auch "ide/sata festplatte beschädigt" - aber systemwiederherstellung gelungen!

imperator88 · 14.06.2011, 19:20

Guten Tag,

auch mich hat dieser Trojaner erwischt "ide/sata festplatte beschädigt" mit schwarzem hintergrundbild, und diesen popups.

habe dann auch einem anderen thread einfach den fixlog in otl kopiert. danach konnte ich wenigstens wieder einiges in windows starten, obwohl die popups und schwarzer hintergrund noch da waren.

habe dann systemwiederherstellung, 2 tage zurück gemacht. fast alles ist jetzt wieder okay. aber: einige dateien auf dem desktop und in meinen ordnern sind durchsichtig, als hätte man sie angeklickt. was ist das?

und wie kann ich mich vor dem trojaner schützen? das problem ist zwar jetzt weg, aber ich will das nicht nochmal. ging das über eine java lücke? ich erinnere mich, dass bevor die popups anfingen, java ohne grund gestartet wurde...

cosinus · 15.06.2011, 10:46

Hallo und

Zitat:

habe dann auch einem anderen thread einfach den fixlog in otl kopiert.

Sowas bitte nicht mehr machen, denn Fixscripte sind indivuduell auf einen personenbezogenen Rechner abgestimmt und nicht einfach so auf jeden x-beliebigen Rechner übertragbar!

Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Danach OTL-Custom:

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox.

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

imperator88 · 15.06.2011, 21:36

habe einige windows updates gemacht (war etwas veraltet alles) und jetzt geht OTL.exe nicht mehr.

fehlermeldung: Exception EReadError in module OTL.exe at 000167C7.
Error reading frmMain. HorzScrollBar. Tracking: Access violation at adress
00416CA7 in module OTL.exe. Read of adress 6F383DE9.

Der Malwarebytes log folgt, dauert bisschen

cosinus · 15.06.2011, 21:59

Windows-Update während einer Bereingungsprozedur sind ein wenig unpassend, findest du nicht?

Wenn man dir hier effektiv helfen soll, dann lass bitte solche Einzelaktionen ohne Absprache, also auch nicht irgendwelche Programme/Spiele installieren. Das kannst du machen wenn wir hier durch sind. Oder meinetwegen die auch die ganze Zeit, dann erwarte aber nicht, dass man hier ein format c verhindern kann...

imperator88 · 15.06.2011, 22:26

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6863

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

15.06.2011 23:24:13
mbam-log-2011-06-15 (23-24-13).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 314101
Laufzeit: 56 Minute(n), 20 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\recycle.bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\$Recycle.Bin\s-1-5-21-4021776669-3632399173-1879490895-1000\$R20IW6U.exe (Adware.TryMedia) -> Quarantined and deleted successfully.
c:\recycle.bin\recycle.bin.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\michael wehrmann\AppData\Local\Temp\jar_cache3034279949701890035.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\recycle.bin\config.bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.

imperator88 · 15.06.2011, 22:56

hier OTL log, musste teilen, weil zu groß. teil 1 und 2

cosinus · 16.06.2011, 09:09

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{018400fa-3d64-11df-9807-001e101f8aaa}\Shell - "" = AutoRun
O33 - MountPoints2\{018400fa-3d64-11df-9807-001e101f8aaa}\Shell\AutoRun\command - "" = K:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{0837dfe7-4950-11de-8072-00238b4abf75}\Shell - "" = AutoRun
O33 - MountPoints2\{0837dfe7-4950-11de-8072-00238b4abf75}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{20e7e212-e186-11de-b5a6-00238b4abf75}\Shell - "" = AutoRun
O33 - MountPoints2\{20e7e212-e186-11de-b5a6-00238b4abf75}\Shell\AutoRun\command - "" = J:\setup.exe
O33 - MountPoints2\{3c351ac2-2785-11de-8cc4-00238b4abf75}\Shell - "" = AutoRun
O33 - MountPoints2\{3c351ac2-2785-11de-8cc4-00238b4abf75}\Shell\AutoRun\command - "" = F:\setup.exe
O33 - MountPoints2\{7d015b3c-3cf9-11df-bf52-00238b4abf75}\Shell - "" = AutoRun
O33 - MountPoints2\{7d015b3c-3cf9-11df-bf52-00238b4abf75}\Shell\AutoRun\command - "" = K:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{7d015b42-3cf9-11df-bf52-001e101fa1f5}\Shell - "" = AutoRun
O33 - MountPoints2\{7d015b42-3cf9-11df-bf52-001e101fa1f5}\Shell\AutoRun\command - "" = K:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{83404407-3cfc-11df-bb56-8f15eba9ecab}\Shell - "" = AutoRun
O33 - MountPoints2\{83404407-3cfc-11df-bb56-8f15eba9ecab}\Shell\AutoRun\command - "" = K:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{c3e41686-f24a-11de-a5f6-00238b4abf75}\Shell - "" = AutoRun
O33 - MountPoints2\{c3e41686-f24a-11de-a5f6-00238b4abf75}\Shell\AutoRun\command - "" = J:\Desperados.exe -autorun
O33 - MountPoints2\K\Shell - "" = AutoRun
O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\setup_vmc_lite.exe /checkApplicationPresence
O4 - HKCU..\Run: [4E3E0230AEBB4E96]  File not found
[2011.06.14 19:42:17 | 000,000,128 | ---- | M] () -- C:\ProgramData\~43638520r
[2011.06.14 19:42:17 | 000,000,104 | ---- | M] () -- C:\ProgramData\~43638520
[2011.06.14 17:43:12 | 000,000,336 | ---- | M] () -- C:\ProgramData\43638520
[2011.06.14 22:42:07 | 000,201,184 | ---- | C] () -- C:\Windows\System32\winrm.vbs
[2011.06.14 20:05:00 | 000,000,000 | ---D | M] -- C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF
[2010.10.27 16:03:17 | 000,000,000 | ---D | M] -- C:\Users\Michael Wehrmann\AppData\Roaming\Ahbye
:Commands
[purity]
[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

imperator88 · 16.06.2011, 09:15

========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{018400fa-3d64-11df-9807-001e101f8aaa}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{018400fa-3d64-11df-9807-001e101f8aaa}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{018400fa-3d64-11df-9807-001e101f8aaa}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{018400fa-3d64-11df-9807-001e101f8aaa}\ not found.
File K:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0837dfe7-4950-11de-8072-00238b4abf75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0837dfe7-4950-11de-8072-00238b4abf75}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0837dfe7-4950-11de-8072-00238b4abf75}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0837dfe7-4950-11de-8072-00238b4abf75}\ not found.
File G:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20e7e212-e186-11de-b5a6-00238b4abf75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20e7e212-e186-11de-b5a6-00238b4abf75}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20e7e212-e186-11de-b5a6-00238b4abf75}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20e7e212-e186-11de-b5a6-00238b4abf75}\ not found.
File J:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3c351ac2-2785-11de-8cc4-00238b4abf75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3c351ac2-2785-11de-8cc4-00238b4abf75}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3c351ac2-2785-11de-8cc4-00238b4abf75}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3c351ac2-2785-11de-8cc4-00238b4abf75}\ not found.
File F:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d015b3c-3cf9-11df-bf52-00238b4abf75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7d015b3c-3cf9-11df-bf52-00238b4abf75}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d015b3c-3cf9-11df-bf52-00238b4abf75}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7d015b3c-3cf9-11df-bf52-00238b4abf75}\ not found.
File K:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d015b42-3cf9-11df-bf52-001e101fa1f5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7d015b42-3cf9-11df-bf52-001e101fa1f5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d015b42-3cf9-11df-bf52-001e101fa1f5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7d015b42-3cf9-11df-bf52-001e101fa1f5}\ not found.
File K:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{83404407-3cfc-11df-bb56-8f15eba9ecab}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{83404407-3cfc-11df-bb56-8f15eba9ecab}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{83404407-3cfc-11df-bb56-8f15eba9ecab}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{83404407-3cfc-11df-bb56-8f15eba9ecab}\ not found.
File K:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c3e41686-f24a-11de-a5f6-00238b4abf75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c3e41686-f24a-11de-a5f6-00238b4abf75}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c3e41686-f24a-11de-a5f6-00238b4abf75}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c3e41686-f24a-11de-a5f6-00238b4abf75}\ not found.
File J:\Desperados.exe -autorun not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\K\ not found.
File K:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\4E3E0230AEBB4E96 deleted successfully.
C:\ProgramData\~43638520r moved successfully.
C:\ProgramData\~43638520 moved successfully.
C:\ProgramData\43638520 moved successfully.
File move failed. C:\Windows\System32\winrm.vbs scheduled to be moved on reboot.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\Xp folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\Vista folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\Magma folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\Iubito folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\GrayXP folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\Desert Chrome folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes\Classic folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Themes folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Myriad\Updates folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Myriad\GMDigit\Cache folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Myriad\GMDigit folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF\Myriad folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\ACAMPREF folder moved successfully.
C:\Users\Michael Wehrmann\AppData\Roaming\Ahbye folder moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.24.0 log created on 06162011_101116

Files\Folders moved on Reboot...
File move failed. C:\Windows\System32\winrm.vbs scheduled to be moved on reboot.

Registry entries deleted on Reboot...

cosinus · 16.06.2011, 09:21

Stell uns bitte den Quarantäneordner von OTL zur Verfügung. Bitte dabei so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht behindern!
2.) Ordner MovedFiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

imperator88 · 16.06.2011, 09:27

ist hochgeladen! danke dir!

cosinus · 16.06.2011, 09:45

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html
Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst oder Verküpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:

Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )

Windows-Vista- und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!

imperator88 · 16.06.2011, 09:52

2011/06/16 10:48:51.0132 3924 TDSS rootkit removing tool 2.5.4.0 Jun 7 2011 17:31:48
2011/06/16 10:48:51.0318 3924 ================================================================================
2011/06/16 10:48:51.0318 3924 SystemInfo:
2011/06/16 10:48:51.0318 3924
2011/06/16 10:48:51.0318 3924 OS Version: 6.0.6001 ServicePack: 1.0
2011/06/16 10:48:51.0318 3924 Product type: Workstation
2011/06/16 10:48:51.0319 3924 ComputerName: MICHAEL-LAPTOP
2011/06/16 10:48:51.0319 3924 UserName: Michael Wehrmann
2011/06/16 10:48:51.0319 3924 Windows directory: C:\Windows
2011/06/16 10:48:51.0319 3924 System windows directory: C:\Windows
2011/06/16 10:48:51.0319 3924 Processor architecture: Intel x86
2011/06/16 10:48:51.0319 3924 Number of processors: 2
2011/06/16 10:48:51.0319 3924 Page size: 0x1000
2011/06/16 10:48:51.0319 3924 Boot type: Normal boot
2011/06/16 10:48:51.0319 3924 ================================================================================
2011/06/16 10:48:52.0544 3924 Initialize success
2011/06/16 10:49:05.0356 0500 ================================================================================
2011/06/16 10:49:05.0356 0500 Scan started
2011/06/16 10:49:05.0356 0500 Mode: Manual;
2011/06/16 10:49:05.0356 0500 ================================================================================
2011/06/16 10:49:06.0598 0500 ACPI (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
2011/06/16 10:49:06.0673 0500 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/06/16 10:49:06.0741 0500 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/06/16 10:49:06.0781 0500 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/06/16 10:49:06.0820 0500 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/06/16 10:49:06.0905 0500 AFD (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
2011/06/16 10:49:06.0956 0500 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/06/16 10:49:06.0998 0500 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/06/16 10:49:07.0054 0500 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/06/16 10:49:07.0102 0500 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/06/16 10:49:07.0143 0500 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/06/16 10:49:07.0179 0500 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/06/16 10:49:07.0219 0500 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
2011/06/16 10:49:07.0287 0500 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/06/16 10:49:07.0329 0500 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/06/16 10:49:07.0396 0500 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/06/16 10:49:07.0463 0500 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2011/06/16 10:49:07.0533 0500 AVerAF15 (59ab11f9b541c6279e0d45dfb77d7b17) C:\Windows\system32\Drivers\AVerAF15.sys
2011/06/16 10:49:07.0591 0500 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/06/16 10:49:07.0672 0500 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/06/16 10:49:07.0701 0500 BMLoad (d002033c1a37f6af51b5f0ba6d0211bc) C:\Windows\system32\drivers\BMLoad.sys
2011/06/16 10:49:07.0762 0500 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/06/16 10:49:07.0811 0500 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/06/16 10:49:07.0852 0500 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/06/16 10:49:07.0902 0500 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/06/16 10:49:07.0943 0500 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/06/16 10:49:07.0988 0500 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/06/16 10:49:08.0024 0500 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/06/16 10:49:08.0063 0500 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/06/16 10:49:08.0142 0500 CamDrL (0f5ca31bb3fdb5c1e63c170cfbecc93b) C:\Windows\system32\DRIVERS\Camdrl.sys
2011/06/16 10:49:08.0208 0500 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/06/16 10:49:08.0272 0500 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2011/06/16 10:49:08.0331 0500 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2011/06/16 10:49:08.0400 0500 CLFS (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2011/06/16 10:49:08.0514 0500 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/06/16 10:49:08.0542 0500 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/06/16 10:49:08.0596 0500 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/06/16 10:49:08.0639 0500 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/06/16 10:49:08.0684 0500 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/06/16 10:49:08.0780 0500 DfsC (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
2011/06/16 10:49:08.0855 0500 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2011/06/16 10:49:08.0932 0500 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/06/16 10:49:09.0002 0500 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2011/06/16 10:49:09.0070 0500 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/06/16 10:49:09.0109 0500 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2011/06/16 10:49:09.0208 0500 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/06/16 10:49:09.0290 0500 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/06/16 10:49:09.0372 0500 ewusbnet (0f40e249e4dd0ce47c7ca19c5c8fb48a) C:\Windows\system32\DRIVERS\ewusbnet.sys
2011/06/16 10:49:09.0419 0500 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2011/06/16 10:49:09.0472 0500 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2011/06/16 10:49:09.0519 0500 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/06/16 10:49:09.0587 0500 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/06/16 10:49:09.0626 0500 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/06/16 10:49:09.0679 0500 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/06/16 10:49:09.0731 0500 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2011/06/16 10:49:09.0773 0500 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/06/16 10:49:09.0824 0500 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/06/16 10:49:09.0894 0500 hamachi (7929a161f9951d173ca9900fe7067391) C:\Windows\system32\DRIVERS\hamachi.sys
2011/06/16 10:49:09.0958 0500 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/06/16 10:49:10.0024 0500 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/06/16 10:49:10.0101 0500 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/06/16 10:49:10.0140 0500 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/06/16 10:49:10.0213 0500 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2011/06/16 10:49:10.0269 0500 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/06/16 10:49:10.0351 0500 HTTP (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
2011/06/16 10:49:10.0398 0500 hwdatacard (92ca47da32009ccc00a5aded04abbd78) C:\Windows\system32\DRIVERS\ewusbmdm.sys
2011/06/16 10:49:10.0440 0500 hwusbfake (089085538885367e281686762a973eb5) C:\Windows\system32\DRIVERS\ewusbfake.sys
2011/06/16 10:49:10.0486 0500 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/06/16 10:49:10.0539 0500 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/06/16 10:49:10.0601 0500 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/06/16 10:49:10.0746 0500 igfx (0627fc0c422cd6e0f23e1b0d1d9f0899) C:\Windows\system32\DRIVERS\igdkmd32.sys
2011/06/16 10:49:10.0883 0500 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/06/16 10:49:11.0031 0500 IntcAzAudAddService (56ac584fe02e0c1d5924892562cbd572) C:\Windows\system32\drivers\RTKVHDA.sys
2011/06/16 10:49:11.0096 0500 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/06/16 10:49:11.0133 0500 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/06/16 10:49:11.0260 0500 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/06/16 10:49:11.0322 0500 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/06/16 10:49:11.0365 0500 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/06/16 10:49:11.0404 0500 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/06/16 10:49:11.0480 0500 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/06/16 10:49:11.0525 0500 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/06/16 10:49:11.0559 0500 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/06/16 10:49:11.0602 0500 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/06/16 10:49:11.0658 0500 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/06/16 10:49:11.0693 0500 KMWDFILTER (566c5fd480fdbce3ba5cf9fbcffaea9a) C:\Windows\system32\DRIVERS\KMWDFILTER.sys
2011/06/16 10:49:11.0758 0500 KSecDD (5367dc846cae9639b899bfd13b97a8c9) C:\Windows\system32\Drivers\ksecdd.sys
2011/06/16 10:49:11.0828 0500 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/06/16 10:49:11.0910 0500 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/06/16 10:49:11.0966 0500 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/06/16 10:49:12.0003 0500 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/06/16 10:49:12.0083 0500 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/06/16 10:49:12.0237 0500 LVcKap (9a3d4fc6b86e7e36473079ab76ac703d) C:\Windows\system32\DRIVERS\LVcKap.sys
2011/06/16 10:49:12.0439 0500 LVMVDrv (0acbc11f19320af6c19f2e20013d9095) C:\Windows\system32\DRIVERS\LVMVDrv.sys
2011/06/16 10:49:12.0494 0500 LVPr2Mon (12866641284ebb41e627bb53c04da959) C:\Windows\system32\DRIVERS\LVPr2Mon.sys
2011/06/16 10:49:12.0537 0500 LVUSBSta (64bc29c3a0388bfc580bb8b1346f7659) C:\Windows\system32\drivers\LVUSBSta.sys
2011/06/16 10:49:12.0706 0500 MBAMSwissArmy (b309912717c29fc67e1ba4730a82b6dd) C:\Windows\system32\drivers\mbamswissarmy.sys
2011/06/16 10:49:12.0811 0500 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/06/16 10:49:12.0877 0500 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/06/16 10:49:12.0945 0500 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/06/16 10:49:12.0979 0500 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/06/16 10:49:13.0006 0500 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/06/16 10:49:13.0051 0500 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/06/16 10:49:13.0083 0500 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/06/16 10:49:13.0128 0500 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/06/16 10:49:13.0170 0500 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/06/16 10:49:13.0207 0500 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/06/16 10:49:13.0257 0500 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2011/06/16 10:49:13.0326 0500 mrxsmb (5734a0f2be7e495f7d3ed6efd4b9f5a1) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/06/16 10:49:13.0375 0500 mrxsmb10 (cf6e972f8e0d0f2970360a17572b366b) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/06/16 10:49:13.0417 0500 mrxsmb20 (5c80d8159181c7abf1b14ba703b01e0b) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/06/16 10:49:13.0482 0500 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/06/16 10:49:13.0537 0500 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/06/16 10:49:13.0606 0500 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/06/16 10:49:13.0680 0500 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/06/16 10:49:13.0820 0500 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/06/16 10:49:13.0866 0500 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/06/16 10:49:13.0903 0500 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/06/16 10:49:13.0943 0500 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2011/06/16 10:49:13.0986 0500 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/06/16 10:49:14.0030 0500 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/06/16 10:49:14.0068 0500 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2011/06/16 10:49:14.0155 0500 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
2011/06/16 10:49:14.0210 0500 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
2011/06/16 10:49:14.0272 0500 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/06/16 10:49:14.0298 0500 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/06/16 10:49:14.0342 0500 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/06/16 10:49:14.0376 0500 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/06/16 10:49:14.0420 0500 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/06/16 10:49:14.0472 0500 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
2011/06/16 10:49:14.0565 0500 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/06/16 10:49:14.0606 0500 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2011/06/16 10:49:14.0686 0500 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/06/16 10:49:14.0763 0500 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2011/06/16 10:49:14.0864 0500 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/06/16 10:49:14.0979 0500 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/06/16 10:49:15.0027 0500 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/06/16 10:49:15.0066 0500 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/06/16 10:49:15.0107 0500 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/06/16 10:49:15.0263 0500 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
2011/06/16 10:49:15.0346 0500 OVT511Plus (c5739be3a8eecdf951955a38e1741f45) C:\Windows\system32\Drivers\omcamvid.sys
2011/06/16 10:49:15.0399 0500 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/06/16 10:49:15.0466 0500 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2011/06/16 10:49:15.0500 0500 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/06/16 10:49:15.0565 0500 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2011/06/16 10:49:15.0612 0500 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2011/06/16 10:49:15.0666 0500 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/06/16 10:49:15.0746 0500 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/06/16 10:49:15.0994 0500 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/06/16 10:49:16.0042 0500 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2011/06/16 10:49:16.0122 0500 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2011/06/16 10:49:16.0216 0500 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/06/16 10:49:16.0285 0500 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/06/16 10:49:16.0343 0500 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/06/16 10:49:16.0394 0500 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/06/16 10:49:16.0443 0500 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/06/16 10:49:16.0503 0500 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/06/16 10:49:16.0537 0500 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
2011/06/16 10:49:16.0597 0500 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
2011/06/16 10:49:16.0634 0500 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/06/16 10:49:16.0707 0500 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/06/16 10:49:16.0746 0500 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/06/16 10:49:16.0812 0500 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2011/06/16 10:49:16.0912 0500 RimUsb (f17713d108aca124a139fde877eef68a) C:\Windows\system32\Drivers\RimUsb.sys
2011/06/16 10:49:16.0962 0500 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys
2011/06/16 10:49:17.0013 0500 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys
2011/06/16 10:49:17.0154 0500 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/06/16 10:49:17.0223 0500 RTL8169 (2fc33077f85d7dc0d03678c06d43898c) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/06/16 10:49:17.0297 0500 RTL8187B (c279a9a9f946359548e5665c0e8bab15) C:\Windows\system32\DRIVERS\RTL8187B.sys
2011/06/16 10:49:17.0372 0500 RTSTOR (d1fb9a678bd6c2b1129fcb09d5feb6dd) C:\Windows\system32\drivers\RTSTOR.SYS
2011/06/16 10:49:17.0438 0500 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/06/16 10:49:17.0570 0500 scsk4 (322c39bbe37c321622e57b2e48be8e2c) C:\Windows\system32\drivers\scsk4.sys
2011/06/16 10:49:17.0652 0500 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/06/16 10:49:17.0772 0500 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/06/16 10:49:17.0820 0500 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/06/16 10:49:17.0866 0500 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/06/16 10:49:17.0960 0500 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2011/06/16 10:49:18.0003 0500 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/06/16 10:49:18.0058 0500 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2011/06/16 10:49:18.0109 0500 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/06/16 10:49:18.0192 0500 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/06/16 10:49:18.0238 0500 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/06/16 10:49:18.0300 0500 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/06/16 10:49:18.0383 0500 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2011/06/16 10:49:18.0493 0500 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/06/16 10:49:18.0569 0500 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2011/06/16 10:49:18.0569 0500 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
2011/06/16 10:49:18.0579 0500 sptd - detected LockedFile.Multi.Generic (1)
2011/06/16 10:49:18.0637 0500 srv (73dddbeec61e78568082916a27aadaee) C:\Windows\system32\DRIVERS\srv.sys
2011/06/16 10:49:18.0672 0500 srv2 (805fac010405ad3f82ef8df0bb035d81) C:\Windows\system32\DRIVERS\srv2.sys
2011/06/16 10:49:18.0736 0500 srvnet (f63a0a58aafe34d7a1a0a74abccdd9c0) C:\Windows\system32\DRIVERS\srvnet.sys
2011/06/16 10:49:18.0818 0500 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/06/16 10:49:18.0869 0500 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/06/16 10:49:18.0915 0500 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/06/16 10:49:18.0967 0500 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/06/16 10:49:19.0104 0500 Tcpip (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\drivers\tcpip.sys
2011/06/16 10:49:19.0206 0500 Tcpip6 (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\DRIVERS\tcpip.sys
2011/06/16 10:49:19.0262 0500 tcpipBM (dcfeb82ca988598ceb8f83148616038e) C:\Windows\system32\drivers\tcpipBM.sys
2011/06/16 10:49:19.0330 0500 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
2011/06/16 10:49:19.0367 0500 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/06/16 10:49:19.0420 0500 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/06/16 10:49:19.0466 0500 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
2011/06/16 10:49:19.0533 0500 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
2011/06/16 10:49:19.0619 0500 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/06/16 10:49:19.0661 0500 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/06/16 10:49:19.0690 0500 tunnel (119b8184e106baedc83fce5ddf3950da) C:\Windows\system32\DRIVERS\tunnel.sys
2011/06/16 10:49:19.0758 0500 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/06/16 10:49:19.0813 0500 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2011/06/16 10:49:19.0887 0500 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/06/16 10:49:19.0936 0500 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/06/16 10:49:20.0006 0500 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/06/16 10:49:20.0238 0500 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/06/16 10:49:20.0318 0500 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/06/16 10:49:20.0428 0500 usbaudio (292a25bb75a568ae2c67169ba2c6365a) C:\Windows\system32\drivers\usbaudio.sys
2011/06/16 10:49:20.0481 0500 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/06/16 10:49:20.0545 0500 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/06/16 10:49:20.0583 0500 usbehci (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
2011/06/16 10:49:20.0626 0500 usbhub (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
2011/06/16 10:49:20.0672 0500 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/06/16 10:49:20.0730 0500 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/06/16 10:49:20.0780 0500 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/06/16 10:49:20.0875 0500 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/06/16 10:49:20.0948 0500 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/06/16 10:49:21.0006 0500 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/06/16 10:49:21.0141 0500 VClone (1cdaa48cb2f7744b8d25650e050766a5) C:\Windows\system32\DRIVERS\VClone.sys
2011/06/16 10:49:21.0247 0500 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/06/16 10:49:21.0291 0500 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/06/16 10:49:21.0344 0500 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/06/16 10:49:21.0380 0500 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/06/16 10:49:21.0415 0500 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/06/16 10:49:21.0474 0500 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/06/16 10:49:21.0509 0500 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2011/06/16 10:49:21.0582 0500 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2011/06/16 10:49:21.0632 0500 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/06/16 10:49:21.0697 0500 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/06/16 10:49:21.0764 0500 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/16 10:49:21.0787 0500 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/16 10:49:21.0935 0500 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/06/16 10:49:22.0000 0500 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/06/16 10:49:22.0186 0500 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/06/16 10:49:22.0281 0500 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/06/16 10:49:22.0362 0500 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/06/16 10:49:22.0482 0500 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
2011/06/16 10:49:22.0502 0500 ================================================================================
2011/06/16 10:49:22.0503 0500 Scan finished
2011/06/16 10:49:22.0503 0500 ================================================================================
2011/06/16 10:49:22.0520 4092 Detected object count: 1
2011/06/16 10:49:22.0520 4092 Actual detected object count: 1
2011/06/16 10:50:03.0719 4092 LockedFile.Multi.Generic(sptd) - User select action: Skip
2011/06/16 10:50:25.0698 3356 ================================================================================
2011/06/16 10:50:25.0698 3356 Scan started
2011/06/16 10:50:25.0698 3356 Mode: Manual;
2011/06/16 10:50:25.0698 3356 ================================================================================
2011/06/16 10:50:26.0249 3356 ACPI (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
2011/06/16 10:50:26.0325 3356 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2011/06/16 10:50:26.0381 3356 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2011/06/16 10:50:26.0422 3356 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2011/06/16 10:50:26.0470 3356 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2011/06/16 10:50:26.0556 3356 AFD (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
2011/06/16 10:50:26.0607 3356 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2011/06/16 10:50:26.0649 3356 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/06/16 10:50:26.0705 3356 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2011/06/16 10:50:26.0753 3356 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2011/06/16 10:50:26.0794 3356 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2011/06/16 10:50:26.0842 3356 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2011/06/16 10:50:26.0882 3356 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
2011/06/16 10:50:26.0928 3356 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2011/06/16 10:50:26.0980 3356 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2011/06/16 10:50:27.0036 3356 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/06/16 10:50:27.0103 3356 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2011/06/16 10:50:27.0173 3356 AVerAF15 (59ab11f9b541c6279e0d45dfb77d7b17) C:\Windows\system32\Drivers\AVerAF15.sys
2011/06/16 10:50:27.0232 3356 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/06/16 10:50:27.0291 3356 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2011/06/16 10:50:27.0318 3356 BMLoad (d002033c1a37f6af51b5f0ba6d0211bc) C:\Windows\system32\drivers\BMLoad.sys
2011/06/16 10:50:27.0369 3356 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/06/16 10:50:27.0418 3356 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/06/16 10:50:27.0459 3356 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/06/16 10:50:27.0509 3356 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/06/16 10:50:27.0549 3356 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/06/16 10:50:27.0583 3356 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/06/16 10:50:27.0619 3356 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/06/16 10:50:27.0659 3356 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/06/16 10:50:27.0737 3356 CamDrL (0f5ca31bb3fdb5c1e63c170cfbecc93b) C:\Windows\system32\DRIVERS\Camdrl.sys
2011/06/16 10:50:27.0804 3356 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/06/16 10:50:27.0868 3356 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2011/06/16 10:50:27.0915 3356 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2011/06/16 10:50:27.0984 3356 CLFS (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2011/06/16 10:50:28.0054 3356 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/06/16 10:50:28.0081 3356 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2011/06/16 10:50:28.0136 3356 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/06/16 10:50:28.0173 3356 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2011/06/16 10:50:28.0224 3356 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2011/06/16 10:50:28.0320 3356 DfsC (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
2011/06/16 10:50:28.0396 3356 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2011/06/16 10:50:28.0461 3356 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/06/16 10:50:28.0541 3356 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2011/06/16 10:50:28.0599 3356 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/06/16 10:50:28.0639 3356 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2011/06/16 10:50:28.0726 3356 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2011/06/16 10:50:28.0786 3356 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2011/06/16 10:50:28.0867 3356 ewusbnet (0f40e249e4dd0ce47c7ca19c5c8fb48a) C:\Windows\system32\DRIVERS\ewusbnet.sys
2011/06/16 10:50:28.0915 3356 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2011/06/16 10:50:28.0991 3356 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2011/06/16 10:50:29.0037 3356 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2011/06/16 10:50:29.0105 3356 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/06/16 10:50:29.0144 3356 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/06/16 10:50:29.0186 3356 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/06/16 10:50:29.0237 3356 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2011/06/16 10:50:29.0280 3356 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/06/16 10:50:29.0330 3356 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2011/06/16 10:50:29.0379 3356 hamachi (7929a161f9951d173ca9900fe7067391) C:\Windows\system32\DRIVERS\hamachi.sys
2011/06/16 10:50:29.0442 3356 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/06/16 10:50:29.0497 3356 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/06/16 10:50:29.0575 3356 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/06/16 10:50:29.0614 3356 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/06/16 10:50:29.0687 3356 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2011/06/16 10:50:29.0754 3356 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2011/06/16 10:50:29.0836 3356 HTTP (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
2011/06/16 10:50:29.0883 3356 hwdatacard (92ca47da32009ccc00a5aded04abbd78) C:\Windows\system32\DRIVERS\ewusbmdm.sys
2011/06/16 10:50:29.0924 3356 hwusbfake (089085538885367e281686762a973eb5) C:\Windows\system32\DRIVERS\ewusbfake.sys
2011/06/16 10:50:29.0960 3356 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2011/06/16 10:50:30.0012 3356 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/06/16 10:50:30.0075 3356 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2011/06/16 10:50:30.0219 3356 igfx (0627fc0c422cd6e0f23e1b0d1d9f0899) C:\Windows\system32\DRIVERS\igdkmd32.sys
2011/06/16 10:50:30.0290 3356 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/06/16 10:50:30.0426 3356 IntcAzAudAddService (56ac584fe02e0c1d5924892562cbd572) C:\Windows\system32\drivers\RTKVHDA.sys
2011/06/16 10:50:30.0492 3356 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/06/16 10:50:30.0528 3356 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/06/16 10:50:30.0622 3356 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2011/06/16 10:50:30.0684 3356 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/06/16 10:50:30.0728 3356 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/06/16 10:50:30.0777 3356 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2011/06/16 10:50:30.0842 3356 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/06/16 10:50:30.0888 3356 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/06/16 10:50:30.0922 3356 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/06/16 10:50:30.0964 3356 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/06/16 10:50:31.0020 3356 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/06/16 10:50:31.0056 3356 KMWDFILTER (566c5fd480fdbce3ba5cf9fbcffaea9a) C:\Windows\system32\DRIVERS\KMWDFILTER.sys
2011/06/16 10:50:31.0121 3356 KSecDD (5367dc846cae9639b899bfd13b97a8c9) C:\Windows\system32\Drivers\ksecdd.sys
2011/06/16 10:50:31.0201 3356 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/06/16 10:50:31.0272 3356 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2011/06/16 10:50:31.0317 3356 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2011/06/16 10:50:31.0347 3356 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2011/06/16 10:50:31.0382 3356 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/06/16 10:50:31.0493 3356 LVcKap (9a3d4fc6b86e7e36473079ab76ac703d) C:\Windows\system32\DRIVERS\LVcKap.sys
2011/06/16 10:50:31.0612 3356 LVMVDrv (0acbc11f19320af6c19f2e20013d9095) C:\Windows\system32\DRIVERS\LVMVDrv.sys
2011/06/16 10:50:31.0678 3356 LVPr2Mon (12866641284ebb41e627bb53c04da959) C:\Windows\system32\DRIVERS\LVPr2Mon.sys
2011/06/16 10:50:31.0724 3356 LVUSBSta (64bc29c3a0388bfc580bb8b1346f7659) C:\Windows\system32\drivers\LVUSBSta.sys
2011/06/16 10:50:31.0823 3356 MBAMSwissArmy (b309912717c29fc67e1ba4730a82b6dd) C:\Windows\system32\drivers\mbamswissarmy.sys
2011/06/16 10:50:31.0918 3356 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2011/06/16 10:50:31.0972 3356 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2011/06/16 10:50:32.0040 3356 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/06/16 10:50:32.0074 3356 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/06/16 10:50:32.0105 3356 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/06/16 10:50:32.0146 3356 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/06/16 10:50:32.0178 3356 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/06/16 10:50:32.0234 3356 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2011/06/16 10:50:32.0277 3356 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/06/16 10:50:32.0314 3356 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/06/16 10:50:32.0363 3356 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2011/06/16 10:50:32.0422 3356 mrxsmb (5734a0f2be7e495f7d3ed6efd4b9f5a1) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/06/16 10:50:32.0470 3356 mrxsmb10 (cf6e972f8e0d0f2970360a17572b366b) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/06/16 10:50:32.0524 3356 mrxsmb20 (5c80d8159181c7abf1b14ba703b01e0b) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/06/16 10:50:32.0589 3356 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2011/06/16 10:50:32.0632 3356 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2011/06/16 10:50:32.0711 3356 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/06/16 10:50:32.0739 3356 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/06/16 10:50:32.0803 3356 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/06/16 10:50:32.0850 3356 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/06/16 10:50:32.0887 3356 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/06/16 10:50:32.0927 3356 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2011/06/16 10:50:32.0970 3356 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/06/16 10:50:33.0025 3356 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/06/16 10:50:33.0054 3356 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2011/06/16 10:50:33.0128 3356 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
2011/06/16 10:50:33.0183 3356 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
2011/06/16 10:50:33.0223 3356 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/06/16 10:50:33.0258 3356 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/06/16 10:50:33.0304 3356 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/06/16 10:50:33.0338 3356 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/06/16 10:50:33.0393 3356 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/06/16 10:50:33.0435 3356 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
2011/06/16 10:50:33.0527 3356 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/06/16 10:50:33.0565 3356 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2011/06/16 10:50:33.0648 3356 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/06/16 10:50:33.0724 3356 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2011/06/16 10:50:33.0781 3356 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/06/16 10:50:33.0829 3356 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/06/16 10:50:33.0878 3356 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2011/06/16 10:50:33.0916 3356 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2011/06/16 10:50:33.0958 3356 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2011/06/16 10:50:34.0067 3356 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
2011/06/16 10:50:34.0130 3356 OVT511Plus (c5739be3a8eecdf951955a38e1741f45) C:\Windows\system32\Drivers\omcamvid.sys
2011/06/16 10:50:34.0180 3356 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/06/16 10:50:34.0215 3356 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2011/06/16 10:50:34.0261 3356 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/06/16 10:50:34.0337 3356 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2011/06/16 10:50:34.0384 3356 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2011/06/16 10:50:34.0427 3356 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/06/16 10:50:34.0496 3356 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/06/16 10:50:34.0644 3356 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/06/16 10:50:34.0692 3356 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2011/06/16 10:50:34.0772 3356 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2011/06/16 10:50:34.0855 3356 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2011/06/16 10:50:34.0913 3356 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/06/16 10:50:34.0971 3356 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/06/16 10:50:35.0011 3356 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/06/16 10:50:35.0082 3356 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/06/16 10:50:35.0171 3356 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/06/16 10:50:35.0273 3356 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
2011/06/16 10:50:35.0324 3356 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
2011/06/16 10:50:35.0355 3356 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/06/16 10:50:35.0424 3356 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2011/06/16 10:50:35.0455 3356 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/06/16 10:50:35.0518 3356 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2011/06/16 10:50:35.0596 3356 RimUsb (f17713d108aca124a139fde877eef68a) C:\Windows\system32\Drivers\RimUsb.sys
2011/06/16 10:50:35.0635 3356 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys
2011/06/16 10:50:35.0686 3356 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys
2011/06/16 10:50:35.0759 3356 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/06/16 10:50:35.0818 3356 RTL8169 (2fc33077f85d7dc0d03678c06d43898c) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/06/16 10:50:35.0869 3356 RTL8187B (c279a9a9f946359548e5665c0e8bab15) C:\Windows\system32\DRIVERS\RTL8187B.sys
2011/06/16 10:50:35.0910 3356 RTSTOR (d1fb9a678bd6c2b1129fcb09d5feb6dd) C:\Windows\system32\drivers\RTSTOR.SYS
2011/06/16 10:50:35.0963 3356 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/06/16 10:50:36.0020 3356 scsk4 (322c39bbe37c321622e57b2e48be8e2c) C:\Windows\system32\drivers\scsk4.sys
2011/06/16 10:50:36.0079 3356 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/06/16 10:50:36.0126 3356 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/06/16 10:50:36.0163 3356 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/06/16 10:50:36.0205 3356 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/06/16 10:50:36.0298 3356 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2011/06/16 10:50:36.0341 3356 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2011/06/16 10:50:36.0375 3356 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2011/06/16 10:50:36.0414 3356 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/06/16 10:50:36.0475 3356 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2011/06/16 10:50:36.0505 3356 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2011/06/16 10:50:36.0550 3356 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2011/06/16 10:50:36.0621 3356 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2011/06/16 10:50:36.0687 3356 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/06/16 10:50:36.0774 3356 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2011/06/16 10:50:36.0774 3356 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
2011/06/16 10:50:36.0784 3356 sptd - detected LockedFile.Multi.Generic (1)
2011/06/16 10:50:36.0842 3356 srv (73dddbeec61e78568082916a27aadaee) C:\Windows\system32\DRIVERS\srv.sys
2011/06/16 10:50:36.0878 3356 srv2 (805fac010405ad3f82ef8df0bb035d81) C:\Windows\system32\DRIVERS\srv2.sys
2011/06/16 10:50:36.0916 3356 srvnet (f63a0a58aafe34d7a1a0a74abccdd9c0) C:\Windows\system32\DRIVERS\srvnet.sys
2011/06/16 10:50:37.0001 3356 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/06/16 10:50:37.0052 3356 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/06/16 10:50:37.0098 3356 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/06/16 10:50:37.0139 3356 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/06/16 10:50:37.0264 3356 Tcpip (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\drivers\tcpip.sys
2011/06/16 10:50:37.0342 3356 Tcpip6 (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\DRIVERS\tcpip.sys
2011/06/16 10:50:37.0379 3356 tcpipBM (dcfeb82ca988598ceb8f83148616038e) C:\Windows\system32\drivers\tcpipBM.sys
2011/06/16 10:50:37.0435 3356 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
2011/06/16 10:50:37.0483 3356 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/06/16 10:50:37.0525 3356 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/06/16 10:50:37.0571 3356 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
2011/06/16 10:50:37.0638 3356 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
2011/06/16 10:50:37.0735 3356 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/06/16 10:50:37.0788 3356 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/06/16 10:50:37.0824 3356 tunnel (119b8184e106baedc83fce5ddf3950da) C:\Windows\system32\DRIVERS\tunnel.sys
2011/06/16 10:50:37.0886 3356 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2011/06/16 10:50:37.0940 3356 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2011/06/16 10:50:38.0014 3356 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2011/06/16 10:50:38.0063 3356 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2011/06/16 10:50:38.0122 3356 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/06/16 10:50:38.0165 3356 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/06/16 10:50:38.0222 3356 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/06/16 10:50:38.0311 3356 usbaudio (292a25bb75a568ae2c67169ba2c6365a) C:\Windows\system32\drivers\usbaudio.sys
2011/06/16 10:50:38.0364 3356 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/06/16 10:50:38.0416 3356 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/06/16 10:50:38.0455 3356 usbehci (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
2011/06/16 10:50:38.0498 3356 usbhub (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
2011/06/16 10:50:38.0543 3356 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/06/16 10:50:38.0601 3356 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/06/16 10:50:38.0652 3356 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/06/16 10:50:38.0702 3356 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/06/16 10:50:38.0763 3356 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/06/16 10:50:38.0821 3356 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/06/16 10:50:38.0945 3356 VClone (1cdaa48cb2f7744b8d25650e050766a5) C:\Windows\system32\DRIVERS\VClone.sys
2011/06/16 10:50:39.0007 3356 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/06/16 10:50:39.0051 3356 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/06/16 10:50:39.0104 3356 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2011/06/16 10:50:39.0140 3356 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2011/06/16 10:50:39.0176 3356 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2011/06/16 10:50:39.0234 3356 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/06/16 10:50:39.0269 3356 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2011/06/16 10:50:39.0342 3356 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2011/06/16 10:50:39.0392 3356 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2011/06/16 10:50:39.0458 3356 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/06/16 10:50:39.0502 3356 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/16 10:50:39.0525 3356 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/16 10:50:39.0606 3356 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2011/06/16 10:50:39.0670 3356 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/06/16 10:50:39.0857 3356 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/06/16 10:50:39.0952 3356 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/06/16 10:50:40.0033 3356 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/06/16 10:50:40.0142 3356 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
2011/06/16 10:50:40.0163 3356 ================================================================================
2011/06/16 10:50:40.0163 3356 Scan finished
2011/06/16 10:50:40.0163 3356 ================================================================================
2011/06/16 10:50:40.0183 2932 Detected object count: 1
2011/06/16 10:50:40.0183 2932 Actual detected object count: 1
2011/06/16 10:51:02.0646 2932 HKLM\SYSTEM\ControlSet001\services\sptd - will be deleted after reboot
2011/06/16 10:51:02.0703 2932 HKLM\SYSTEM\ControlSet002\services\sptd - will be deleted after reboot
2011/06/16 10:51:02.0746 2932 C:\Windows\system32\Drivers\sptd.sys - will be deleted after reboot
2011/06/16 10:51:02.0746 2932 LockedFile.Multi.Generic(sptd) - User select action: Delete

cosinus · 16.06.2011, 10:46

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

imperator88 · 16.06.2011, 14:55

Combofix Logfile:

Code:

ATTFilter

ComboFix 11-06-15.04 - Michael Wehrmann 16.06.2011  15:39:38.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.2936.2142 [GMT 2:00]
ausgeführt von:: c:\users\Michael Wehrmann\Desktop\cofi.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Michael Wehrmann\AppData\Roaming\EurekaLog
c:\windows\IsUn0407.exe
D:\install.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-05-16 bis 2011-06-16  ))))))))))))))))))))))))))))))
.
.
2011-06-16 13:48 . 2011-06-16 13:49	--------	d-----w-	c:\users\Michael Wehrmann\AppData\Local\temp
2011-06-16 13:48 . 2011-06-16 13:48	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-06-16 13:48 . 2011-06-16 13:48	--------	d-----w-	c:\windows\ServiceProfiles\LocalService\AppData\Local\temp
2011-06-16 08:22 . 2011-06-16 08:22	--------	d-----w-	c:\program files\7-Zip
2011-06-16 08:11 . 2011-06-16 08:36	--------	d-----w-	C:\_OTL
2011-06-15 19:11 . 2011-06-15 19:11	--------	d-----w-	c:\windows\system32\EventProviders
2011-06-15 15:40 . 2011-06-15 15:40	--------	d-----w-	C:\Downloads
2011-06-14 21:53 . 2011-06-14 21:53	--------	d-----w-	c:\program files\Microsoft CAPICOM 2.1.0.2
2011-06-14 21:02 . 2010-02-12 10:48	293376	----a-w-	c:\windows\system32\browserchoice.exe
2011-06-14 20:51 . 2009-11-08 08:55	99176	----a-w-	c:\windows\system32\PresentationHostProxy.dll
2011-06-14 20:51 . 2009-11-08 08:55	49472	----a-w-	c:\windows\system32\netfxperf.dll
2011-06-14 20:51 . 2009-11-08 08:55	297808	----a-w-	c:\windows\system32\mscoree.dll
2011-06-14 20:51 . 2009-11-08 08:55	295264	----a-w-	c:\windows\system32\PresentationHost.exe
2011-06-14 20:51 . 2009-11-08 08:55	1130824	----a-w-	c:\windows\system32\dfshim.dll
2011-06-14 20:48 . 2010-02-20 23:39	24064	----a-w-	c:\windows\system32\nshhttp.dll
2011-06-14 20:48 . 2010-02-20 23:37	31232	----a-w-	c:\windows\system32\httpapi.dll
2011-06-14 20:48 . 2010-02-20 21:18	411136	----a-w-	c:\windows\system32\drivers\http.sys
2011-06-14 20:46 . 2010-09-20 09:25	231936	----a-w-	c:\windows\system32\msshsq.dll
2011-06-14 20:37 . 2009-09-10 15:21	1418752	----a-w-	c:\program files\Windows Media Player\setup_wm.exe
2011-06-14 20:37 . 2009-09-10 15:21	310784	----a-w-	c:\windows\system32\unregmp2.exe
2011-06-14 20:37 . 2009-09-10 15:21	168960	----a-w-	c:\program files\Windows Media Player\wmplayer.exe
2011-06-14 20:37 . 2009-07-14 12:58	7680	----a-w-	c:\windows\system32\spwmp.dll
2011-06-14 20:37 . 2009-07-14 10:58	107520	----a-w-	c:\program files\Windows Media Player\wmpshare.exe
2011-06-14 20:37 . 2009-07-14 12:59	4096	----a-w-	c:\windows\system32\msdxm.ocx
2011-06-14 20:37 . 2009-07-14 12:59	4096	----a-w-	c:\windows\system32\dxmasf.dll
2011-06-14 20:37 . 2009-07-14 10:59	107520	----a-w-	c:\program files\Windows Media Player\wmpconfig.exe
2011-06-14 20:37 . 2009-09-10 15:21	8147456	----a-w-	c:\windows\system32\wmploc.DLL
2011-06-14 20:37 . 2010-10-28 12:56	2048	----a-w-	c:\windows\system32\tzres.dll
2011-06-14 20:35 . 2010-11-06 11:10	357376	----a-w-	c:\windows\system32\taskschd.dll
2011-06-14 20:35 . 2010-11-06 11:09	603648	----a-w-	c:\windows\system32\schedsvc.dll
2011-06-14 20:35 . 2010-11-06 11:10	345088	----a-w-	c:\windows\system32\wmicmiplugin.dll
2011-06-14 20:35 . 2010-11-06 11:10	270336	----a-w-	c:\windows\system32\taskcomp.dll
2011-06-14 20:35 . 2010-11-05 00:53	171520	----a-w-	c:\windows\system32\taskeng.exe
2011-06-14 20:35 . 2009-07-14 13:00	313344	----a-w-	c:\windows\system32\wmpdxm.dll
2011-06-14 20:33 . 2010-08-31 15:40	531968	----a-w-	c:\windows\system32\comctl32.dll
2011-06-14 20:33 . 2010-06-11 15:30	1257472	----a-w-	c:\windows\system32\msxml3.dll
2011-06-14 20:33 . 2009-04-02 12:37	604672	----a-w-	c:\windows\system32\WMSPDMOD.DLL
2011-06-14 20:32 . 2010-01-25 12:48	472576	----a-w-	c:\windows\system32\secproc_isv.dll
2011-06-14 20:32 . 2010-01-25 12:48	472064	----a-w-	c:\windows\system32\secproc.dll
2011-06-14 20:32 . 2010-01-25 08:35	346624	----a-w-	c:\windows\system32\RMActivate_ssp_isv.exe
2011-06-14 20:32 . 2010-01-25 08:35	523776	----a-w-	c:\windows\system32\RMActivate_isv.exe
2011-06-14 20:32 . 2010-01-25 08:34	511488	----a-w-	c:\windows\system32\RMActivate.exe
2011-06-14 20:32 . 2010-01-25 08:34	347136	----a-w-	c:\windows\system32\RMActivate_ssp.exe
2011-06-14 20:32 . 2010-01-25 12:48	151040	----a-w-	c:\windows\system32\secproc_ssp_isv.dll
2011-06-14 20:32 . 2010-01-25 12:48	151040	----a-w-	c:\windows\system32\secproc_ssp.dll
2011-06-14 20:32 . 2010-01-25 12:45	329216	----a-w-	c:\windows\system32\msdrm.dll
2011-06-14 20:32 . 2011-05-02 12:00	2409784	----a-w-	c:\program files\Windows Mail\OESpamFilter.dat
2011-06-14 20:32 . 2009-04-23 12:43	784896	----a-w-	c:\windows\system32\rpcrt4.dll
2011-06-14 20:31 . 2009-12-28 12:35	11776	----a-w-	c:\windows\system32\tsbyuv.dll
2011-06-14 20:31 . 2009-12-28 12:32	22528	----a-w-	c:\windows\system32\msyuv.dll
2011-06-14 20:31 . 2009-12-28 12:32	31744	----a-w-	c:\windows\system32\msvidc32.dll
2011-06-14 20:31 . 2009-12-28 12:32	13312	----a-w-	c:\windows\system32\msrle32.dll
2011-06-14 20:31 . 2009-12-28 12:31	50176	----a-w-	c:\windows\system32\iyuv_32.dll
2011-06-14 20:31 . 2009-12-28 12:28	91136	----a-w-	c:\windows\system32\avifil32.dll
2011-06-14 20:31 . 2009-12-28 12:32	123904	----a-w-	c:\windows\system32\msvfw32.dll
2011-06-14 20:31 . 2009-12-28 12:31	82944	----a-w-	c:\windows\system32\mciavi32.dll
2011-06-14 20:31 . 2009-12-28 12:28	65024	----a-w-	c:\windows\system32\avicap32.dll
2011-06-14 20:31 . 2010-12-17 16:43	2067456	----a-w-	c:\windows\system32\mstscax.dll
2011-06-14 20:31 . 2010-12-17 15:06	677888	----a-w-	c:\windows\system32\mstsc.exe
2011-06-14 20:31 . 2011-05-02 15:58	738816	----a-w-	c:\windows\system32\inetcomm.dll
2011-06-14 20:30 . 2010-10-18 14:01	81920	----a-w-	c:\windows\system32\consent.exe
2011-06-14 20:30 . 2010-01-21 15:59	62464	----a-w-	c:\windows\system32\l3codeca.acm
2011-06-14 20:28 . 2009-02-13 08:49	1255936	----a-w-	c:\windows\system32\lsasrv.dll
2011-06-14 20:28 . 2009-03-17 03:38	13824	----a-w-	c:\windows\system32\apilogen.dll
2011-06-14 20:28 . 2009-03-17 03:38	24064	----a-w-	c:\windows\system32\amxread.dll
2011-06-14 20:28 . 2009-02-13 08:49	72704	----a-w-	c:\windows\system32\secur32.dll
2011-06-14 20:08 . 2011-05-24 17:12	6962000	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{26E12B43-B7DA-4AC5-8C12-D9BE37F51474}\mpengine.dll
2011-06-14 20:06 . 2009-12-23 12:43	171520	----a-w-	c:\windows\system32\wintrust.dll
2011-06-14 20:04 . 2010-01-15 00:04	98304	----a-w-	c:\windows\system32\cabview.dll
2011-06-14 18:44 . 2011-06-14 18:44	--------	d-----w-	c:\users\Michael Wehrmann\AppData\Roaming\Malwarebytes
2011-06-14 18:44 . 2011-05-29 07:11	39984	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-14 18:44 . 2011-06-14 18:44	--------	d-----w-	c:\programdata\Malwarebytes
2011-06-14 18:44 . 2011-06-14 18:44	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-06-14 18:23 . 2011-04-14 16:40	142296	----a-w-	c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-06-14 18:23 . 2011-04-14 16:40	89048	----a-w-	c:\program files\Mozilla Firefox\libEGL.dll
2011-06-14 18:23 . 2011-04-14 16:40	781272	----a-w-	c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-06-14 18:23 . 2011-04-14 16:40	465880	----a-w-	c:\program files\Mozilla Firefox\libGLESv2.dll
2011-06-14 18:23 . 2011-04-14 16:40	1874904	----a-w-	c:\program files\Mozilla Firefox\mozjs.dll
2011-06-14 18:23 . 2011-04-14 16:40	15832	----a-w-	c:\program files\Mozilla Firefox\mozalloc.dll
2011-06-14 18:23 . 2010-01-01 08:00	1974616	----a-w-	c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-06-14 18:23 . 2010-01-01 08:00	1892184	----a-w-	c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-06-12 12:09 . 2011-06-14 15:44	--------	d-----w-	c:\users\Michael Wehrmann\.freemind
2011-06-12 12:08 . 2011-06-12 12:08	--------	d-----w-	c:\program files\FreeMind
2011-06-01 19:44 . 2011-06-14 18:04	--------	d-----w-	c:\program files\ICQ7.5
2011-05-27 07:01 . 2011-05-27 07:01	95672	----a-w-	c:\program files\Mozilla Firefox\plugins\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-24 17:14 . 2010-12-28 09:55	222080	------w-	c:\windows\system32\MpSigStub.exe
2011-04-14 16:40 . 2011-06-14 18:23	142296	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-12 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-12 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-12 145944]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-05-27 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-29 937920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-05-29 07:11	449584	----a-w-	c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-10-31 11:06	6609440	----a-w-	c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" -autorun
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" /hide
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"MobileConnect"=%programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4021776669-3632399173-1879490895-1000]
"EnableNotificationsRef"=dword:00000001
.
R1 vcdrom;Virtual CD-ROM Device Driver;c:\users\Michael Wehrmann\Desktop\diablo 2\VCdRom.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
R3 AVerAF15;AVerMedia BDA Digital Tuner;c:\windows\system32\Drivers\AVerAF15.sys [2007-07-17 269056]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-06-29 112128]
R3 Hecfdiacc;Hecfdiacc; [x]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2009-06-29 102912]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2009-09-11 9216]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2008-06-24 337920]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - BMLoad
.
.
------- Zusätzlicher Suchlauf -------
.
IE: ???QQ??
IE: Free YouTube to Mp3 Converter - c:\users\Michael Wehrmann\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
LSP: bmnet.dll
DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
FF - ProfilePath - c:\users\Michael Wehrmann\AppData\Roaming\Mozilla\Firefox\Profiles\a7xxmj5j.default\
FF - prefs.js: browser.startup.homepage - google.de
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
------- Dateityp-Verknüpfung -------
.
txtfile=c:\windows\notepad.exe %1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-25108333.sys
AddRemove-Baldur's Gate - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-06-16 15:49
Windows 6.0.6001 Service Pack 1 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]
"OOSAFEERASE03.00.00.01MSWINDOWS"="199BC25A69F7A3CC6F011FCC60EDDAD5D68BCC1C23E915A451C8F266996BAA2C0C92DEA4AC4392DADA1C6909A764657A860B1DEB6F48BC2B69A1444F0762DAE85A79ACE7619F1DA1EBCED03D0978CCDB745C43591319B06CF041F186620DF93DA87EB71D3F8679A63482B8E4B9ADAB51C1C294FD5E850EAF356469E53ADD4B0291F722013155ACF2BBC6163B22696DB481A6FC38571FC73F756BA90DD1AFE493A05FA092D7CD9412FACAF5435DF6D2E238117BA9B758A16AE65B475E9E3DB3CF57517C9506946016E0E57341BE04713E6331A439FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B98085D575E7D6A3B9808A9C6AECB7A5D14070B9563DA0D3A042CEBD65DE936C90794DA2849D7FDDC36DC4AAFC7F9B02B0CB9A9DDAB6566DBBD851304BE198EE627E8B96E5C33C9F71320319FD63799EC44C37D0DB26358DF59A97EF32D1A0EC17ED61EBC19558386EB7559E97F31B3DAB46C921E20FC8871ED77B42F35E46760175AAB428EA988085F9B2587F664AC8C35D327F4EE5F91E3A58F739EB778416E1137BC13A39E30A023952BD3C8D0A640ACDEAFD5F0BA80AC3FD52B9068D537B81EF25EA592263F18FD2BB4915379B4D59936D36A48C4D7658C7400B8D083583306D7D2D6E73773594EE6C1E14966E1D28DC46EBEEC348CCBF2D8C9AC4E0B27F4A5F48F64074DFCF5021805CEB2A228E02C3C0FC52BC70BC26E3416E691F89AB96B1B3DF124667FA020D163C568BEFB4BB08E79D4A2BE2F4F0C7A26451FDE1F5ED960BA094A0512313E6BF8159A4DC003E6F5A52546DECC9BEDE6EC8BCED392E68820989156B043A4898014F2CBE6CE1F316E3ED3DF70A875CA74145E4E71C7FA23F79C5EFA72101A43EFB576D1A7F45584B6A462093F7C50ED65F7C91FD386E4E8C9C021BCDA6E563E5C961D59AD7385E8D2E8B6B21DF63FB3BF283B141E0992ACBBB170F6FBC5BF64ADA0C65F9CFD2FFD8CD6991FDD3A7D8FCA6905D7F5FE98D6395149566BF163B08D70B6B79DBF77F2EF66B7E8DADB6A0814B55FE6838B2DE06EB58A5CC44470B36DDA9709DB54260E4C492579EF6686B6EDB7E1117545A95B4EA7775F26FE3C117F6574CD07CDA9A836E1D3917ED776CAEC510D7B7DB610E98FA4B789325A3C033A4BBDD35130923005C71FC46BA18605E996421F515F01C12C5E56D711048ED3587A48C074F495A4D5C7C47B1E2AA33C82CF48492A334431613B439DEB9972E45A154C082B888B9C09DFE57003CA5EDB18F9C8194618449432D3D07EF032CB2A83F1E6F6344D7142C1C386B30E53EE61CE45D306666A1161E4F5B775D3D2222CD99C172BD5976850E85B122A2F042EDE8F96DA565177DB9D03A2934FCBF9A107A952C196D4"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(600)
c:\windows\system32\bmnet.dll
.
Zeit der Fertigstellung: 2011-06-16  15:52:33
ComboFix-quarantined-files.txt  2011-06-16 13:52
.
Vor Suchlauf: 11 Verzeichnis(se), 54.936.539.136 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 54.984.900.608 Bytes frei
.
- - End Of File - - 883343D363376C2F74BC51546F4301A8

--- --- ---

cosinus · 16.06.2011, 15:03

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

auch "ide/sata festplatte beschädigt" - aber systemwiederherstellung gelungen!

Log-Analyse und Auswertung: auch "ide/sata festplatte beschädigt" - aber systemwiederherstellung gelungen!