverDevice (37260a293b6a89373ae76791e6cc5a12) C:\WINDOWS\system32\drivers\nhcDriver.sys
16:49:29.0843 1952        nhcDriverDevice - ok
16:49:29.0875 1952        NIC1394        (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
16:49:29.0890 1952        NIC1394 - ok
16:49:29.0953 1952        Nla            (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
16:49:29.0953 1952        Nla - ok
16:49:30.0015 1952        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
16:49:30.0015 1952        Npfs - ok
16:49:30.0078 1952        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
16:49:30.0109 1952        Ntfs - ok
16:49:30.0125 1952        NtLmSsp        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
16:49:30.0125 1952        NtLmSsp - ok
16:49:30.0187 1952        NtmsSvc        (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
16:49:30.0234 1952        NtmsSvc - ok
16:49:30.0250 1952        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
16:49:30.0250 1952        Null - ok
16:49:30.0281 1952        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
16:49:30.0296 1952        NwlnkFlt - ok
16:49:30.0312 1952        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
16:49:30.0328 1952        NwlnkFwd - ok
16:49:30.0343 1952        ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
16:49:30.0343 1952        ohci1394 - ok
16:49:30.0406 1952        ose            (7a56cf3e3f12e8af599963b16f50fb6a) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
16:49:30.0421 1952        ose - ok
16:49:30.0453 1952        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
16:49:30.0453 1952        Parport - ok
16:49:30.0468 1952        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
16:49:30.0484 1952        PartMgr - ok
16:49:30.0515 1952        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
16:49:30.0531 1952        ParVdm - ok
16:49:30.0546 1952        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
16:49:30.0562 1952        PCI - ok
16:49:30.0578 1952        PCIDump - ok
16:49:30.0593 1952        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
16:49:30.0609 1952        PCIIde - ok
16:49:30.0625 1952        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
16:49:30.0640 1952        Pcmcia - ok
16:49:30.0656 1952        PDCOMP - ok
16:49:30.0656 1952        PDFRAME - ok
16:49:30.0671 1952        PDRELI - ok
16:49:30.0671 1952        PDRFRAME - ok
16:49:30.0687 1952        perc2 - ok
16:49:30.0687 1952        perc2hib - ok
16:49:30.0765 1952        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
16:49:30.0781 1952        PlugPlay - ok
16:49:30.0781 1952        PolicyAgent    (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
16:49:30.0781 1952        PolicyAgent - ok
16:49:30.0796 1952        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
16:49:30.0812 1952        PptpMiniport - ok
16:49:30.0812 1952        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
16:49:30.0812 1952        ProtectedStorage - ok
16:49:30.0828 1952        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
16:49:30.0828 1952        PSched - ok
16:49:30.0859 1952        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
16:49:30.0859 1952        Ptilink - ok
16:49:30.0890 1952        PxHelp20        (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
16:49:30.0906 1952        PxHelp20 - ok
16:49:30.0921 1952        ql1080 - ok
16:49:30.0921 1952        Ql10wnt - ok
16:49:30.0921 1952        ql12160 - ok
16:49:30.0937 1952        ql1240 - ok
16:49:30.0953 1952        ql1280 - ok
16:49:30.0984 1952        R592            (028f5ab62b4a4bc16b63676eb9901bf8) C:\WINDOWS\system32\DRIVERS\R592.sys
16:49:31.0000 1952        R592 - ok
16:49:31.0000 1952        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
16:49:31.0000 1952        RasAcd - ok
16:49:31.0031 1952        RasAuto        (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
16:49:31.0046 1952        RasAuto - ok
16:49:31.0078 1952        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
16:49:31.0078 1952        Rasl2tp - ok
16:49:31.0125 1952        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
16:49:31.0140 1952        RasMan - ok
16:49:31.0156 1952        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
16:49:31.0156 1952        RasPppoe - ok
16:49:31.0156 1952        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
16:49:31.0156 1952        Raspti - ok
16:49:31.0187 1952        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
16:49:31.0203 1952        Rdbss - ok
16:49:31.0203 1952        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:49:31.0203 1952        RDPCDD - ok
16:49:31.0234 1952        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
16:49:31.0234 1952        rdpdr - ok
16:49:31.0281 1952        RDPWD          (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
16:49:31.0296 1952        RDPWD - ok
16:49:31.0343 1952        RDSessMgr      (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
16:49:31.0343 1952        RDSessMgr - ok
16:49:31.0390 1952        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
16:49:31.0390 1952        redbook - ok
16:49:31.0515 1952        RegSrvc        (098ba55ef5f540dba0d578c5a2ae3e01) C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
16:49:31.0531 1952        RegSrvc - ok
16:49:31.0578 1952        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
16:49:31.0593 1952        RemoteAccess - ok
16:49:31.0625 1952        RemoteRegistry  (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll
16:49:31.0640 1952        RemoteRegistry - ok
16:49:31.0671 1952        RFCOMM          (851c30df2807fcfa21e4c681a7d6440e) C:\WINDOWS\system32\DRIVERS\rfcomm.sys
16:49:31.0687 1952        RFCOMM - ok
16:49:31.0734 1952        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
16:49:31.0734 1952        RpcLocator - ok
16:49:31.0828 1952        RpcSs          (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
16:49:31.0828 1952        RpcSs - ok
16:49:31.0875 1952        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
16:49:31.0875 1952        RSVP - ok
16:49:32.0000 1952        S24EventMonitor (6344c0a1f7aef8aa1ec1f37b77437494) C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
16:49:32.0031 1952        S24EventMonitor - ok
16:49:32.0062 1952        s24trans        (c26a053e4db47f6cdd8653c83aaf22ee) C:\WINDOWS\system32\DRIVERS\s24trans.sys
16:49:32.0062 1952        s24trans - ok
16:49:32.0093 1952        SamSs          (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
16:49:32.0093 1952        SamSs - ok
16:49:32.0171 1952        Samsung Update Plus - ok
16:49:32.0218 1952        SANDRA          (230fd3749904ca045ea5ec0aa14006e9) C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP4a\WNt500x86\Sandra.sys
16:49:32.0234 1952        SANDRA - ok
16:49:32.0265 1952        SandraAgentSrv  (dd063e84112e3cca3773d594d97259c8) C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP4a\RpcAgentSrv.exe
16:49:32.0265 1952        SandraAgentSrv - ok
16:49:32.0296 1952        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
16:49:32.0296 1952        SCardSvr - ok
16:49:32.0390 1952        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
16:49:32.0406 1952        Schedule - ok
16:49:32.0453 1952        sdbus          (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
16:49:32.0453 1952        sdbus - ok
16:49:32.0500 1952        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
16:49:32.0500 1952        Secdrv - ok
16:49:32.0531 1952        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
16:49:32.0531 1952        seclogon - ok
16:49:32.0546 1952        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
16:49:32.0562 1952        SENS - ok
16:49:32.0578 1952        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
16:49:32.0578 1952        Serial - ok
16:49:32.0625 1952        sffdisk        (0fa803c64df0914b41f807ea276bf2a6) C:\WINDOWS\system32\DRIVERS\sffdisk.sys
16:49:32.0625 1952        sffdisk - ok
16:49:32.0640 1952        sffp_sd        (c17c331e435ed8737525c86a7557b3ac) C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
16:49:32.0656 1952        sffp_sd - ok
16:49:32.0671 1952        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
16:49:32.0671 1952        Sfloppy - ok
16:49:32.0734 1952        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
16:49:32.0750 1952        SharedAccess - ok
16:49:32.0796 1952        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
16:49:32.0796 1952        ShellHWDetection - ok
16:49:32.0812 1952        Simbad - ok
16:49:32.0875 1952        smwdm          (854786d53c11ea9842f51176b139bd4b) C:\WINDOWS\system32\drivers\smwdm.sys
16:49:32.0875 1952        smwdm - ok
16:49:32.0937 1952        SoundMAX Agent Service (default) (3978f082274f723ad5a0a8058c2417dd) C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
16:49:32.0937 1952        SoundMAX Agent Service (default) - ok
16:49:32.0953 1952        Sparrow - ok
16:49:33.0031 1952        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
16:49:33.0031 1952        splitter - ok
16:49:33.0078 1952        Spooler        (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
16:49:33.0078 1952        Spooler - ok
16:49:33.0171 1952        sptd            (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\System32\Drivers\sptd.sys
16:49:33.0234 1952        sptd - ok
16:49:33.0250 1952        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
16:49:33.0265 1952        sr - ok
16:49:33.0312 1952        srservice      (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
16:49:33.0312 1952        srservice - ok
16:49:33.0375 1952        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
16:49:33.0375 1952        Srv - ok
16:49:33.0421 1952        SSDPSRV        (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
16:49:33.0437 1952        SSDPSRV - ok
16:49:33.0484 1952        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
16:49:33.0484 1952        ssmdrv - ok
16:49:33.0515 1952        StarOpen        (306521935042fc0a6988d528643619b3) C:\WINDOWS\system32\drivers\StarOpen.sys
16:49:33.0515 1952        StarOpen - ok
16:49:33.0578 1952        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
16:49:33.0609 1952        stisvc - ok
16:49:33.0656 1952        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
16:49:33.0656 1952        swenum - ok
16:49:33.0671 1952        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
16:49:33.0671 1952        swmidi - ok
16:49:33.0687 1952        SwPrv - ok
16:49:33.0687 1952        symc810 - ok
16:49:33.0703 1952        symc8xx - ok
16:49:33.0703 1952        sym_hi - ok
16:49:33.0718 1952        sym_u3 - ok
16:49:33.0750 1952        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
16:49:33.0750 1952        sysaudio - ok
16:49:33.0765 1952        SysmonLog      (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
16:49:33.0765 1952        SysmonLog - ok
16:49:33.0812 1952        TapiSrv        (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
16:49:33.0812 1952        TapiSrv - ok
16:49:33.0890 1952        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
16:49:33.0890 1952        Tcpip - ok
16:49:33.0921 1952        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
16:49:33.0937 1952        TDPIPE - ok
16:49:33.0953 1952        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
16:49:33.0953 1952        TDTCP - ok
16:49:34.0000 1952        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
16:49:34.0000 1952        TermDD - ok
16:49:34.0062 1952        TermService    (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
16:49:34.0078 1952        TermService - ok
16:49:34.0125 1952        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
16:49:34.0125 1952        Themes - ok
16:49:34.0171 1952        TlntSvr        (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\system32\tlntsvr.exe
16:49:34.0187 1952        TlntSvr - ok
16:49:34.0187 1952        TosIde - ok
16:49:34.0218 1952        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
16:49:34.0234 1952        TrkWks - ok
16:49:34.0250 1952        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
16:49:34.0265 1952        Udfs - ok
16:49:34.0281 1952        ultra - ok
16:49:34.0328 1952        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
16:49:34.0343 1952        Update - ok
16:49:34.0406 1952        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
16:49:34.0421 1952        upnphost - ok
16:49:34.0453 1952        UPS            (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
16:49:34.0453 1952        UPS - ok
16:49:34.0515 1952        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:49:34.0531 1952        usbccgp - ok
16:49:34.0578 1952        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
16:49:34.0578 1952        usbehci - ok
16:49:34.0593 1952        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
16:49:34.0609 1952        usbhub - ok
16:49:34.0640 1952        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:49:34.0640 1952        USBSTOR - ok
16:49:34.0656 1952        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
16:49:34.0656 1952        usbuhci - ok
16:49:34.0671 1952        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
16:49:34.0671 1952        VgaSave - ok
16:49:34.0671 1952        ViaIde - ok
16:49:34.0687 1952        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
16:49:34.0703 1952        VolSnap - ok
16:49:34.0812 1952        VSS            (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
16:49:34.0828 1952        VSS - ok
16:49:35.0031 1952        w29n51          (a22abd73e0d6ba666cba4e86eeb001b3) C:\WINDOWS\system32\DRIVERS\w29n51.sys
16:49:35.0140 1952        w29n51 - ok
16:49:35.0281 1952        W32Time        (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
16:49:35.0281 1952        W32Time - ok
16:49:35.0343 1952        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
16:49:35.0343 1952        Wanarp - ok
16:49:35.0359 1952        WDICA - ok
16:49:35.0390 1952        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
16:49:35.0390 1952        wdmaud - ok
16:49:35.0421 1952        WebClient      (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
16:49:35.0421 1952        WebClient - ok
16:49:35.0500 1952        winmgmt        (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
16:49:35.0500 1952        winmgmt - ok
16:49:35.0562 1952        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
16:49:35.0578 1952        WmdmPmSN - ok
16:49:35.0671 1952        Wmi            (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll
16:49:35.0703 1952        Wmi - ok
16:49:35.0765 1952        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
16:49:35.0765 1952        WmiApSrv - ok
16:49:35.0906 1952        WMPNetworkSvc  (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
16:49:36.0000 1952        WMPNetworkSvc - ok
16:49:36.0062 1952        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
16:49:36.0062 1952        wscsvc - ok
16:49:36.0078 1952        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
16:49:36.0093 1952        wuauserv - ok
16:49:36.0156 1952        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
16:49:36.0171 1952        WudfPf - ok
16:49:36.0203 1952        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
16:49:36.0218 1952        WudfRd - ok
16:49:36.0250 1952        WudfSvc        (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
16:49:36.0265 1952        WudfSvc - ok
16:49:36.0343 1952        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
16:49:36.0359 1952        WZCSVC - ok
16:49:36.0421 1952        xmlprov        (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
16:49:36.0437 1952        xmlprov - ok
16:49:36.0500 1952        MBR (0x1B8)    (d5e3886b06ca267325513abf88a00427) \Device\Harddisk0\DR0
16:49:36.0531 1952        \Device\Harddisk0\DR0 ( Rootkit.Boot.Wistler.a ) - infected
16:49:36.0531 1952        \Device\Harddisk0\DR0 - detected Rootkit.Boot.Wistler.a (0)
16:49:36.0656 1952        Boot (0x1200)  (94fb89f0716bd2edc9560b54c11d35e1) \Device\Harddisk0\DR0\Partition0
16:49:36.0656 1952        \Device\Harddisk0\DR0\Partition0 - ok
16:49:36.0671 1952        Boot (0x1200)  (8bfe847d9fbd1c8b8e5f73d2c05b199a) \Device\Harddisk0\DR0\Partition1
16:49:36.0671 1952        \Device\Harddisk0\DR0\Partition1 - ok
16:49:36.0671 1952        ============================================================
16:49:36.0671 1952        Scan finished
16:49:36.0671 1952        ============================================================
16:49:36.0687 0192        Detected object count: 1
16:49:36.0687 0192        Actual detected object count: 1
16:49:54.0312 0192        \Device\Harddisk0\DR0 ( Rootkit.Boot.Wistler.a ) - skipped by user
16:49:54.0312 0192        \Device\Harddisk0\DR0 ( Rootkit.Boot.Wistler.a ) - User select action: Skip
16:51:13.0312 3308        Deinitialize success

Psychotic 15.06.2012 06:25
Poste mir bitte noch die Extras.txt von OTL. Du findest sie unter C:\_OTL.

Robot 15.06.2012 09:05
Liste der Anhänge anzeigen (Anzahl: 1)
Ich habe leider keine extra.txt auf meinem Rechner. Die Suchfunktion hat auch nichts zu Tage gefördert.
Nach dem Beenden des Scans von OTL wird immer nur eine otl.txt erstellt.

Ich habe einen Screenshot von OTL gemacht. Sind die Einstellungen so richtig?
(ich habe nichts verändert)

Psychotic 15.06.2012 09:11
Aktiviere bei "Extra-Registrierung" Benutze Safelist! ;)

Robot 15.06.2012 09:37
Sobald ich QuickScan starte springt die Einstellung von "Benutze Safelist" auf "Aus" zurück und es gibt wieder nur eine otl.txt. :wtf:

Psychotic 15.06.2012 10:10
Oh, pardon...versuchs mal mit dem "SCAN"-Button! :D

Robot 15.06.2012 10:37
Juhu jetzt hat es geklappt. :daumenhoc

otl.txt
Code:
OTL logfile created on: 15.06.2012 11:13:20 - Run 6
OTL by OldTimer - Version 3.2.48.0    Folder = C:\Dokumente und Einstellungen\***\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1022,17 Mb Total Physical Memory | 494,87 Mb Available Physical Memory | 48,41% Memory free
2,40 Gb Paging File | 1,96 Gb Available in Paging File | 81,65% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 59,57 Gb Total Space | 4,61 Gb Free Space | 7,73% Space Free | Partition Type: NTFS
Drive E: | 89,48 Gb Total Space | 0,78 Gb Free Space | 0,87% Space Free | Partition Type: NTFS
 
Computer Name: BLACKNOTE | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
PRC - C:\Programme\COMODO\COMODO Internet Security\cfp.exe (COMODO)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
PRC - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Samsung Update Plus) -- C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe File not found
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (cmdAgent) -- C:\Programme\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (SandraAgentSrv) -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP4a\RpcAgentSrv.exe (SiSoftware)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (SoundMAX Agent Service (default)) -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCIDump) --  File not found
DRV - (lbrtfdc) --  File not found
DRV - (i2omgmt) --  File not found
DRV - (Changer) --  File not found
DRV - (ADDMEM) -- C:\DOKUME~1\***\LOKALE~1\Temp\__Samsung_Update\ADDMEM.SYS File not found
DRV - (nhcDriverDevice) -- C:\WINDOWS\system32\drivers\nhcDriver.sys (pBUS-167 Software - hxxp://www.pbus-167.com)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\WINDOWS\system32\drivers\avkmgr.sys (Avira GmbH)
DRV - (KProcessHacker2) -- C:\Programme\Process Hacker 2\kprocesshacker.sys (wj32)
DRV - (Inspect) -- C:\WINDOWS\system32\drivers\inspect.sys (COMODO)
DRV - (cmdHlp) -- C:\WINDOWS\system32\drivers\cmdhlp.sys (COMODO)
DRV - (cmdGuard) -- C:\WINDOWS\system32\drivers\cmdGuard.sys (COMODO)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (sptd) -- C:\WINDOWS\system32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (SANDRA) -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP4a\WNt500x86\sandra.sys (SiSoftware)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (atitray) -- C:\Programme\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys ()
DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (ATITool) -- C:\WINDOWS\system32\drivers\ATITool.sys ()
DRV - (StarOpen) -- C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (b57w2k) Broadcom NetLink (TM) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (R592) -- C:\WINDOWS\system32\drivers\R592.sys (REDC)
DRV - (DOSMEMIO) -- C:\WINDOWS\system32\MEMIO.SYS ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\..\SearchScopes,DefaultScope = {B63622CE-394E-4D34-A1D4-7806642E58BB}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=IE8SRC&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{B63622CE-394E-4D34-A1D4-7806642E58BB}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9
FF - prefs.js..extensions.enabledItems: anycolor.pavlos256@gmail.com:0.3.3
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.5
FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.15.1
FF - prefs.js..extensions.enabledItems: {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}:0.4.6
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.1.2.5
FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..network.proxy.http: "107.22.164.23"
FF - prefs.js..network.proxy.http_port: 3128
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Programme\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Programme\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Programme\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Programme\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.2.183.39\npGoogleOneClick8.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.04.25 10:36:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.12 09:57:11 | 000,000,000 | ---D | M]
 
[2009.07.16 17:05:35 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions
[2012.06.13 13:53:36 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\d9z0v5dg.default\extensions
[2011.01.24 13:57:40 | 000,000,000 | ---D | M] (Image Zoom) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\d9z0v5dg.default\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}
[2010.11.15 10:13:45 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\d9z0v5dg.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.07.18 09:18:38 | 000,000,000 | ---D | M] (Flashblock) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\d9z0v5dg.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2011.01.24 13:57:40 | 000,000,000 | ---D | M] (Web Developer) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\d9z0v5dg.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2012.05.28 18:08:14 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\d9z0v5dg.default\extensions\ich@maltegoetz.de
[2009.11.03 10:42:15 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\d9z0v5dg.default\extensions\moveplayer@movenetworks.com
[2012.03.28 13:59:13 | 000,000,000 | ---D | M] (vShare) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\d9z0v5dg.default\extensions\vshare@toolbar
[2012.01.21 12:01:10 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.06.04 08:55:36 | 000,505,801 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\D9Z0V5DG.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI
[2012.06.13 13:53:36 | 000,525,301 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\D9Z0V5DG.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
[2012.01.06 18:22:33 | 000,634,964 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\D9Z0V5DG.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.04.25 10:36:26 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012.03.04 15:15:16 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.03.04 15:15:16 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.03.04 15:15:16 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.03.04 15:15:16 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.03.04 15:15:15 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.03.04 15:15:15 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\18.0.1025.142\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\18.0.1025.142\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\18.0.1025.142\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Programme\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.300.12 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U30 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Programme\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = C:\Programme\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll
CHR - plugin: Google Update (Enabled) = C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Veetle TV Player (Enabled) = C:\Programme\Veetle\Player\npvlc.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Programme\Veetle\plugins\npVeetle.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Programme\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: AdBlock = C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.34_0\
 
O1 HOSTS File: ([2010.07.17 11:26:06 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AtiPTA] C:\WINDOWS\System32\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Programme\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [NotebookHardwareControl] C:\Programme\Notebook Hardware Control\nhc.exe (hxxp://www.pbus-167.com)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1247825290156 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} hxxp://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5CD9E82C-1DA6-4F24-A96C-9A361C128F44}: NameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\WINDOWS\system32\guard32.dll) - C:\WINDOWS\system32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.07.16 16:24:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.14 16:42:52 | 002,127,448 | ---- | C] (Kaspersky Lab ZAO) -- C:\Dokumente und Einstellungen\***\Desktop\tdsskiller.exe
[2012.06.13 17:02:42 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2012.06.12 13:45:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Proxure
[2012.06.12 13:44:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ClubSanDisk
[2012.06.10 11:43:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\Irada 1.4o (2011-02-17)
[2012.06.08 18:46:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\Logs
[2012.06.08 18:45:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\SiSoftware
[2012.06.08 18:44:56 | 000,000,000 | ---D | C] -- C:\Programme\SiSoftware
[2012.06.04 19:53:03 | 000,426,184 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012.06.04 19:53:03 | 000,070,344 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\Dokumente und Einstellungen\***\*.tmp files -> C:\Dokumente und Einstellungen\***\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.15 10:44:15 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2012.06.15 09:57:27 | 000,116,822 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\OTL.JPG
[2012.06.14 16:46:06 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.14 16:46:03 | 000,022,528 | ---- | M] (pBUS-167 Software - hxxp://www.pbus-167.com) -- C:\WINDOWS\System32\drivers\nhcDriver.sys
[2012.06.14 16:45:21 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.14 16:45:18 | 1071,890,432 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.14 16:42:49 | 002,127,448 | ---- | M] (Kaspersky Lab ZAO) -- C:\Dokumente und Einstellungen\***\Desktop\tdsskiller.exe
[2012.06.14 12:13:23 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\4k4n2j1v.exe
[2012.06.13 13:49:43 | 000,000,020 | ---- | M] () -- C:\Dokumente und Einstellungen\***\defogger_reenable
[2012.06.13 13:27:58 | 000,112,640 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.06.12 15:37:34 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.09 14:15:43 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012.06.09 14:15:42 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012.06.09 14:13:56 | 000,000,691 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk
[2012.06.08 18:45:39 | 000,001,003 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SiSoftware Sandra Lite 2012.SP4a.lnk
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\Dokumente und Einstellungen\***\*.tmp files -> C:\Dokumente und Einstellungen\***\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.15 09:57:27 | 000,116,822 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\OTL.JPG
[2012.06.14 12:13:26 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\4k4n2j1v.exe
[2012.06.13 13:49:25 | 000,000,020 | ---- | C] () -- C:\Dokumente und Einstellungen\***\defogger_reenable
[2012.06.12 15:47:02 | 000,075,744 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012.06.12 15:37:34 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.09 14:13:56 | 000,000,691 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk
[2012.06.08 18:47:37 | 011,567,104 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Sandra.mdb
[2012.06.08 18:45:39 | 000,001,003 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SiSoftware Sandra Lite 2012.SP4a.lnk
[2012.03.24 12:31:27 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.01.23 11:05:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2010.10.11 09:19:49 | 000,000,000 | ---- | C] () -- C:\WINDOWS\DbgOut.INI
[2010.08.29 10:34:51 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LauncherAccess.dt
[2010.08.29 10:28:28 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2010.07.26 09:29:05 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
 
========== LOP Check ==========
 
[2012.06.12 13:44:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ClubSanDisk
[2009.09.30 19:31:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2012.03.27 12:15:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreeHideIP
[2011.02.05 01:05:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\mNjAmMm09000
[2011.03.31 18:15:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\oJjPgLc06504
[2010.07.23 15:40:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\14DC811A43A8FAC44BA6A65FF4A1AE7F
[2012.04.10 19:02:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\AVM
[2009.09.30 19:33:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\DAEMON Tools Lite
[2011.11.16 13:45:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\DVDVideoSoft
[2012.03.27 12:15:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\FreeHideIP
[2009.07.19 23:48:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\IEPro
[2011.11.16 19:34:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mp3tag
[2009.11.14 17:40:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\NeatImage SL
[2009.07.17 09:32:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\OfficeUpdate12
[2009.10.31 18:53:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Opera
[2010.08.10 18:11:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Process Hacker 2
[2010.08.29 11:42:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Samsung
[2012.01.23 12:41:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Teleca
 
========== Purity Check ==========
 
 

< End of report >
extra.txt
Code:
OTL Extras logfile created on: 15.06.2012 11:13:20 - Run 6
OTL by OldTimer - Version 3.2.48.0    Folder = C:\Dokumente und Einstellungen\***\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1022,17 Mb Total Physical Memory | 494,87 Mb Available Physical Memory | 48,41% Memory free
2,40 Gb Paging File | 1,96 Gb Available in Paging File | 81,65% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 59,57 Gb Total Space | 4,61 Gb Free Space | 7,73% Space Free | Partition Type: NTFS
Drive E: | 89,48 Gb Total Space | 0,78 Gb Free Space | 0,87% Space Free | Partition Type: NTFS
 
Computer Name: BLACKNOTE | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\eMule\emule.exe" = C:\Programme\eMule\emule.exe:*:Enabled:eMule
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Disabled:Firefox -- (Mozilla Corporation)
"C:\Programme\Opera\opera.exe" = C:\Programme\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP4a\RpcAgentSrv.exe" = C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP4a\RpcAgentSrv.exe:*:Enabled:SiSoftware Deployment Agent Service -- (SiSoftware)
"C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP4a\WNt500x86\RpcSandraSrv.exe" = C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP4a\WNt500x86\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service -- (SiSoftware)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 30
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7FF00365-0D54-48DF-B494-F7852EA41FCD}" = MultiMemoryCardDriver
"{829CD169-E692-48E8-9BDE-A3E8D8B65538}" = mSCfg
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{91120407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{AEB9948B-4FF2-47C9-990E-47014492A0FE}" = MSXML 6.0 Parser
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{B98A55FE-758D-4828-D398-F7196D6D5DD3}" = ATI Catalyst Install Manager
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1" = SiSoftware Sandra Lite 2012.SP4a
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{EFADD989-D9F2-49F6-A280-675951CC78D3}" = FRITZ!Box-Fernzugang einrichten
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FD8E178D-8B4E-42DA-B434-EFF270329B1C}" = COMODO Internet Security
"7-Zip" = 7-Zip 4.65
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = SENS LT56ADW Modem
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira Free Antivirus
"CCleaner" = CCleaner
"CDex" = CDex extraction audio
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Free Audio Converter_is1" = Free Audio Converter version 2.3.4.920
"ie8" = Windows Internet Explorer 8
"IrfanView" = IrfanView (remove only)
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 5.0.0
"LinuxLive USB Creator" = LinuxLive USB Creator
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Mp3tag" = Mp3tag v2.49a
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MultiRes (remove only)" = MultiRes (remove only)
"Notebook Hardware Control" = Notebook Hardware Control 2.0 Pre-Release-06
"Opera 11.61.1250" = Opera 11.61
"Process_Hacker2_is1" = Process Hacker 2.27 (r4957)
"ProInst" = Intel(R) PROSet/Wireless Software
"Radeon Omega Drivers for Windows XP/2kv4.8.442" = Radeon Omega Drivers v4.8.442 Setup Files and Tools
"Veetle TV" = Veetle TV 0.9.18
"VLC media player" = VLC media player 2.0.1
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 05.07.2011 04:36:34 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.4127,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x0000100b.
 
Error - 12.07.2011 04:00:56 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.4127,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x0000100b.
 
Error - 20.07.2011 03:49:46 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.4127,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x0000100b.
 
Error - 28.07.2011 10:46:34 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung divx player.exe, Version 7.2.0.19, fehlgeschlagenes
 Modul atioglxx.dll, Version 6.14.10.7169, Fehleradresse 0x000d898c.
 
Error - 07.08.2011 11:29:28 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.4127,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x0000100b.
 
Error - 09.08.2011 11:23:21 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.4127,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x0000100b.
 
Error - 22.08.2011 04:34:50 | Computer Name = BLACKNOTE | Source = ESENT | ID = 490
Description = svchost (1256) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 30.08.2011 12:18:06 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung podplayer.exe, Version 1.5.0.0, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x5d457512.
 
Error - 30.08.2011 12:18:19 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung podplayer.exe, Version 1.5.0.0, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x5d457512.
 
Error - 30.08.2011 12:24:20 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung podplayer.exe, Version 1.7.0.1, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x5d457512.
 
[ Application Events ]
Error - 05.07.2011 04:36:34 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.4127,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x0000100b.
 
Error - 12.07.2011 04:00:56 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.4127,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x0000100b.
 
Error - 20.07.2011 03:49:46 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.4127,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x0000100b.
 
Error - 28.07.2011 10:46:34 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung divx player.exe, Version 7.2.0.19, fehlgeschlagenes
 Modul atioglxx.dll, Version 6.14.10.7169, Fehleradresse 0x000d898c.
 
Error - 07.08.2011 11:29:28 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.4127,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x0000100b.
 
Error - 09.08.2011 11:23:21 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.4127,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x0000100b.
 
Error - 22.08.2011 04:34:50 | Computer Name = BLACKNOTE | Source = ESENT | ID = 490
Description = svchost (1256) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 30.08.2011 12:18:06 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung podplayer.exe, Version 1.5.0.0, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x5d457512.
 
Error - 30.08.2011 12:18:19 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung podplayer.exe, Version 1.5.0.0, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x5d457512.
 
Error - 30.08.2011 12:24:20 | Computer Name = BLACKNOTE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung podplayer.exe, Version 1.7.0.1, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x5d457512.
 
[ System Events ]
Error - 12.06.2012 09:26:01 | Computer Name = BLACKNOTE | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
 Bibliothek SanDisk Cruzer Slice USB Device nicht laden.
 
Error - 12.06.2012 10:18:43 | Computer Name = BLACKNOTE | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
Error - 12.06.2012 11:04:26 | Computer Name = BLACKNOTE | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
Error - 13.06.2012 04:05:27 | Computer Name = BLACKNOTE | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  IntelIde
 
Error - 13.06.2012 06:08:21 | Computer Name = BLACKNOTE | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
Error - 13.06.2012 06:49:08 | Computer Name = BLACKNOTE | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
Error - 13.06.2012 06:52:39 | Computer Name = BLACKNOTE | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
Error - 13.06.2012 07:21:34 | Computer Name = BLACKNOTE | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
Error - 13.06.2012 08:24:24 | Computer Name = BLACKNOTE | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
Error - 15.06.2012 03:39:34 | Computer Name = BLACKNOTE | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
 
< End of report >

Psychotic 15.06.2012 10:45
TDSS-Killer

Starte TDSSkiller.exe mit Doppelklick.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Klicke Change parameters, wähle Detect TDLFS file system, klicke OK.
  • Drücke auf Start Scan.
    Mache während dem Scan nichts am Rechner
  • Gehe sicher das Cure ( default ) angehakt ist !
  • Drücke Continue --> Reboot.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern ( Meistens C:\ )
Als Beispiel: C:\TDSSKiller.<version_date_time>log.txt

Poste den Inhalt bitte hier in deinen Thread.

Robot 15.06.2012 11:02
Avira hat jetzt beim Neustart keinen Fund mehr angezeigt.

Hier ist das Log von TDSSKiller

Code:
11:52:13.0984 1740        TDSS rootkit removing tool 2.7.39.0 Jun 14 2012 08:11:46
11:52:14.0062 1740        ============================================================
11:52:14.0062 1740        Current date / time: 2012/06/15 11:52:14.0062
11:52:14.0062 1740        SystemInfo:
11:52:14.0062 1740       
11:52:14.0062 1740        OS Version: 5.1.2600 ServicePack: 3.0
11:52:14.0062 1740        Product type: Workstation
11:52:14.0062 1740        ComputerName: BLACKNOTE
11:52:14.0062 1740        UserName: ***
11:52:14.0062 1740        Windows directory: C:\WINDOWS
11:52:14.0062 1740        System windows directory: C:\WINDOWS
11:52:14.0062 1740        Processor architecture: Intel x86
11:52:14.0062 1740        Number of processors: 1
11:52:14.0062 1740        Page size: 0x1000
11:52:14.0062 1740        Boot type: Normal boot
11:52:14.0062 1740        ============================================================
11:52:16.0250 1740        Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4BB55, SectorsPerTrack: 0x3F, TracksPerCylinder: 0x10, Type 'K0', Flags 0x00000054
11:52:16.0250 1740        ============================================================
11:52:16.0250 1740        \Device\Harddisk0\DR0:
11:52:16.0250 1740        MBR partitions:
11:52:16.0250 1740        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x7722621
11:52:16.0265 1740        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x772269F, BlocksNum 0xB2F6422
11:52:16.0265 1740        ============================================================
11:52:16.0312 1740        C: <-> \Device\Harddisk0\DR0\Partition0
11:52:16.0718 1740        E: <-> \Device\Harddisk0\DR0\Partition1
11:52:16.0718 1740        ============================================================
11:52:16.0718 1740        Initialize success
11:52:16.0718 1740        ============================================================
11:53:21.0281 1952        ============================================================
11:53:21.0281 1952        Scan started
11:53:21.0281 1952        Mode: Manual;
11:53:21.0281 1952        ============================================================
11:53:21.0921 1952        Abiosdsk - ok
11:53:21.0921 1952        abp480n5 - ok
11:53:21.0984 1952        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
11:53:21.0984 1952        ACPI - ok
11:53:22.0015 1952        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
11:53:22.0015 1952        ACPIEC - ok
11:53:22.0156 1952        ADDMEM - ok
11:53:22.0156 1952        adpu160m - ok
11:53:22.0218 1952        aeaudio        (75bee80a25fc7f690dcd57570dc159c1) C:\WINDOWS\system32\drivers\aeaudio.sys
11:53:22.0218 1952        aeaudio - ok
11:53:22.0265 1952        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
11:53:22.0265 1952        aec - ok
11:53:22.0296 1952        AegisP          (023867b6606fbabcdd52e089c4a507da) C:\WINDOWS\system32\DRIVERS\AegisP.sys
11:53:22.0296 1952        AegisP - ok
11:53:22.0343 1952        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
11:53:22.0343 1952        AFD - ok
11:53:22.0453 1952        AgereSoftModem  (029e01cb2938bec5af31bf47b6af0159) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
11:53:22.0484 1952        AgereSoftModem - ok
11:53:22.0500 1952        Aha154x - ok
11:53:22.0500 1952        aic78u2 - ok
11:53:22.0515 1952        aic78xx - ok
11:53:22.0546 1952        Alerter        (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
11:53:22.0546 1952        Alerter - ok
11:53:22.0578 1952        ALG            (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
11:53:22.0578 1952        ALG - ok
11:53:22.0593 1952        AliIde - ok
11:53:22.0593 1952        amsint - ok
11:53:22.0687 1952        AntiVirSchedulerService (a122d68ea2541453f787f341877cb40b) C:\Programme\Avira\AntiVir Desktop\sched.exe
11:53:22.0703 1952        AntiVirSchedulerService - ok
11:53:22.0750 1952        AntiVirService  (2fe359edeb34efcf42574752f8aebd3f) C:\Programme\Avira\AntiVir Desktop\avguard.exe
11:53:22.0765 1952        AntiVirService - ok
11:53:22.0812 1952        AppMgmt        (d45960be52c3c610d361977057f98c54) C:\WINDOWS\System32\appmgmts.dll
11:53:22.0812 1952        AppMgmt - ok
11:53:22.0859 1952        Arp1394        (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
11:53:22.0859 1952        Arp1394 - ok
11:53:22.0875 1952        asc - ok
11:53:22.0875 1952        asc3350p - ok
11:53:22.0890 1952        asc3550 - ok
11:53:23.0000 1952        aspnet_state    (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
11:53:23.0000 1952        aspnet_state - ok
11:53:23.0031 1952        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
11:53:23.0031 1952        AsyncMac - ok
11:53:23.0062 1952        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
11:53:23.0062 1952        atapi - ok
11:53:23.0078 1952        Atdisk - ok
11:53:23.0156 1952        Ati HotKey Poller (2a27a3a8634fb9e29f539d6d3ed3646a) C:\WINDOWS\system32\Ati2evxx.exe
11:53:23.0171 1952        Ati HotKey Poller - ok
11:53:23.0250 1952        ATI Smart      (3ae69ea1af3d65c362869d6dec0cfa52) C:\WINDOWS\system32\ati2sgag.exe
11:53:23.0265 1952        ATI Smart - ok
11:53:23.0578 1952        ati2mtag        (8763ede3e0cd40f5c3450571ac57f205) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
11:53:23.0687 1952        ati2mtag - ok
11:53:23.0828 1952        ATITool        (0e4bb35c5305099ac82053ac992e3e0e) C:\WINDOWS\system32\DRIVERS\ATITool.sys
11:53:23.0828 1952        ATITool - ok
11:53:23.0890 1952        atitray        (6e51838f65c4f5264af489773a53d678) C:\Programme\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys
11:53:23.0890 1952        atitray - ok
11:53:23.0921 1952        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
11:53:23.0921 1952        Atmarpc - ok
11:53:23.0968 1952        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
11:53:23.0968 1952        AudioSrv - ok
11:53:24.0015 1952        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
11:53:24.0015 1952        audstub - ok
11:53:24.0062 1952        avgntflt        (7713e4eb0276702faa08e52a6e23f2a6) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
11:53:24.0062 1952        avgntflt - ok
11:53:24.0093 1952        avipbb          (13b02b9b969dde270cd7c351203dad3c) C:\WINDOWS\system32\DRIVERS\avipbb.sys
11:53:24.0093 1952        avipbb - ok
11:53:24.0125 1952        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
11:53:24.0125 1952        avkmgr - ok
11:53:24.0171 1952        b57w2k          (4826fcf97c47b361a2e2f68cd487a19e) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
11:53:24.0187 1952        b57w2k - ok
11:53:24.0234 1952        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
11:53:24.0234 1952        Beep - ok
11:53:24.0312 1952        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
11:53:24.0328 1952        BITS - ok
11:53:24.0375 1952        Browser        (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
11:53:24.0375 1952        Browser - ok
11:53:24.0406 1952        BthEnum        (b279426e3c0c344893ed78a613a73bde) C:\WINDOWS\system32\DRIVERS\BthEnum.sys
11:53:24.0406 1952        BthEnum - ok
11:53:24.0437 1952        BthPan          (80602b8746d3738f5886ce3d67ef06b6) C:\WINDOWS\system32\DRIVERS\bthpan.sys
11:53:24.0437 1952        BthPan - ok
11:53:24.0484 1952        BTHPORT        (592e1cedbe314d0ef184dc6f46141e76) C:\WINDOWS\system32\Drivers\BTHport.sys
11:53:24.0484 1952        BTHPORT - ok
11:53:24.0531 1952        BthServ        (26c601ef7525e31379744abfc6f35a1b) C:\WINDOWS\System32\bthserv.dll
11:53:24.0531 1952        BthServ - ok
11:53:24.0562 1952        BTHUSB          (61364cd71ef63b0f038b7e9df00f1efa) C:\WINDOWS\system32\Drivers\BTHUSB.sys
11:53:24.0562 1952        BTHUSB - ok
11:53:24.0609 1952        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
11:53:24.0609 1952        cbidf2k - ok
11:53:24.0609 1952        cd20xrnt - ok
11:53:24.0640 1952        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
11:53:24.0640 1952        Cdaudio - ok
11:53:24.0687 1952        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
11:53:24.0687 1952        Cdfs - ok
11:53:24.0718 1952        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
11:53:24.0734 1952        Cdrom - ok
11:53:24.0734 1952        Changer - ok
11:53:24.0781 1952        CiSvc          (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
11:53:24.0781 1952        CiSvc - ok
11:53:24.0796 1952        ClipSrv        (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
11:53:24.0812 1952        ClipSrv - ok
11:53:24.0890 1952        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:53:24.0890 1952        clr_optimization_v2.0.50727_32 - ok
11:53:24.0937 1952        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
11:53:24.0937 1952        CmBatt - ok
11:53:25.0140 1952        cmdAgent        (a98775f9140d0337f019c381707444a1) C:\Programme\COMODO\COMODO Internet Security\cmdagent.exe
11:53:25.0203 1952        cmdAgent - ok
11:53:25.0328 1952        cmdGuard        (dd530ee7d9efbb0ec42aebe7226b8a93) C:\WINDOWS\system32\DRIVERS\cmdguard.sys
11:53:25.0328 1952        cmdGuard - ok
11:53:25.0343 1952        cmdHlp          (07cbbe993ed08a52dafac1e6cf27b6a5) C:\WINDOWS\system32\DRIVERS\cmdhlp.sys
11:53:25.0343 1952        cmdHlp - ok
11:53:25.0359 1952        CmdIde - ok
11:53:25.0390 1952        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
11:53:25.0390 1952        Compbatt - ok
11:53:25.0390 1952        COMSysApp - ok
11:53:25.0421 1952        Cpqarray - ok
11:53:25.0468 1952        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
11:53:25.0468 1952        CryptSvc - ok
11:53:25.0484 1952        dac2w2k - ok
11:53:25.0500 1952        dac960nt - ok
11:53:25.0562 1952        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
11:53:25.0578 1952        DcomLaunch - ok
11:53:25.0593 1952        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
11:53:25.0593 1952        Dhcp - ok
11:53:25.0609 1952        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
11:53:25.0609 1952        Disk - ok
11:53:25.0625 1952        dmadmin - ok
11:53:25.0718 1952        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
11:53:25.0734 1952        dmboot - ok
11:53:25.0765 1952        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
11:53:25.0781 1952        dmio - ok
11:53:25.0812 1952        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
11:53:25.0812 1952        dmload - ok
11:53:25.0843 1952        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
11:53:25.0843 1952        dmserver - ok
11:53:25.0875 1952        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
11:53:25.0890 1952        DMusic - ok
11:53:25.0921 1952        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
11:53:25.0937 1952        Dnscache - ok
11:53:25.0968 1952        DOSMEMIO        (8a4cb9438571814b128b6dc30d698064) C:\WINDOWS\system32\MEMIO.SYS
11:53:25.0968 1952        DOSMEMIO - ok
11:53:26.0015 1952        Dot3svc        (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
11:53:26.0031 1952        Dot3svc - ok
11:53:26.0046 1952        dpti2o - ok
11:53:26.0062 1952        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
11:53:26.0062 1952        drmkaud - ok
11:53:26.0093 1952        EapHost        (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
11:53:26.0093 1952        EapHost - ok
11:53:26.0140 1952        ERSvc          (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
11:53:26.0140 1952        ERSvc - ok
11:53:26.0203 1952        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
11:53:26.0203 1952        Eventlog - ok
11:53:26.0250 1952        EventSystem    (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\system32\es.dll
11:53:26.0265 1952        EventSystem - ok
11:53:26.0421 1952        EvtEng          (e2d3e74c02abe0fb2169a541ce976aac) C:\Programme\Intel\Wireless\Bin\EvtEng.exe
11:53:26.0437 1952        EvtEng - ok
11:53:26.0500 1952        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
11:53:26.0500 1952        Fastfat - ok
11:53:26.0578 1952        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
11:53:26.0578 1952        FastUserSwitchingCompatibility - ok
11:53:26.0609 1952        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
11:53:26.0609 1952        Fdc - ok
11:53:26.0640 1952        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
11:53:26.0640 1952        Fips - ok
11:53:26.0640 1952        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
11:53:26.0656 1952        Flpydisk - ok
11:53:26.0671 1952        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
11:53:26.0687 1952        FltMgr - ok
11:53:26.0781 1952        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
11:53:26.0781 1952        FontCache3.0.0.0 - ok
11:53:26.0812 1952        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
11:53:26.0812 1952        Fs_Rec - ok
11:53:26.0828 1952        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
11:53:26.0828 1952        Ftdisk - ok
11:53:26.0859 1952        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
11:53:26.0859 1952        Gpc - ok
11:53:26.0890 1952        helpsvc        (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
11:53:26.0906 1952        helpsvc - ok
11:53:26.0921 1952        HidServ        (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
11:53:26.0921 1952        HidServ - ok
11:53:26.0953 1952        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
11:53:26.0953 1952        HidUsb - ok
11:53:27.0000 1952        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
11:53:27.0015 1952        hkmsvc - ok
11:53:27.0015 1952        hpn - ok
11:53:27.0078 1952        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
11:53:27.0093 1952        HTTP - ok
11:53:27.0109 1952        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
11:53:27.0109 1952        HTTPFilter - ok
11:53:27.0125 1952        i2omgmt - ok
11:53:27.0140 1952        i2omp - ok
11:53:27.0171 1952        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
11:53:27.0171 1952        i8042prt - ok
11:53:27.0296 1952        idsvc          (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
11:53:27.0312 1952        idsvc - ok
11:53:27.0328 1952        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
11:53:27.0343 1952        Imapi - ok
11:53:27.0390 1952        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\system32\imapi.exe
11:53:27.0390 1952        ImapiService - ok
11:53:27.0406 1952        ini910u - ok
11:53:27.0468 1952        Inspect        (8154a2c13b72b08db11157673c60c3eb) C:\WINDOWS\system32\DRIVERS\inspect.sys
11:53:27.0468 1952        Inspect - ok
11:53:27.0484 1952        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
11:53:27.0484 1952        IntelIde - ok
11:53:27.0531 1952        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
11:53:27.0531 1952        intelppm - ok
11:53:27.0562 1952        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
11:53:27.0562 1952        Ip6Fw - ok
11:53:27.0593 1952        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
11:53:27.0593 1952        IpFilterDriver - ok
11:53:27.0625 1952        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
11:53:27.0625 1952        IpInIp - ok
11:53:27.0671 1952        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
11:53:27.0671 1952        IpNat - ok
11:53:27.0687 1952        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
11:53:27.0703 1952        IPSec - ok
11:53:27.0718 1952        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
11:53:27.0718 1952        IRENUM - ok
11:53:27.0750 1952        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
11:53:27.0750 1952        isapnp - ok
11:53:27.0875 1952        JavaQuickStarterService (9aa67569d5257462e230767510b0c815) C:\Programme\Java\jre6\bin\jqs.exe
11:53:27.0875 1952        JavaQuickStarterService - ok
11:53:27.0921 1952        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
11:53:27.0921 1952        Kbdclass - ok
11:53:27.0968 1952        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
11:53:27.0968 1952        kbdhid - ok
11:53:28.0000 1952        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
11:53:28.0000 1952        kmixer - ok
11:53:28.0046 1952        KProcessHacker2 (42868dcfd4ad0b089a65ff51bc2a6578) C:\Programme\Process Hacker 2\kprocesshacker.sys
11:53:28.0046 1952        KProcessHacker2 - ok
11:53:28.0093 1952        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
11:53:28.0093 1952        KSecDD - ok
11:53:28.0140 1952        lanmanserver    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
11:53:28.0140 1952        lanmanserver - ok
11:53:28.0187 1952        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
11:53:28.0187 1952        lanmanworkstation - ok
11:53:28.0203 1952        lbrtfdc - ok
11:53:28.0250 1952        LmHosts        (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
11:53:28.0250 1952        LmHosts - ok
11:53:28.0281 1952        Messenger      (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
11:53:28.0281 1952        Messenger - ok
11:53:28.0312 1952        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
11:53:28.0312 1952        mnmdd - ok
11:53:28.0359 1952        mnmsrvc        (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\system32\mnmsrvc.exe
11:53:28.0359 1952        mnmsrvc - ok
11:53:28.0390 1952        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
11:53:28.0390 1952        Modem - ok
11:53:28.0421 1952        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
11:53:28.0421 1952        Mouclass - ok
11:53:28.0468 1952        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
11:53:28.0468 1952        mouhid - ok
11:53:28.0484 1952        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
11:53:28.0484 1952        MountMgr - ok
11:53:28.0531 1952        MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
11:53:28.0546 1952        MozillaMaintenance - ok
11:53:28.0546 1952        mraid35x - ok
11:53:28.0578 1952        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
11:53:28.0578 1952        MRxDAV - ok
11:53:28.0640 1952        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
11:53:28.0656 1952        MRxSmb - ok
11:53:28.0687 1952        MSDTC          (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\system32\msdtc.exe
11:53:28.0703 1952        MSDTC - ok
11:53:28.0718 1952        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
11:53:28.0718 1952        Msfs - ok
11:53:28.0718 1952        MSIServer - ok
11:53:28.0750 1952        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
11:53:28.0750 1952        MSKSSRV - ok
11:53:28.0765 1952        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
11:53:28.0765 1952        MSPCLOCK - ok
11:53:28.0781 1952        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
11:53:28.0781 1952        MSPQM - ok
11:53:28.0812 1952        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
11:53:28.0812 1952        mssmbios - ok
11:53:28.0843 1952        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
11:53:28.0843 1952        Mup - ok
11:53:28.0906 1952        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
11:53:28.0921 1952        napagent - ok
11:53:28.0953 1952        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
11:53:28.0968 1952        NDIS - ok
11:53:29.0000 1952        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
11:53:29.0000 1952        NdisTapi - ok
11:53:29.0031 1952        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
11:53:29.0031 1952        Ndisuio - ok
11:53:29.0062 1952        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
11:53:29.0062 1952        NdisWan - ok
11:53:29.0093 1952        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
11:53:29.0093 1952        NDProxy - ok
11:53:29.0109 1952        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
11:53:29.0125 1952        NetBIOS - ok
11:53:29.0156 1952        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
11:53:29.0156 1952        NetBT - ok
11:53:29.0203 1952        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
11:53:29.0203 1952        NetDDE - ok
11:53:29.0218 1952        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
11:53:29.0218 1952        NetDDEdsdm - ok
11:53:29.0281 1952        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:53:29.0281 1952        Netlogon - ok
11:53:29.0312 1952        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
11:53:29.0328 1952        Netman - ok
11:53:29.0390 1952        NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
11:53:29.0390 1952        NetTcpPortSharing - ok
11:53:29.0437 1952        nhcDriverDevice (37260a293b6a89373ae76791e6cc5a12) C:\WINDOWS\system32\drivers\nhcDriver.sys
11:53:29.0437 1952        nhcDriverDevice - ok
11:53:29.0468 1952        NIC1394        (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
11:53:29.0468 1952        NIC1394 - ok
11:53:29.0515 1952        Nla            (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
11:53:29.0531 1952        Nla - ok
11:53:29.0593 1952        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
11:53:29.0593 1952        Npfs - ok
11:53:29.0640 1952        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
11:53:29.0671 1952        Ntfs - ok
11:53:29.0671 1952        NtLmSsp        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:53:29.0671 1952        NtLmSsp - ok
11:53:29.0750 1952        NtmsSvc        (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
11:53:29.0765 1952        NtmsSvc - ok
11:53:29.0796 1952        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
11:53:29.0796 1952        Null - ok
11:53:29.0828 1952        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
11:53:29.0828 1952        NwlnkFlt - ok
11:53:29.0843 1952        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
11:53:29.0843 1952        NwlnkFwd - ok
11:53:29.0859 1952        ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
11:53:29.0859 1952        ohci1394 - ok
11:53:29.0921 1952        ose            (7a56cf3e3f12e8af599963b16f50fb6a) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
11:53:29.0921 1952        ose - ok
11:53:29.0968 1952        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
11:53:29.0968 1952        Parport - ok
11:53:29.0984 1952        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
11:53:29.0984 1952        PartMgr - ok
11:53:30.0015 1952        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
11:53:30.0031 1952        ParVdm - ok
11:53:30.0046 1952        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
11:53:30.0046 1952        PCI - ok
11:53:30.0046 1952        PCIDump - ok
11:53:30.0078 1952        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
11:53:30.0078 1952        PCIIde - ok
11:53:30.0109 1952        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
11:53:30.0109 1952        Pcmcia - ok
11:53:30.0125 1952        PDCOMP - ok
11:53:30.0125 1952        PDFRAME - ok
11:53:30.0140 1952        PDRELI - ok
11:53:30.0156 1952        PDRFRAME - ok
11:53:30.0156 1952        perc2 - ok
11:53:30.0171 1952        perc2hib - ok
11:53:30.0234 1952        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
11:53:30.0234 1952        PlugPlay - ok
11:53:30.0250 1952        PolicyAgent    (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:53:30.0250 1952        PolicyAgent - ok
11:53:30.0281 1952        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
11:53:30.0281 1952        PptpMiniport - ok
11:53:30.0281 1952        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:53:30.0296 1952        ProtectedStorage - ok
11:53:30.0312 1952        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
11:53:30.0312 1952        PSched - ok
11:53:30.0343 1952        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
11:53:30.0343 1952        Ptilink - ok
11:53:30.0375 1952        PxHelp20        (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
11:53:30.0375 1952        PxHelp20 - ok
11:53:30.0375 1952        ql1080 - ok
11:53:30.0390 1952        Ql10wnt - ok
11:53:30.0406 1952        ql12160 - ok
11:53:30.0406 1952        ql1240 - ok
11:53:30.0421 1952        ql1280 - ok
11:53:30.0437 1952        R592            (028f5ab62b4a4bc16b63676eb9901bf8) C:\WINDOWS\system32\DRIVERS\R592.sys
11:53:30.0453 1952        R592 - ok
11:53:30.0453 1952        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
11:53:30.0453 1952        RasAcd - ok
11:53:30.0484 1952        RasAuto        (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
11:53:30.0500 1952        RasAuto - ok
11:53:30.0515 1952        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
11:53:30.0515 1952        Rasl2tp - ok
11:53:30.0562 1952        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
11:53:30.0578 1952        RasMan - ok
11:53:30.0593 1952        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
11:53:30.0593 1952        RasPppoe - ok
11:53:30.0609 1952        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
11:53:30.0609 1952        Raspti - ok
11:53:30.0625 1952        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
11:53:30.0640 1952        Rdbss - ok
11:53:30.0656 1952        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
11:53:30.0656 1952        RDPCDD - ok
11:53:30.0687 1952        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
11:53:30.0687 1952        rdpdr - ok
11:53:30.0750 1952        RDPWD          (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
11:53:30.0750 1952        RDPWD - ok
11:53:30.0796 1952        RDSessMgr      (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
11:53:30.0812 1952        RDSessMgr - ok
11:53:30.0828 1952        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
11:53:30.0843 1952        redbook - ok
11:53:30.0953 1952        RegSrvc        (098ba55ef5f540dba0d578c5a2ae3e01) C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
11:53:30.0968 1952        RegSrvc - ok
11:53:31.0031 1952        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
11:53:31.0031 1952        RemoteAccess - ok
11:53:31.0078 1952        RemoteRegistry  (e4cd1f3d84e1c2ca0b8cf7501e201593) C:\WINDOWS\system32\regsvc.dll
11:53:31.0093 1952        RemoteRegistry - ok
11:53:31.0125 1952        RFCOMM          (851c30df2807fcfa21e4c681a7d6440e) C:\WINDOWS\system32\DRIVERS\rfcomm.sys
11:53:31.0125 1952        RFCOMM - ok
11:53:31.0171 1952        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\system32\locator.exe
11:53:31.0171 1952        RpcLocator - ok
11:53:31.0234 1952        RpcSs          (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
11:53:31.0250 1952        RpcSs - ok
11:53:31.0281 1952        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\system32\rsvp.exe
11:53:31.0296 1952        RSVP - ok
11:53:31.0406 1952        S24EventMonitor (6344c0a1f7aef8aa1ec1f37b77437494) C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
11:53:31.0437 1952        S24EventMonitor - ok
11:53:31.0468 1952        s24trans        (c26a053e4db47f6cdd8653c83aaf22ee) C:\WINDOWS\system32\DRIVERS\s24trans.sys
11:53:31.0484 1952        s24trans - ok
11:53:31.0515 1952        SamSs          (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
11:53:31.0515 1952        SamSs - ok
11:53:31.0593 1952        Samsung Update Plus - ok
11:53:31.0640 1952        SANDRA          (230fd3749904ca045ea5ec0aa14006e9) C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP4a\WNt500x86\Sandra.sys
11:53:31.0640 1952        SANDRA - ok
11:53:31.0671 1952        SandraAgentSrv  (dd063e84112e3cca3773d594d97259c8) C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP4a\RpcAgentSrv.exe
11:53:31.0671 1952        SandraAgentSrv - ok
11:53:31.0734 1952        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
11:53:31.0750 1952        SCardSvr - ok
11:53:31.0796 1952        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
11:53:31.0812 1952        Schedule - ok
11:53:31.0843 1952        sdbus          (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
11:53:31.0843 1952        sdbus - ok
11:53:31.0890 1952        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
11:53:31.0890 1952        Secdrv - ok
11:53:31.0921 1952        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
11:53:31.0921 1952        seclogon - ok
11:53:31.0937 1952        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
11:53:31.0937 1952        SENS - ok
11:53:31.0968 1952        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
11:53:31.0968 1952        Serial - ok
11:53:32.0000 1952        sffdisk        (0fa803c64df0914b41f807ea276bf2a6) C:\WINDOWS\system32\DRIVERS\sffdisk.sys
11:53:32.0015 1952        sffdisk - ok
11:53:32.0031 1952        sffp_sd        (c17c331e435ed8737525c86a7557b3ac) C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
11:53:32.0031 1952        sffp_sd - ok
11:53:32.0046 1952        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
11:53:32.0046 1952        Sfloppy - ok
11:53:32.0109 1952        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
11:53:32.0125 1952        SharedAccess - ok
11:53:32.0187 1952        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
11:53:32.0187 1952        ShellHWDetection - ok
11:53:32.0203 1952        Simbad - ok
11:53:32.0265 1952        smwdm          (854786d53c11ea9842f51176b139bd4b) C:\WINDOWS\system32\drivers\smwdm.sys
11:53:32.0281 1952        smwdm - ok
11:53:32.0343 1952        SoundMAX Agent Service (default) (3978f082274f723ad5a0a8058c2417dd) C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
11:53:32.0343 1952        SoundMAX Agent Service (default) - ok
11:53:32.0359 1952        Sparrow - ok
11:53:32.0406 1952        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
11:53:32.0406 1952        splitter - ok
11:53:32.0453 1952        Spooler        (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
11:53:32.0468 1952        Spooler - ok
11:53:32.0562 1952        sptd            (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\System32\Drivers\sptd.sys
11:53:32.0578 1952        sptd - ok
11:53:32.0593 1952        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
11:53:32.0593 1952        sr - ok
11:53:32.0921 1952        srservice      (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\system32\srsvc.dll
11:53:32.0953 1952        srservice - ok
11:53:34.0218 1952        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
11:53:34.0265 1952        Srv - ok
11:53:34.0312 1952        SSDPSRV        (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
11:53:34.0312 1952        SSDPSRV - ok
11:53:34.0359 1952        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
11:53:34.0359 1952        ssmdrv - ok
11:53:34.0375 1952        StarOpen        (306521935042fc0a6988d528643619b3) C:\WINDOWS\system32\drivers\StarOpen.sys
11:53:34.0375 1952        StarOpen - ok
11:53:34.0421 1952        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
11:53:34.0421 1952        stisvc - ok
11:53:34.0468 1952        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
11:53:34.0468 1952        swenum - ok
11:53:34.0484 1952        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
11:53:34.0484 1952        swmidi - ok
11:53:34.0500 1952        SwPrv - ok
11:53:34.0500 1952        symc810 - ok
11:53:34.0515 1952        symc8xx - ok
11:53:34.0515 1952        sym_hi - ok
11:53:34.0531 1952        sym_u3 - ok
11:53:34.0562 1952        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
11:53:34.0562 1952        sysaudio - ok
11:53:34.0578 1952        SysmonLog      (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
11:53:34.0578 1952        SysmonLog - ok
11:53:34.0609 1952        TapiSrv        (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
11:53:34.0609 1952        TapiSrv - ok
11:53:34.0671 1952        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
11:53:34.0687 1952        Tcpip - ok
11:53:34.0718 1952        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
11:53:34.0718 1952        TDPIPE - ok
11:53:34.0750 1952        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
11:53:34.0750 1952        TDTCP - ok
11:53:34.0765 1952        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
11:53:34.0765 1952        TermDD - ok
11:53:34.0812 1952        TermService    (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
11:53:34.0828 1952        TermService - ok
11:53:34.0875 1952        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
11:53:34.0875 1952        Themes - ok
11:53:34.0906 1952        TlntSvr        (03681a1ce77f51586903869a5ab1deab) C:\WINDOWS\system32\tlntsvr.exe
11:53:34.0921 1952        TlntSvr - ok
11:53:34.0921 1952        TosIde - ok
11:53:34.0953 1952        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
11:53:34.0968 1952        TrkWks - ok
11:53:35.0000 1952        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
11:53:35.0000 1952        Udfs - ok
11:53:35.0015 1952        ultra - ok
11:53:35.0062 1952        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
11:53:35.0078 1952        Update - ok
11:53:35.0109 1952        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
11:53:35.0109 1952        upnphost - ok
11:53:35.0140 1952        UPS            (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
11:53:35.0140 1952        UPS - ok
11:53:35.0187 1952        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
11:53:35.0187 1952        usbccgp - ok
11:53:35.0234 1952        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
11:53:35.0234 1952        usbehci - ok
11:53:35.0265 1952        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
11:53:35.0265 1952        usbhub - ok
11:53:35.0312 1952        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
11:53:35.0312 1952        USBSTOR - ok
11:53:35.0328 1952        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
11:53:35.0328 1952        usbuhci - ok
11:53:35.0343 1952        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
11:53:35.0343 1952        VgaSave - ok
11:53:35.0359 1952        ViaIde - ok
11:53:35.0375 1952        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
11:53:35.0375 1952        VolSnap - ok
11:53:35.0421 1952        VSS            (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
11:53:35.0437 1952        VSS - ok
11:53:35.0625 1952        w29n51          (a22abd73e0d6ba666cba4e86eeb001b3) C:\WINDOWS\system32\DRIVERS\w29n51.sys
11:53:35.0687 1952        w29n51 - ok
11:53:35.0843 1952        W32Time        (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\system32\w32time.dll
11:53:35.0843 1952        W32Time - ok
11:53:35.0906 1952        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
11:53:35.0906 1952        Wanarp - ok
11:53:35.0921 1952        WDICA - ok
11:53:35.0953 1952        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
11:53:35.0953 1952        wdmaud - ok
11:53:35.0984 1952        WebClient      (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
11:53:35.0984 1952        WebClient - ok
11:53:36.0062 1952        winmgmt        (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
11:53:36.0062 1952        winmgmt - ok
11:53:36.0125 1952        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
11:53:36.0125 1952        WmdmPmSN - ok
11:53:36.0203 1952        Wmi            (ffa4d901d46d07a5bab2d8307fbb51a6) C:\WINDOWS\System32\advapi32.dll
11:53:36.0218 1952        Wmi - ok
11:53:36.0265 1952        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\system32\wbem\wmiapsrv.exe
11:53:36.0265 1952        WmiApSrv - ok
11:53:36.0421 1952        WMPNetworkSvc  (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
11:53:36.0453 1952        WMPNetworkSvc - ok
11:53:36.0500 1952        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
11:53:36.0515 1952        wscsvc - ok
11:53:36.0531 1952        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
11:53:36.0546 1952        wuauserv - ok
11:53:36.0593 1952        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
11:53:36.0609 1952        WudfPf - ok
11:53:36.0625 1952        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
11:53:36.0640 1952        WudfRd - ok
11:53:36.0656 1952        WudfSvc        (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
11:53:36.0671 1952        WudfSvc - ok
11:53:36.0765 1952        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
11:53:36.0781 1952        WZCSVC - ok
11:53:36.0828 1952        xmlprov        (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
11:53:36.0843 1952        xmlprov - ok
11:53:36.0890 1952        MBR (0x1B8)    (d5e3886b06ca267325513abf88a00427) \Device\Harddisk0\DR0
11:53:36.0906 1952        \Device\Harddisk0\DR0 ( Rootkit.Boot.Wistler.a ) - infected
11:53:36.0906 1952        \Device\Harddisk0\DR0 - detected Rootkit.Boot.Wistler.a (0)
11:53:36.0921 1952        Boot (0x1200)  (94fb89f0716bd2edc9560b54c11d35e1) \Device\Harddisk0\DR0\Partition0
11:53:36.0921 1952        \Device\Harddisk0\DR0\Partition0 - ok
11:53:36.0968 1952        Boot (0x1200)  (8bfe847d9fbd1c8b8e5f73d2c05b199a) \Device\Harddisk0\DR0\Partition1
11:53:36.0968 1952        \Device\Harddisk0\DR0\Partition1 - ok
11:53:36.0968 1952        ============================================================
11:53:36.0968 1952        Scan finished
11:53:36.0968 1952        ============================================================
11:53:37.0000 1920        Detected object count: 1
11:53:37.0000 1920        Actual detected object count: 1
11:53:49.0390 1920        \Device\Harddisk0\DR0\# - copied to quarantine
11:53:49.0406 1920        \Device\Harddisk0\DR0 - copied to quarantine
11:53:49.0437 1920        \Device\Harddisk0\DR0 ( Rootkit.Boot.Wistler.a ) - will be cured on reboot
11:53:49.0437 1920        \Device\Harddisk0\DR0 - ok
11:53:49.0437 1920        \Device\Harddisk0\DR0 ( Rootkit.Boot.Wistler.a ) - User select action: Cure
11:53:56.0187 3512        Deinitialize success
Ich galube ich habe den Haken bei detect file system nicht gemacht. :headbang:

Psychotic 18.06.2012 06:46
Das ist in diesem Fall nicht schlimm, brauchen wir also nicht zu wiederholen! :)

Combofix

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Combofix wird überprüfen, ob die Microsoft Windows Wiederherstellungskonsole installiert ist.
    Ist diese nicht installiert, erlaube Combofix diese herunter zu laden und zu installieren. Folge dazu einfach den Anweisungen und aktzeptiere die End Nutzer Lizenz.
    Bei heutiger Malware ist dies sehr empfehlenswert, da diese uns eine Möglichkeit bietet, dein System zu reparieren, falls was schief geht.
    Bestätige die Information, dass die Wiederherstellungskonsole installiert wurde mit Ja.
Hinweis: Ist diese bereits installiert, wird Combofix mit der Malwareentfernung fortfahren.


Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Robot 18.06.2012 09:23
So, Combofix ist fertig
Code:
ComboFix 12-06-16.02 - *** 18.06.2012  9:47.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1022.486 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\***\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall *Disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\***\FAP253E.tmp
c:\dokumente und einstellungen\***\FAP2542.tmp
c:\dokumente und einstellungen\***\FAP2546.tmp
c:\windows\system32\dllcache\dlimport.exe
c:\windows\system32\test.dll
.
Infizierte Kopie von c:\windows\system32\samsrv.dll wurde gefunden und desinfiziert
Kopie von - c:\windows\ServicePackFiles\i386\samsrv.dll wurde wiederhergestellt
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-18 bis 2012-06-18  ))))))))))))))))))))))))))))))
.
.
2012-06-15 09:53 . 2012-06-15 09:53        --------        d-----w-        C:\TDSSKiller_Quarantine
2012-06-12 11:45 . 2012-06-12 11:45        --------        d-----w-        c:\dokumente und einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Proxure
2012-06-12 11:44 . 2012-06-12 11:44        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\ClubSanDisk
2012-06-08 16:46 . 2012-06-08 16:46        --------        d-----w-        c:\windows\Logs
2012-06-08 16:44 . 2012-06-08 16:44        --------        d-----w-        c:\programme\SiSoftware
2012-06-04 17:53 . 2012-06-09 12:15        426184        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-06-04 17:53 . 2012-06-09 12:15        70344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-02 15:57 . 2012-06-02 17:43        --------        d-----w-        c:\dokumente und einstellungen\Gast
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-18 08:03 . 2009-07-16 18:17        22528        ----a-w-        c:\windows\system32\drivers\nhcDriver.sys
2012-04-04 13:56 . 2010-07-17 12:24        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-04-25 08:36 . 2011-08-12 07:54        97208        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2012-02-24 14:53 . C3A2915C71AE6F225EB906C25CCD29B5 . 24064 . . [1.0.0.5] . . c:\windows\ServicePackFiles\i386\ctfmon.exe
[-] 2012-02-24 14:53 . C3A2915C71AE6F225EB906C25CCD29B5 . 24064 . . [1.0.0.5] . . c:\windows\system32\ctfmon.exe
[7] 2004-08-04 . 7CE20569925DF6789C31799F0C538F29 . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\programme\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-06-30 1388544]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"AtiPTA"="atiptaxx.exe" [2006-02-22 344064]
"NotebookHardwareControl"="c:\programme\Notebook Hardware Control\nhc.exe" [2007-05-04 2629632]
"COMODO Internet Security"="c:\programme\COMODO\COMODO Internet Security\cfp.exe" [2011-01-17 2548552]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2012-01-31 258512]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2012-02-24 24064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-02 09:07        843712        ----a-r-        c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-03-27 12:41        37296        ----a-w-        c:\programme\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2005-03-04 10:01        88209        ----a-w-        c:\windows\AGRSMMSG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-04-23 13:51        691656        ----a-w-        c:\programme\DAEMON Tools Lite\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2007-11-01 11:47        1101824        ----a-w-        c:\programme\Intel\Wireless\Bin\iFrmewrk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2007-11-01 11:51        995328        ----a-w-        c:\programme\Intel\Wireless\Bin\ZCfgSvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 15:18        413696        ----a-w-        c:\programme\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-06-09 12:06        254696        ----a-w-        c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPBackground]
2010-02-03 12:34        294912        ----a-w-        c:\programme\Samsung\Samsung Update Plus\SUPBackGround.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Samsung Update Plus"=2 (0x2)
"S24EventMonitor"=2 (0x2)
"RegSrvc"=2 (0x2)
"EvtEng"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Programme\\Java\\jre6\\bin\\java.exe"=
"c:\\Programme\\Mozilla Firefox\\firefox.exe"=
"c:\\Programme\\Opera\\opera.exe"=
"c:\\Programme\\SiSoftware\\SiSoftware Sandra Lite 2012.SP4a\\RpcAgentSrv.exe"=
"c:\\Programme\\SiSoftware\\SiSoftware Sandra Lite 2012.SP4a\\WNt500x86\\RpcSandraSrv.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 R592;R592;c:\windows\system32\drivers\R592.sys [16.07.2009 16:42 54912]
R1 atitray;atitray;c:\programme\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys [16.07.2009 19:46 17952]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [24.03.2012 12:18 36000]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [06.01.2011 18:37 239368]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [06.01.2011 18:37 27576]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [24.03.2012 12:18 86224]
R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [16.07.2009 16:42 4300]
S3 ADDMEM;ADDMEM;\??\c:\dokume~1\***\LOKALE~1\Temp\__Samsung_Update\ADDMEM.SYS --> c:\dokume~1\***\LOKALE~1\Temp\__Samsung_Update\ADDMEM.SYS [?]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\programme\Mozilla Maintenance Service\maintenanceservice.exe [25.04.2012 10:36 129976]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\programme\SiSoftware\SiSoftware Sandra Lite 2012.SP4a\RpcAgentSrv.exe [08.06.2012 18:44 95896]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30.09.2009 19:13 721904]
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: Interfaces\{5CD9E82C-1DA6-4F24-A96C-9A361C128F44}: NameServer = 192.168.178.1
FF - ProfilePath - c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\d9z0v5dg.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\system32\Macromed\Flash\FlashUtil10i_ActiveX.exe
MSConfigStartUp-Mobile Connectivity Suite - c:\programme\HTC\HTC Sync\Application Launcher\Application Launcher.exe
AddRemove-2kv4.8.442 - c:\windows\Radeon Omega Drivers v4.8.442
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-06-18 10:03
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
  d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8b,52,ad,83,f3,97,8f,44,8e,fa,b3,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
  d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8b,52,ad,83,f3,97,8f,44,8e,fa,b3,\
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"7040211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(736)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(2540)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\netprovcredman.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\programme\COMODO\COMODO Internet Security\cmdagent.exe
c:\windows\system32\Ati2evxx.exe
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\Analog Devices\SoundMAX\SMAgent.exe
c:\programme\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-18  10:09:04 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-06-18 08:08
.
Vor Suchlauf: 5.048.061.952 Bytes frei
Nach Suchlauf: 7.825.035.264 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 03641A652A5209F4FF2CF9F9CBC29986
Zwei Dinge sind mir noch aufgefallen
1. Ich hab auf C: deutlich mehr freien Speicherplatz als vorher und
2. auf dem Desktop ist jetzt ein Icon für den IE neu.


Alle Zeitangaben in WEZ +1. Es ist jetzt 18:19 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19