WORM DV/WB kann ich nicht entfernen

#1 hallo ich habe seit wenigen tagen diesen wurm habe mir auch schon alles durchgelesen.
leider bin ich nicht so firm mit dem pc

hier mal das was der combofix gefunden hat:



((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\msxml3a.dll


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\nm


((((((((((((((((((((((((( Files Created from 2007-05-21 to 2007-06-21 )))))))))))))))))))))))))))))))


2007-06-21 06:40 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-21 06:15 <DIR> d-------- C:\!KillBox
2007-06-17 12:12 <DIR> d-------- C:\Programme\Koch Media
2007-06-17 12:00 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Yahoo! Companion
2007-06-15 08:04 <DIR> d-------- C:\Programme\TuneUp Utilities 2007
2007-06-15 08:03 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2007-06-04 19:13 <DIR> d-------- C:\Programme\CCleaner
2007-06-04 19:12 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2007-06-02 09:54 3,145,728 --a------ C:\DOKUME~1\sabine\ntuser.dat
2007-05-31 08:45 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-05-31 08:44 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-05-31 08:44 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-05-31 08:44 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-05-31 08:44 740,442 --a------ C:\WINDOWS\system32\DivX.dll
2007-05-22 09:37 <DIR> d-------- C:\My Shared Folder
2007-05-22 09:37 <DIR> d-------- C:\DOKUME~1\sabine\ANWEND~1\Kazaa Lite
2007-05-22 09:27 <DIR> d-------- C:\Programme\Azureus
2007-05-22 09:27 <DIR> d-------- C:\DOKUME~1\sabine\ANWEND~1\Azureus
2007-05-21 14:58 <DIR> d-------- C:\DOKUME~1\sabine\ANWEND~1\ICQ Toolbar


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-21 04:43:36 -------- d-----w C:\Programme\Gemeinsame Dateien\Symantec Shared
2007-06-17 10:12:23 -------- d--h--w C:\Programme\InstallShield Installation Information
2007-06-17 10:00:34 -------- d-----w C:\Programme\ICQToolbar
2007-06-15 14:27:01 -------- d-----w C:\Programme\Cubic Mahjongg
2007-06-07 08:27:13 -------- d-----w C:\DOKUME~1\sabine\ANWEND~1\Simple Sudoku
2007-06-04 17:13:34 -------- d-----w C:\Programme\Yahoo!
2007-06-04 17:03:25 -------- d-----w C:\Programme\Dartmoor
2007-06-02 07:40:08 -------- d-----w C:\Programme\Windows Media Connect 2
2007-06-01 08:52:43 -------- d-----w C:\Programme\DivX
2007-05-20 16:38:37 -------- d-----w C:\Programme\Tetris Unlimited
2007-05-20 16:38:26 -------- d-----w C:\Programme\gnubg
2007-05-20 12:25:55 -------- d-----w C:\Programme\Santa Claus in Trouble
2007-05-20 10:09:27 -------- d-----w C:\Programme\ICQLite
2007-05-20 10:09:22 -------- d-----w C:\DOKUME~1\sabine\ANWEND~1\ICQLite
2007-05-20 09:45:07 -------- d-----w C:\Programme\Lavasoft
2007-05-20 08:43:26 -------- d-----w C:\Programme\Turnbeutelvergesser
2007-05-18 06:03:57 -------- d-----w C:\Programme\Sea Mahjong
2007-05-17 14:07:57 -------- d-----w C:\Programme\Ocean Mahjongg
2007-05-16 15:11:44 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-12 05:00:28 783,360 ----a-w C:\WINDOWS\system32\Turnbeutelvergesser.scr
2007-05-11 13:26:25 -------- d-----w C:\Programme\Sunny Mahjong
2007-05-11 13:16:38 -------- d-----w C:\Programme\Heart Mahjong
2007-05-08 17:21:10 50,304 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-05-08 11:32:10 9,472 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-05-08 10:58:44 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-01 12:11:15 -------- d-----w C:\DOKUME~1\sabine\ANWEND~1\Apple Computer
2007-04-25 14:22:27 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-23 00:15:29 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-04-23 00:15:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-04-23 00:15:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-04-23 00:02:34 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-04-23 00:02:34 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-04-23 00:02:33 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-04-23 00:02:31 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-04-23 00:02:31 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-04-23 00:02:31 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-04-23 00:01:47 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-04-23 00:01:46 124,472 ----a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-04-22 16:00:28 -------- d-----w C:\Programme\Stardock
2007-04-22 16:00:28 -------- d-----w C:\Programme\Gemeinsame Dateien\Stardock
2007-04-22 15:25:40 63,778 ----a-w C:\WINDOWS\system32\perfc007.dat
2007-04-22 15:25:40 391,330 ----a-w C:\WINDOWS\system32\perfh007.dat
2007-04-22 15:05:07 -------- d-----w C:\Programme\PyTraffic
2007-04-22 15:01:41 -------- d-----w C:\Programme\BitTornado
2007-04-22 15:01:22 -------- d-----w C:\Programme\BitTorrent
2007-04-22 14:56:07 -------- d-----w C:\DOKUME~1\sabine\ANWEND~1\BitTorrent
2007-04-22 12:32:06 -------- d-----w C:\Programme\Gemeinsame Dateien\InstallShield
2007-04-22 11:59:26 -------- d-----w C:\DOKUME~1\sabine\ANWEND~1\Steganos VPN
2007-04-22 11:58:44 -------- d-----w C:\Programme\VMNetSrv
2007-04-21 09:23:54 -------- d-----w C:\Programme\Simple Sudoku
2007-04-21 06:58:19 -------- d-----w C:\DOKUME~1\sabine\ANWEND~1\OpenOffice.org2
2007-04-21 06:48:38 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat
2007-04-18 16:13:24 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-13 13:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 10:28]
{055FD26D-3A88-4e15-963D-DC8493744B1D}=C:\Programme\ICQToolbar\toolbaru.dll [2006-12-25 10:40]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Programme\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{9ECB9560-04F9-4bbc-943D-298DDF1699E1}=C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll [2004-11-18 14:52]
{BDF3E430-B101-42AD-A544-FADC6B084872}=C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2004-11-15 16:35]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-21 20:23]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Programme\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 15:22]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"InfoCockpit"=C:\Programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE /nosplash

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Programme\Stardock\Object Desktop\ThemeManager\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="C:\Programme\Messenger\msmsgs.exe" /background
"InfoCockpit"=C:\Programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE /nosplash

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATIPTA"=C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
"AlcWzrd"=ALCWZRD.EXE
"PCMService"="c:\Apps\Powercinema\PCMService.exe"
"EmailChecker"=C:\APPS\EmailChecker\ech.exe
"Verknüpfung mit der High Definition Audio-Eigenschaftenseite"=HDAudPropShortcut.exe
"InCD"=C:\Programme\Ahead\InCD\InCD.exe
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"SoundMan"=SOUNDMAN.EXE
"Alcmtr"=ALCMTR.EXE
"ccApp"="C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"Adobe Photo Downloader"="C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
UxTuneUp


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5f8e0c3c-043a-11dc-ad7a-00038a000015}]
AutoRun\command- J:\InstallTomTomHOME.exe


Contents of the 'Scheduled Tasks' folder
2007-06-15 15:53:48 C:\WINDOWS\tasks\1-Klick-Wartung.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-21 06:43:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-21 6:45:55 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-21 06:45

--- E O F ---


bitte um HILFE

#2 Hi,

bitte noch das H-Log, nenne vorher die HJ.exe auf test.com um.

Poste das Logfile.
http://board.protecus.de/t23188.htm
- Erstellen eines Hijackthis-Logfiles
- CleanUp (temporaeren Dateien loeschen)

Scanne mit Antivir im abgesicherten Modus (F8 beim Booten) und diesen Einstellungen (alles gefundene erstmal in Quarantäne schieben lassen).
Mache vorher ein Update der Signaturen.
http://board.protecus.de/t23979.htm

Chris

#3 ok

hier der file

habe aber vergessenes umzubennen

danke

Logfile of HijackThis v1.99.1
Scan saved at 19:34, on 2007-06-21
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Ahead\InCD\InCDsrv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Norton Internet Security\ISSVC.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Java\jre1.6.0_01\bin\jusched.exe
C:\Programme\BitTornado\btdownloadgui.exe
C:\Programme\BitTornado\btdownloadgui.exe
C:\Programme\TuneUp Utilities 2007\Integrator.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\sabine\Eigene Dateien\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.web.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\ger.htm
R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: XTTBPos00 Class - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: XBTP02634 Class - {F97DA966-F09D-4cab-BF29-75A0026986EA} - (no file)
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\ger.htm
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll
O20 - Winlogon Notify: WB - C:\Programme\Stardock\Object Desktop\ThemeManager\fastload.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programme\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Programme\Ahead\InCD\InCDsrv.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Programme\Norton Internet Security\ISSVC.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - Deutsche Telekom AG, Marmiko IT-Solutions GmbH - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe